CVE-2026-53404 Apache Tomcat: Bad ornext processing in RewriteValve
Attackers can bypass rewrite rules in Apache Tomcat due to incorrect control flow in the RewriteValve, potentially circumventing security restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53404?
CVE-2026-53404 is a high-severity vulnerability in Apache Tomcat, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
Weakness: CWE-670
Which versions are affected by CVE-2026-53404?
1 open source package ship an affected version, including tomcat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tomcat Bitnami | All versions | 9.0.101, 10.1.37, 11.0.5 |
Products include Apache Tomcat.
How do I fix CVE-2026-53404?
Upgrade tomcat to a fixed version for your release line: 9.0.101, 10.1.37 or 11.0.5.
Is CVE-2026-53404 being exploited?
There is no known exploitation of CVE-2026-53404 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2026-53404, DEBIAN-CVE-2026-53404, GHSA-h792-v28v-ppgr, UBUNTU-CVE-2026-53404.