CVE-2026-24733: Apache Tomcat Security Constraint Bypass via HTTP/0.9 Requests
Summary
CVE-2026-24733: Apache Tomcat: Security constraint bypass with HTTP/0.9. Affects tomcat across 3 version ranges.
< 9.0.113
>= 10.1.0, < 10.1.50
>= 11.0.0, < 11.0.15
Fixed in 9.0.113, 10.1.50 or 11.0.15, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-24733 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. However, certain versions of Tomcat are vulnerable to a security constraint bypass issue that can be exploited through improper handling of HTTP/0.9 requests.
Vulnerability Detail
The vulnerability arises from Apache Tomcat's failure to restrict HTTP/0.9 requests to the GET method. This oversight allows an attacker to bypass security constraints configured to deny GET requests while allowing HEAD requests. By sending an invalid HEAD request using HTTP/0.9, the attacker can access resources that should be protected, potentially leading to unauthorized information disclosure or other security breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 9.0.1139.0.113 -
>= 10.1.0, < 10.1.5010.1.50 -
>= 11.0.0, < 11.0.1511.0.15
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement additional filtering or validation on incoming requests to reject any HTTP/0.9 requests that do not conform to expected methods. This can be done by configuring the web server or application to explicitly deny such requests.
Conclusion
In summary, CVE-2026-24733 is a significant vulnerability in Apache Tomcat that allows for security constraint bypass through HTTP/0.9 requests. Users are strongly advised to upgrade to the latest patched versions to mitigate the risk of exploitation.
See every vulnerability recorded for tomcat →
FAQ
CVE-2026-24733 is a vulnerability in Apache Tomcat that allows attackers to bypass security constraints using HTTP/0.9 requests.
The vulnerability affects Apache Tomcat versions from 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.49, and 9.0.0.M1 through 9.0.112.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, consider implementing request filtering to block HTTP/0.9 requests as a temporary measure.
More information can be found in the official Apache Tomcat security advisories and the CVE database.
References
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
