CVE-2026-65927 Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control
An off-by-one error in Apache Tomcat's RewriteValve allows attackers to bypass access control rules by exploiting the [N] flag restart behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-65927?
CVE-2026-65927 is a high-severity vulnerability in Apache Tomcat, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.
Weakness: CWE-193
Which versions are affected by CVE-2026-65927?
1 open source package ship an affected version, including tomcat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tomcat Bitnami | From 8.5.0 | 9.0.121, 10.1.58, 11.0.25 |
Products include Apache Tomcat.
How do I fix CVE-2026-65927?
Upgrade tomcat to a fixed version for your release line: 9.0.121, 10.1.58 or 11.0.25.
Is CVE-2026-65927 being exploited?
There is no known exploitation of CVE-2026-65927 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2026-65927, DEBIAN-CVE-2026-65927, GHSA-g8qj-vp23-742m, MINI-2xjh-v93m-ch53, MINI-9hhj-wmfc-hmwf, MINI-wch8-hgxx-cgmr and 1 more.