Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2026-24733 BIT-tomcat-2026-24733EUVD-2026-7831GHSA-qq5r-98hh-rxc9

Apache Tomcat: Security constraint bypass with HTTP/0.9

Published Feb 17, 2026 · Updated Mar 11, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Tomcat Package: org.apache.tomcat:tomcat-coyote Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: tomcat10 Package: tomcat10 Package: tomcat11 Package: tomcat11 Package: tomcat6 Package: tomcat9 Package: tomcat9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Improper Input Validation vulnerability in Apache Tomcat.

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security
constraint was configured to allow HEAD requests to a URI but deny GET
requests, the user could bypass that constraint on GET requests by
sending a (specification invalid) HEAD request using HTTP/0.9.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.

Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Tomcat 11.0.0-M1 – ≤ 11.0.14, 10.1.0-M1 – ≤ 10.1.49, 9.0.0.M1 – ≤ 9.0.112, ≤ 8.5.100 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 tomcat10 10.1.52-1 —
Debian 14 tomcat11 11.0.15-1 —
Debian 14 tomcat9 9.0.70-2 —
Debian 13 tomcat10 10.1.52-1~deb13u1 DSA-6120-1
Debian 13 tomcat11 11.0.15-1~deb13u1 DSA-6121-1
Debian 13 tomcat9 9.0.70-2 —
Debian 12 tomcat10 10.1.52-1~deb12u1 DSA-6120-1
Debian 12 tomcat9 9.0.70-2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS tomcat10 No fix yet —
Ubuntu 25.10 tomcat9 +2 No fix yet —
Ubuntu 24.04 LTS tomcat9 +1 No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS tomcat9 No fix yet —
Ubuntu Pro 20.04 LTS tomcat9 No fix yet —
Ubuntu Pro 18.04 LTS tomcat9 No fix yet —
Ubuntu Pro 14.04 LTS tomcat6 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 tomcat +7 1:9.0.117-1.el9_8 RHSA-2026:26323
RHEL 8 tomcat +7 1:9.0.120-1.el8_10 RHSA-2026:68677
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS tomcat9 +7 1:9.0.120-1.el10_0 RHSA-2026:67163
RHEL 9.6 EUS tomcat +7 1:9.0.120-1.el9_6 RHSA-2026:68659
RHEL 9.4 E4S tomcat +7 1:9.0.120-1.el9_4 RHSA-2026:68679
RHEL 9.2 E4S tomcat +7 1:9.0.120-1.el9_2 RHSA-2026:68678
RHEL 8.8 TUS tomcat +7 1:9.0.120-1.el8_8 RHSA-2026:68680
RHEL 8.8 E4S tomcat +7 1:9.0.120-1.el8_8 RHSA-2026:68680
Red Hat JBoss Web Server 6 jws6-tomcat +9 10.1.49-10.redhat_00008.1.el8jws RHSA-2026:12194
Red Hat Hardened Images 1 tomcat10 +9 10.1.54-1.hum1 RHSA-2026:8334
Red Hat Hardened Images 1 tomcat11 +7 11.0.21-0.1.hum1 RHSA-2026:6569

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 tomcat9 +7 1:9.0.117-1.el10_2.alma.1 ALSA-2026:36790, ALSA-2026:25341
AlmaLinux 9 tomcat +7 1:9.0.117-1.el9_8 ALSA-2026:26323
AlmaLinux 8 tomcat +7 1:9.0.120-1.el8_10 ALSA-2026:68677

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 tomcat9 1:9.0.117-1.el10_2 RLSA-2026:25341

