CVE-2026-53404: Apache Tomcat Rewrite Valve Logic Flaw—Bypass Risk & Patch Guidance

Technical summary

The vulnerability resides in Tomcat's ModRewrite valve implementation, which handles URL rewrite conditions. When evaluating a chain of conditions connected by OR operators, if the first OR condition evaluates to true, the valve's control flow incorrectly bypasses subsequent non-OR conditions without evaluation. This represents an always-incorrect implementation of the logical operator precedence and short-circuiting behavior expected in conditional rule chains. The defect permits rewrite rules that combine OR and non-OR operators to execute with incomplete condition validation, leading to unintended request routing or modification outcomes.

Business impact

Organizations relying on Tomcat's rewrite valve for security policies—such as blocking malicious traffic patterns, enforcing URL normalization, or routing sensitive requests—may find those policies partially or completely ineffective. If rewrite rules protect against specific attack vectors or ensure compliance with URL standards, the logic flaw can allow prohibited requests to pass through. This is particularly concerning for enterprises using Tomcat as a reverse proxy or in load-balancing architectures where rewrite rules are critical control points.

Affected systems

The vulnerability affects Apache Tomcat versions 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0-M1 through 9.0.118, and 8.5.0 through 8.5.100. End-of-support versions in these branches may also be vulnerable. Organizations running patched versions 11.0.23, 10.1.56, or 9.0.119 and later are not affected. Version 8.5 users should verify patch availability with the vendor.

Exploitability

Exploitation requires no authentication, no special interaction, and can be triggered over the network. However, weaponization depends on the specific rewrite rules deployed in a target environment. An attacker must understand the intended logic of deployed rules to craft requests that exploit the condition-skipping flaw. This means the practical attack surface varies widely—high-value in environments where rewrite rules gate access to sensitive functions, lower in environments where rules serve non-critical purposes. No public exploit code is known to exist.

Remediation

Upgrade to patched versions: Tomcat 11.0.23 or later, 10.1.56 or later, or 9.0.119 or later. For version 8.5 systems, verify patch availability and timeline with the Apache Tomcat project. Organizations unable to patch immediately should audit rewrite valve configurations to identify rules combining OR and non-OR conditions, and consider temporarily disabling or refactoring affected rules.

Patch guidance

Apply updates in the following priority order: production systems first, then staging and development. Test rewrite rules thoroughly post-patch to confirm rule logic executes as originally intended. Pay special attention to rules that mix OR and non-OR operators, as these were the ones exhibiting the flaw. Verify that security-critical rules (such as those blocking known attack patterns) are functioning correctly.

Detection guidance

Review Tomcat rewrite valve configurations for rules that combine OR and non-OR operators. Enable detailed logging in the rewrite valve to capture condition evaluation sequences. Monitor for unexpected traffic patterns or requests that should have been blocked according to rewrite rule logic. Compare observed request routing against documented rule intent. Inspect access logs for signs of requests matching known malicious patterns that were intended to be blocked by rewrite rules.

Why prioritize this

This vulnerability merits urgent attention because it undermines the integrity of a core security control—URL rewriting—that many organizations depend on for traffic filtering and policy enforcement. The CVSS score of 7.3 reflects network accessibility and potential for information disclosure and integrity compromise. While exploit complexity is low, real-world impact depends on rule configuration; environments with security-critical rewrite policies should treat this as a priority patch.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects: network-based attack vector (AV:N), low attack complexity (AC:L), no authentication required (PR:N), and impact to confidentiality, integrity, and availability of requests processed by the rewrite valve (C:L/I:L/A:L). The scope is unchanged (S:U). The severity is elevated by the fact that rewrite rules are often deployed in trust-critical paths, but is moderated by the requirement that an attacker understand target rule logic to exploit the flaw effectively.

Frequently asked questions