{"id":"CVE-2026-53404","kind":"vulnerability","aliases":["CVE-2026-53404","GHSA-h792-v28v-ppgr"],"related":[],"title":"Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerability","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.","summary":"In Apache Tomcat's rewrite valve, if the first condition in an OR chain matches, later non-OR conditions are skipped. An attacker can get requests past rewrite-based access rules that the administrator meant to enforce.","severity":"high","cvss":7.3,"epss":0.00652,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":["11.0.23"],"affected":">= 11.0.0-M1, < 11.0.23","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":["10.1.56"],"affected":">= 10.1.0-M1, < 10.1.56","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":["9.0.119"],"affected":">= 9.0.0.M1, < 9.0.119","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["11.0.23"],"affected":">= 11.0.0-M1, < 11.0.23","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["10.1.56"],"affected":">= 10.1.0-M1, < 10.1.56","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["9.0.119"],"affected":">= 9.0.0.M1, < 9.0.119","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":["11.0.23"],"affected":">= 11.0.0-M1, < 11.0.23","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":["10.1.56"],"affected":">= 10.1.0-M1, < 10.1.56","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":["9.0.119"],"affected":">= 9.0.0.M1, < 9.0.119","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-670","java","runtime","self-hosted","tomcat"],"not_affected_if":["no-or-conditions","no-rewrite-valve"],"how_to_check":"- Check the Tomcat version with `catalina.sh version` and compare it to the affected ranges.\n- Look for `RewriteCond` rules with OR chains (`[OR]` flag) in `rewrite.config` or the context's rewrite configuration.\n- Check whether the Maven dependency `org.apache.tomcat.embed:tomcat-embed-core` or `org.apache.tomcat:tomcat-catalina` is in use at an affected version.","fix":"- Apache Tomcat 11.0.x: upgrade to `11.0.23`\n- Apache Tomcat 10.1.x: upgrade to `10.1.56`\n- Apache Tomcat 9.0.x: upgrade to `9.0.119`\n- Apache Tomcat 8.5.x: unknown, the sources list no fixed version for 8.5.","status":"open","published_at":"2026-06-29T21:32:15+00:00","first_seen_at":"2026-11-04T16:44:44+00:00","triaged_at":"2026-11-04T16:45:11+00:00","updated_at":"2026-11-04T16:45:11+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-04T16:45:11Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Tomcat 11.0.x: upgrade to `11.0.23`\n- Apache Tomcat 10.1.x: upgrade to `10.1.56`\n- Apache Tomcat 9.0.x: upgrade to `9.0.119`\n- Apache Tomcat 8.5.x: unknown, the sources list no fixed version for 8.5.","reach":"internet","title":"Apache Tomcat: rewrite valve skips conditions, bypassing rewrite rules","impact":"medium","summary":"In Apache Tomcat's rewrite valve, if the first condition in an OR chain matches, later non-OR conditions are skipped. An attacker can get requests past rewrite-based access rules that the administrator meant to enforce.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["tomcat","java","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"requests bypass rewrite-based access rules meant to block them","analyst_note":"Confirm whether a fixed version exists for Tomcat 8.5 (listed as '?') at https://github.com/advisories/GHSA-h792-v28v-ppgr.","how_to_check":"- Check the Tomcat version with `catalina.sh version` and compare it to the affected ranges.\n- Look for `RewriteCond` rules with OR chains (`[OR]` flag) in `rewrite.config` or the context's rewrite configuration.\n- Check whether the Maven dependency `org.apache.tomcat.embed:tomcat-embed-core` or `org.apache.tomcat:tomcat-catalina` is in use at an affected version.","plain_action":"","needs_analyst":true,"not_affected_if":["no-rewrite-valve","no-or-conditions"],"who_is_affected":"Exposed only where a Tomcat rewrite valve is configured with OR-chained RewriteCond rules that guard access or routing. Deployments that do not use the rewrite valve, or that use only non-OR conditions, are not affected. Versions 8.5.x have no listed fix, and the sources say other end-of-support versions may also be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000884,"input_tokens":4925,"output_tokens":783,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,24A '-53404':17A,25A '-670':71B '10.1.0':159C '10.1.55':162C '10.1.56':192C '11.0.0':154C '11.0.22':157C '11.0.23':191C '8.5.0':169C '8.5.100':171C '9.0.0':164C '9.0.118':167C '9.0.119':194C 'access':109B 'administr':113B 'affect':150C,183C 'also':181C 'alway':9A,118C 'always-incorrect':8A,117C 'apach':1A,79B,125C,151C 'attack':101B 'base':108B 'catalina':57A,61A,65A,69A 'chain':91B,139C 'condit':87B,97B,135C,145C 'control':11A,120C 'core':30A,35A,40A,45A 'cve':15A,23A 'cwe':70B 'embed':29A,34A,39A,44A 'end':177C 'enforc':116B 'first':86B,134C 'fix':196C 'flow':12A,121C 'get':103B 'ghsa':19A 'ghsa-h792-v28v-ppgr':18A 'h792':20A 'host':76B 'implement':13A,122C 'incorrect':10A,119C 'issu':149C,198C 'java':72B 'later':93B 'm1':155C,160C,165C 'match':92B,140C 'may':180C 'meant':114B,130C 'non':95B,143C 'non-or':94B,142C 'org.apache.tomcat':46A,48A,50A,52A,54A,58A,62A,66A 'org.apache.tomcat.embed':26A,31A,36A,41A 'past':105B 'ppgr':22A 'reach':176C 'recommend':186C 'request':104B 'rewrit':4A,82B,107B,128C 'rewrite-bas':106B 'rule':110B 'runtim':73B 'self':75B 'self-host':74B 'skip':99B,147C 'subsequ':141C 'support':179C 'tomcat':2A,28A,33A,38A,43A,47A,49A,51A,53A,56A,60A,64A,68A,77B,80B,126C,152C 'tomcat-catalina':55A,59A,63A,67A 'tomcat-embed-core':27A,32A,37A,42A 'upgrad':188C 'user':184C 'v28v':21A 'valv':5A,83B,129C 'version':173C,190C 'vulner':14A,123C","nicknames":[],"mitigations":[],"who_affected":"Exposed only where a Tomcat rewrite valve is configured with OR-chained RewriteCond rules that guard access or routing. Deployments that do not use the rewrite valve, or that use only non-OR conditions, are not affected. Versions 8.5.x have no listed fix, and the sources say other end-of-support versions may also be affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["orgapachetomcatembedtomcatembedcore","orgapachetomcattomcat","orgapachetomcattomcatcatalina"],"ptokens":["apache","catalina","core","embed","org","tomcat"],"labels":["cwe670","high","java","maven","runtime","selfhosted","tomcat"],"campaign_type":null,"first_public_at":"2026-06-29T21:32:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-h792-v28v-ppgr","url":"https://github.com/advisories/GHSA-h792-v28v-ppgr","severity":"high","published_at":"2026-06-29T21:32:15+00:00","modified_at":"2026-11-04T16:43:25+00:00","first_seen_at":"2026-11-04T16:44:44+00:00","fetched_at":"2026-11-04T16:49:52+00:00","note":null}],"documents":[{"id":68560,"url":"https://github.com/apache/tomcat/commit/b647cb584cea8bf95e64f5d2526c59ab8fca3225","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68561,"url":"https://github.com/apache/tomcat/commit/bbb6219fa5ac185060bef7842cee5fb90230ca00","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68562,"url":"https://github.com/apache/tomcat/commit/fe06ae8a71997061596f54189dae1b1b5da75430","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}