ORG.APACHE.TOMCAT.EMBED:TOMCAT-EMBED-CORE · CVE-2026-53404 · Runtime
FIX → 11.0.23 · 10.1.56 · 9.0.119
In Apache Tomcat's rewrite valve, if the first condition in an OR chain matches, later non-OR conditions are skipped. An attacker can get requests past rewrite-based access rules that the administrator meant to enforce.
first public Jun 29, 2026 · 1 source
Running Org.apache.tomcat.embed:tomcat-embed-core? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Exposed only where a Tomcat rewrite valve is configured with OR-chained RewriteCond rules that guard access or routing. Deployments that do not use the rewrite valve, or that use only non-OR conditions, are not affected. Versions 8.5.x have no listed fix, and the sources say other end-of-support versions may also be affected.
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
Not affected if no-or-conditions, no-rewrite-valve
Who cares cwe-670, java, self-hosted, tomcat
catalina.sh version and compare it to the affected ranges.RewriteCond rules with OR chains ([OR] flag) in rewrite.config or the context's rewrite configuration.org.apache.tomcat.embed:tomcat-embed-core or org.apache.tomcat:tomcat-catalina is in use at an affected version.Upgrade to 11.0.23 · 10.1.56 · 9.0.119
11.0.2310.1.569.0.119This page as .md · .json · in your agent: get_signal("CVE-2026-53404") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.