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 tomcat 9.0.115-150200.102.1 SUSE-SU-2026:0932-1
SLES 15 SP7 tomcat10 10.1.52-150200.5.61.1 SUSE-SU-2026:0890-1
SLES 15 SP7 tomcat11 11.0.18-150600.13.15.1 SUSE-SU-2026:0877-1
SLES 15 SP6 tomcat 9.0.115-150200.102.1 SUSE-SU-2026:0932-1
SLES 15 SP6 tomcat10 10.1.52-150200.5.61.1 SUSE-SU-2026:0890-1
SLES 15 SP6 tomcat11 11.0.18-150600.13.15.1 SUSE-SU-2026:0877-1
SLES 15 SP5 tomcat 9.0.115-150200.102.1 SUSE-SU-2026:0932-1
SLES 15 SP5 tomcat10 10.1.52-150200.5.61.1 SUSE-SU-2026:0890-1
SLES 15 SP4 tomcat 9.0.115-150200.102.1 SUSE-SU-2026:0932-1
SLES 12 SP5 tomcat 9.0.36-3.156.1 SUSE-SU-2026:1058-1, SUSE-SU-2026:0922-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 tomcat10 10.1.52-160000.1.1 SUSE-SU-2026:20982-1
SLES for SAP 16.0 tomcat11 11.0.18-160000.1.1 SUSE-SU-2026:20926-1
SLES for SAP 15 SP6 tomcat 9.0.115-150200.102.1 SUSE-SU-2026:0932-1
SLES for SAP 15 SP6 tomcat10 10.1.52-150200.5.61.1 SUSE-SU-2026:0890-1
SLES for SAP 15 SP6 tomcat11 11.0.18-150600.13.15.1 SUSE-SU-2026:0877-1
SLES for SAP 15 SP5 tomcat 9.0.115-150200.102.1 SUSE-SU-2026:0932-1
SLES for SAP 15 SP5 tomcat10 10.1.52-150200.5.61.1 SUSE-SU-2026:0890-1
SLES for SAP 15 SP4 tomcat 9.0.115-150200.102.1 SUSE-SU-2026:0932-1
SLES 16.0 tomcat10 10.1.52-160000.1.1 SUSE-SU-2026:20982-1
SLES 16.0 tomcat11 11.0.18-160000.1.1 SUSE-SU-2026:20926-1
SLE HPC 15 SP5 tomcat 9.0.115-150200.102.1 SUSE-SU-2026:0932-1
SLE HPC 15 SP5 tomcat10 10.1.52-150200.5.61.1 SUSE-SU-2026:0890-1
SLE HPC 15 SP4 tomcat 9.0.115-150200.102.1 SUSE-SU-2026:0932-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed tomcat 9.0.115-1.1 openSUSE-SU-2026:10305-1
openSUSE Tumbleweed tomcat10 10.1.52-1.1 openSUSE-SU-2026:10306-1
openSUSE Tumbleweed tomcat11 11.0.18-1.1 openSUSE-SU-2026:10307-1
openSUSE Leap 16.0 tomcat 9.0.115-160000.1.1 openSUSE-SU-2026:20350-1
openSUSE Leap 16.0 tomcat10 10.1.52-160000.1.1 openSUSE-SU-2026:20444-1
openSUSE Leap 16.0 tomcat11 11.0.18-160000.1.1 openSUSE-SU-2026:20414-1
openSUSE Leap 15.6 tomcat 9.0.115-150200.102.1 SUSE-SU-2026:0932-1
openSUSE Leap 15.6 tomcat10 10.1.52-150200.5.61.1 SUSE-SU-2026:0890-1
openSUSE Leap 15.6 tomcat11 11.0.18-150600.13.15.1 SUSE-SU-2026:0877-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 tomcat10 +7 1:10.1.52-1.amzn2023.0.1 ALAS2023-2026-1497
Amazon Linux 2023 tomcat9 +7 1:9.0.115-1.amzn2023.0.1 ALAS2023-2026-1496
Amazon Linux 2 tomcat +9 7.0.76-10.amzn2.0.16 ALAS2-2026-3204

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling thingsboard-tb-mqtt-transport 4.3.0.1-r1 —
Wolfi rolling thingsboard-tb-node 4.3.1-r2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Darabium/CVE-2026-24733 ★ 1 · Sep 15, 2026

    ## What is CVE-2026-24733? Apache Tomcat incorrectly handled an HTTP/0.9-style `HEAD` request under certain security-constraint configurations.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.tomcat:tomcat-coyote >= 11.0.0-M1, < 11.0.15 11.0.15 GHSA-qq5r-98hh-rxc9
Maven org.apache.tomcat:tomcat-coyote >= 10.1.0-M1, < 10.1.50 10.1.50 GHSA-qq5r-98hh-rxc9
Maven org.apache.tomcat:tomcat-coyote < 9.0.113 9.0.113 GHSA-qq5r-98hh-rxc9

Advisories 34

References