---
id: "CVE-2026-53404"
kind: "vulnerability"
aliases: ["CVE-2026-53404", "GHSA-h792-v28v-ppgr"]
title: "Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerability"
severity: "high"
cvss: 7.3
epss: 0.00652
exploited: false
status: "open"
category: "runtime"
products: [{"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["11.0.23"], "affected": ">= 11.0.0-M1, < 11.0.23", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["10.1.56"], "affected": ">= 10.1.0-M1, < 10.1.56", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["9.0.119"], "affected": ">= 9.0.0.M1, < 9.0.119", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["11.0.23"], "affected": ">= 11.0.0-M1, < 11.0.23", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["10.1.56"], "affected": ">= 10.1.0-M1, < 10.1.56", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["9.0.119"], "affected": ">= 9.0.0.M1, < 9.0.119", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": ["11.0.23"], "affected": ">= 11.0.0-M1, < 11.0.23", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": ["10.1.56"], "affected": ">= 10.1.0-M1, < 10.1.56", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": ["9.0.119"], "affected": ">= 9.0.0.M1, < 9.0.119", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["cwe-670", "java", "runtime", "self-hosted", "tomcat"]
not_affected_if: ["no-or-conditions", "no-rewrite-valve"]
published_at: "2026-06-29T21:32:15+00:00"
first_seen_at: "2026-11-04T16:44:44+00:00"
updated_at: "2026-11-04T16:45:11+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-h792-v28v-ppgr", "first_seen_at": "2026-11-04T16:44:44+00:00"}]
---

# Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerability

In Apache Tomcat's rewrite valve, if the first condition in an OR chain matches, later non-OR conditions are skipped. An attacker can get requests past rewrite-based access rules that the administrator meant to enforce.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 11.0.0-M1, < 11.0.23 fixed 11.0.23
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 10.1.0-M1, < 10.1.56 fixed 10.1.56
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 9.0.0.M1, < 9.0.119 fixed 9.0.119
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 8.5.0, <= 8.5.100 fixed ?
- maven:org.apache.tomcat:tomcat affected >= 11.0.0-M1, < 11.0.23 fixed 11.0.23
- maven:org.apache.tomcat:tomcat affected >= 10.1.0-M1, < 10.1.56 fixed 10.1.56
- maven:org.apache.tomcat:tomcat affected >= 9.0.0.M1, < 9.0.119 fixed 9.0.119
- maven:org.apache.tomcat:tomcat affected >= 8.5.0, <= 8.5.100 fixed ?
- maven:org.apache.tomcat:tomcat-catalina affected >= 11.0.0-M1, < 11.0.23 fixed 11.0.23
- maven:org.apache.tomcat:tomcat-catalina affected >= 10.1.0-M1, < 10.1.56 fixed 10.1.56
- maven:org.apache.tomcat:tomcat-catalina affected >= 9.0.0.M1, < 9.0.119 fixed 9.0.119
- maven:org.apache.tomcat:tomcat-catalina affected >= 8.5.0, <= 8.5.100 fixed ?

## How to check

- Check the Tomcat version with `catalina.sh version` and compare it to the affected ranges.
- Look for `RewriteCond` rules with OR chains (`[OR]` flag) in `rewrite.config` or the context's rewrite configuration.
- Check whether the Maven dependency `org.apache.tomcat.embed:tomcat-embed-core` or `org.apache.tomcat:tomcat-catalina` is in use at an affected version.

## Fix

- Apache Tomcat 11.0.x: upgrade to `11.0.23`
- Apache Tomcat 10.1.x: upgrade to `10.1.56`
- Apache Tomcat 9.0.x: upgrade to `9.0.119`
- Apache Tomcat 8.5.x: unknown, the sources list no fixed version for 8.5.

## Timeline

- 2026-11-04T16:44:44+00:00 ghsa https://github.com/advisories/GHSA-h792-v28v-ppgr

## Documents

- [fix] Patch: github.com https://github.com/apache/tomcat/commit/b647cb584cea8bf95e64f5d2526c59ab8fca3225
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/bbb6219fa5ac185060bef7842cee5fb90230ca00
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/fe06ae8a71997061596f54189dae1b1b5da75430

## From the sources

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_