CVE-2026-74049 Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-74049?
CVE-2026-74049 is a medium-severity vulnerability in Apache Tomcat, published on 20 Oct 2026.
Official description
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
Weakness: CWE-698
Which versions are affected by CVE-2026-74049?
1 open source package ship an affected version, including tomcat.
| Package | Affected | Fixed in |
|---|---|---|
tomcat Bitnami | From 7.0.0 | 9.0.123, 10.1.61, 11.0.27 |
How do I fix CVE-2026-74049?
Upgrade tomcat to a fixed version for your release line: 9.0.123, 10.1.61 or 11.0.27.
Is CVE-2026-74049 being exploited?
There is no known exploitation of CVE-2026-74049 in the wild and no public exploit code.
Sources
Also known as BIT-tomcat-2026-74049, DEBIAN-CVE-2026-74049, GHSA-2hg3-hfj5-cq2f, UBUNTU-CVE-2026-74049.