Execution After Redirect Vulnerability in Apache Tomcat Packages
Summary
DEBIAN-CVE-2026-74049: Execution After Redirect (EAR) vulnerability in Apache Tomcat. Affects tomcat10 versions 10.1.10-1 – 10.1.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The affected versions of Tomcat include 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122, all of which are vulnerable to an Execution After Redirect (EAR) issue.
Vulnerability Detail
The Execution After Redirect (EAR) vulnerability in Apache Tomcat allows an attacker to execute arbitrary code after a redirect has occurred. This can lead to unauthorized access and manipulation of sensitive data. The vulnerability arises from improper handling of redirects, which can be exploited by attackers to gain control over the application. The affected versions include both supported and end-of-life releases, making it critical for users to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected applications or implement additional security measures to monitor and control redirect behavior until the upgrade can be performed.
Conclusion
The Execution After Redirect vulnerability in Apache Tomcat poses significant risks to applications using affected versions. Users are strongly advised to upgrade to the latest patched versions to mitigate these risks. For those unable to upgrade immediately, implementing temporary security measures is recommended.
See every vulnerability recorded for tomcat10 →
FAQ
It is a security flaw that allows attackers to execute arbitrary code after a redirect, potentially compromising the application.
Versions from 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122 are affected, along with certain end-of-life versions.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
Implement security measures to restrict access to the affected applications and monitor for unusual activity until an upgrade can be performed.
Yes, Vulert allows you to monitor vulnerabilities in your software using a manifest file like package-lock.json without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for tomcat10.
