- Description
- Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.
- Source
- security@apache.org
- NVD status
- Analyzed
- Products
- tomcat
CVSS 3.1
- Type
- Secondary
- Base score
- 9.1
- Impact score
- 5.2
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity
- CRITICAL
- security@apache.org
- CWE-177
- Hype score
- Not currently trending
CVE-2026-59083: Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass https://t.co/rttxyYQYYU CVE-2026-59084: Apache Tomcat: EncryptInterceptor requirements not clearly documented https://t.co/6mSzl8qZhO
@oss_security
18 Jul 2026
386 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
🚨*CVE* CVE-2026-59083 Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issu… https://t.co/Bx5D8xXh3l ----- Traducción: CVE-2026-59083 Man… https://t.co/utmtNg
@infoflowcloud
14 Jul 2026
28 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6626CE25-E8F0-4F67-ACEB-363F6D2BDEEC",
"versionEndIncluding": "8.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FF43D0D7-FBF3-4D7A-84C4-47B65A75A524",
"versionEndIncluding": "8.5.100",
"versionStartIncluding": "8.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C8665E8D-D2A4-46FF-A126-75EDE95FCA35",
"versionEndIncluding": "9.0.119",
"versionStartIncluding": "9.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B3DEC2A-7E4A-4851-8466-AFCC4B249748",
"versionEndIncluding": "10.1.56",
"versionStartIncluding": "10.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"matchCriteriaId": "30943912-13A4-40D8-A9E3-9DE3C0008258",
"versionEndIncluding": "11.0.23",
"versionStartIncluding": "11.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]