CVE-2026-74049
—UnscoredPublished 20 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- —
- Complexity
- —
- Privileges needed
- —
- User interaction
- —
- Impact
- —
- Weakness
- CWE-698
Impact
Attackers can bypass security checks or access unauthorized application logic by ignoring HTTP redirect responses. They only need network access to send requests directly to the affected Tomcat server.
Root cause
Tomcat fails to halt code execution after issuing a redirect, allowing downstream logic to run when it should stop.
Affected systems
Apache Tomcat 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, 9.0.0.M1 through 9.0.122, EOL 8.5.0 through 8.5.100, and EOL 7.0.0 through 7.0.109.
Fix & remediation
Upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123. No interim mitigation is listed in the advisory.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.