Home

CVE-2026-24733

Description

Improper Input Validation vulnerability in Apache Tomcat.Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.Older, EOL versions are also affected.Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.

Risk Information

Base Score
3.7
MODERATE
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score
Exploitation Probability
0.16

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache Tomcat 11.0.15Windows
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache Tomcat 10.1.50Windows
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache Tomcat 9.0.113Windows
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache - tomcat-embed-core 11.0.14Windows
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache - tomcat-embed-core 10.1.49Windows
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache - tomcat-embed-core 9.0.112Windows
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache - tomcat 11.0.14Windows
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache - tomcat 10.1.49Windows
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache - tomcat 9.0.112Windows
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache-tomcat-catalina 11.0.14Windows
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache-tomcat-catalina 10.1.49Windows
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache-tomcat-catalina 9.0.112Windows
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache - tomcat-embed-core 11.0.15Windows
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache - tomcat-embed-core 10.1.50Windows
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache - tomcat-embed-core 9.0.113Windows
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache - tomcat 11.0.15Windows
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache - tomcat 10.1.50Windows
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache - tomcat 9.0.113Windows
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache-tomcat-catalina 11.0.15Windows
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache-tomcat-catalina 10.1.50Windows
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache-tomcat-catalina 9.0.113Windows
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache - tomcat-embed-core for Linux 11.0.14Linux
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache - tomcat-embed-core for Linux 10.1.49Linux
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache - tomcat-embed-core for Linux 9.0.112Linux
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache - tomcat for Linux 11.0.14Linux
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache - tomcat for Linux 10.1.49Linux
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache - tomcat for Linux 9.0.112Linux
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache-tomcat-catalina for Linux 11.0.14Linux
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache-tomcat-catalina for Linux 10.1.49Linux
Vulnerabilities CVE-2026-24733,CVE-2025-66614 are fixed in Apache-tomcat-catalina for Linux 9.0.112Linux
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache - tomcat-embed-core for Linux 11.0.15Linux
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache - tomcat-embed-core for Linux 10.1.50Linux
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache - tomcat-embed-core for Linux 9.0.113Linux
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache - tomcat for Linux 11.0.15Linux
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache - tomcat for Linux 10.1.50Linux
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache - tomcat for Linux 9.0.113Linux
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache-tomcat-catalina for Linux 11.0.15Linux
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache-tomcat-catalina for Linux 10.1.50Linux
Vulnerabilities CVE-2025-66614,CVE-2026-24733 are fixed in Apache-tomcat-catalina for Linux 9.0.113Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234