Apache Tomcat Security Flaw Overview
A recent security vulnerability identified as CVE-2026-24733 has been disclosed in Apache Tomcat. This low-severity issue allows attackers to bypass security constraints using HTTP/0.9 requests under specific configurations.
The Apache Tomcat security team highlighted this vulnerability, first publishing their advisory on February 17, 2026. The flaw arises when Tomcat does not limit HTTP/0.9 requests solely to the GET method, an outdated protocol variant which is seldom used in modern systems.
How the Vulnerability Occurs
The vulnerability is exploited when an attacker accesses a Tomcat server and sends specifically crafted HTTP/0.9 traffic. This can create an unexpected loophole in security enforcement, especially when certain access controls are configured to permit HEAD requests but deny GET requests to the same URI.
Ordinarily, this configuration would prevent resource retrieval via GET requests in standard HTTP versions. However, CVE-2026-24733 allows attackers to bypass this restriction by submitting an invalid HEAD request in HTTP/0.9, effectively circumventing the constraint.
Specific Conditions and Risks
The issue is conditional, requiring a specific setup where a security constraint allows HEAD requests but blocks GET requests, alongside an environment where HTTP/0.9 parsing is not properly managed throughout the network path.
This vulnerability is significant in legacy systems, non-standard client integrations, and certain proxy or network configurations where protocol handling does not align with expectations.
Affected Versions and Recommended Actions
The affected versions include both current and older Tomcat branches. Organizations still using end-of-life versions should consider this a prompt to upgrade to supported branches for enhanced security.
- Tomcat 11: Versions 11.0.0-M1 to 11.0.14 are impacted. Upgrade to 11.0.15 or later.
- Tomcat 10: Versions 10.1.0-M1 to 10.1.49 need upgrading to 10.1.50 or higher.
- Tomcat 9: Versions 9.0.0.M1 to 9.0.112 should move to 9.0.113 or newer.
Apache advises upgrading to these patched releases. Additionally, it is crucial to review access-control settings regarding HEAD and GET requests and ensure that any reverse proxies or load balancers do not inadvertently support protocol downgrades.
Stay updated by following us on Google News, LinkedIn, and X for continuous cybersecurity insights. Contact us to share your stories.
