Sign in
Deutsch English Español Polski
Low

Apache Tomcat - Security constraint bypass with HTTP/0.9

  • Disclosed: 17.02.2026
  • Updated: 11.10.2026 13:20

Improper Input Validation vulnerability in Apache Tomcat.

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.

Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.apache.tomcat:tomcat-coyote >= 11.0.0-M1, < 11.0.15, >= 10.1.0-M1, < 10.1.50, < 9.0.113 11.0.15, 10.1.50, 9.0.113

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weakness (CWE)
CWE-20
Platform
Java / Kotlin (Maven)
Package
org.apache.tomcat:tomcat-coyote
Disclosed
17.02.2026
Updated
11.10.2026 13:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-qq5r-98hh-rxc9 - CC BY 4.0

Vulnerability history: org.apache.tomcat:tomcat-coyote

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (33) in the archive
Total entries
33
First → latest
06.2020 05.2026
Without a fix
0
Exploited in attacks
1

Severity breakdown

  • Critical 2
  • High 17
  • Medium 13
  • Low 1

Disclosures per year

Severity:
  1. Apache Tomcat - HTTP/2 request headers not validated
    Critical · 9.8 CVE-2026-41293 >= 8.5.0, < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  2. Apache Tomcat has an HTTP Request/Response Smuggling vulnerability
    High · 7.5 CVE-2026-24880 >= 7.0.0, < 9.0.116, >= 10.1.0-M1, < 10.1.52, >= 11.0.0-M1, < 11.0.20 9.0.116, 10.1.52, 11.0.20
  3. Apache Tomcat: Configured cipher preference order not preserved
    High · 7.5 CVE-2026-29129 >= 9.0.114, < 9.0.116, >= 10.1.51, < 10.1.53, >= 11.0.16, < 11.0.20 9.0.116, 10.1.53, 11.0.20
  4. Apache Tomcat - Security constraint bypass with HTTP/0.9 this entry
    Low CVE-2026-24733 >= 11.0.0-M1, < 11.0.15, >= 10.1.0-M1, < 10.1.50, < 9.0.113 11.0.15, 10.1.50, 9.0.113
  5. Apache Tomcat has an Improper Input Validation vulnerability
    High · 7.5 CVE-2026-24734 >= 11.0.0-M1, < 11.0.18, >= 10.1.0-M7, < 10.1.52, >= 9.0.83, < 9.0.115 11.0.18, 10.1.52, 9.0.115
  6. Apache Tomcat Improper Resource Shutdown or Release vulnerability
    High · 7.5 CVE-2025-48989 >= 11.0.0-M1, < 11.0.10, >= 10.1.0-M1, < 10.1.44, >= 9.0.0.M1, < 9.0.108 11.0.10, 10.1.44, 9.0.108
  7. Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams
    High · 7.5 CVE-2025-53506 >= 11.0.0-M1, < 11.0.9, >= 10.1.0-M1, < 10.1.43, >= 9.0.0.M1, < 9.0.107, >= 8.5.0, <= 8.5.100 11.0.9, 10.1.43, 9.0.107
  8. Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability
    High · 8.6 CVE-2024-38286 >= 11.0.0-M1, < 11.0.0-M21, >= 10.1.0-M1, < 10.1.25, >= 9.0.13, < 9.0.90, >= 8.5.35, <= 8.5.100, >= 7.0.92, <= 7.0.109 11.0.0-M21, 10.1.25, 9.0.90
  9. Apache Tomcat - Denial of Service
    High · 7.5 CVE-2024-34750 >= 11.0.0-M1, < 11.0.0-M21, >= 10.1.0-M1, < 10.1.25, >= 9.0.0-M1, < 9.0.90, >= 8.5.0, <= 8.5.100 11.0.0-M21, 10.1.25, 9.0.90
  10. Apache Tomcat Improper Input Validation vulnerability
    High · 7.5 CVE-2023-46589 >= 11.0.0-M1, < 11.0.0-M11 11.0.0-M11
  11. Apache Tomcat - Fix for CVE-2023-24998 was incomplete
    High · 7.5 CVE-2023-28709 >= 8.5.85, < 8.5.88 8.5.88
  12. Apache Tomcat vulnerable to information leak
    High · 7.5 CVE-2023-34981 >= 8.5.88, < 8.5.89 8.5.89
  13. Apache Commons FileUpload denial of service vulnerability
    High · 7.5 CVE-2023-24998 >= 10.1.0-M1, < 10.1.5, >= 11.0.0-M2, < 11.0.0-M5, >= 8.5.85, < 8.5.88, >= 9.0.0-M1, < 9.0.71 10.1.5, 11.0.0-M5, 8.5.88, 9.0.71
  14. Apache Tomcat may reject request containing invalid Content-Length header
    High · 7.5 CVE-2022-42252 >= 9.0.0-M1, < 9.0.68, >= 10.0.0-M1, < 10.0.27, >= 10.1.0-M1, < 10.1.1 9.0.68, 10.0.27, 10.1.1
  15. Expected Behavior Violation in Apache Tomcat
    Critical · 9.8 CVE-2017-5651 >= 9.0.0.M1, < 9.0.0.M19, >= 8.5.0, < 8.5.13 9.0.0.M19, 8.5.13
  16. Improper Input Validation in Apache Tomcat
    High · 7.1 CVE-2016-6816 >= 9.0.0.M1, < 9.0.0.M12, >= 8.5.0, < 8.5.8, >= 8.0.0RC1, < 8.0.39, >= 7.0.0, < 7.0.73, >= 6.0.0, < 6.0.48 9.0.0.M12, 8.5.8, 8.0.39, 7.0.73, 6.0.48
  17. Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
    High · 7.5 CVE-2020-17527 >= 10.0.0-M1, < 10.0.0-M10, >= 9.0.0-M1, < 9.0.40, >= 8.5.0, < 8.5.60 10.0.0-M10, 9.0.40, 8.5.60
  18. Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
    High · 7.5 CVE-2020-13934 >= 10.0.0-M1, < 10.0.0-M6, >= 9.0.0.M5, < 9.0.36, >= 8.5.1, < 8.5.56 10.0.0-M6, 9.0.36, 8.5.56
  19. Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
    High · 7.5 CVE-2021-25122 >= 10.0.0-M1, < 10.0.2 10.0.2
  20. Apache Tomcat Denial of Service vulnerability
    High · 7.5 CVE-2019-0199 >= 9.0.0, < 9.0.16, >= 8.0.0, < 8.5.38 9.0.16, 8.5.38

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.