Live › vulnerability › CVE-2026-74049
Go to dashboardApache Tomcat has an Execution After Redirect (EAR) flaw in several release lines, where code can keep running after a redirect is sent. The sources do not say what an attacker can read or change through it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache Tomcat in the listed version ranges, including end-of-life 8.5.x and 7.0.x installs. The sources do not say which application patterns trigger the flaw, so treat all Tomcat servers in those ranges as in scope.
No product ranges from the sources yet.
catalina.sh version or check the Tomcat version in the server status page to see whether it is in an affected range: 11.0.0-M1 to 11.0.26, 10.1.0-M1 to 10.1.60, 9.0.0.M1 to 9.0.122, or any 8.5.x or 7.0.x release.11.0.27.10.1.61.9.0.123.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-74049")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.