CVE-2026-59083: tomcat — Fix

Description

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

Is your site exposed to CVE-2026-59083?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS — Exploit Prediction

0.0037

Probability of exploitation

0.30%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-177 CWE-177

Affected Products

Vendor	Product	Versions
apache	tomcat	< 8.0.0
apache	tomcat	8.5.0 — 8.5.100
apache	tomcat	9.0.0 — 9.0.119
apache	tomcat	10.1.0 — 10.1.56
apache	tomcat	11.0.0 — 11.0.23

References

Advisories & Patches

https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq

Other References

http://www.openwall.com/lists/oss-security/2026/07/14/7

Frequently Asked Questions

What is CVE-2026-59083? +

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue. It has a CVSS v3.1 base score of 9.1 (CRITICAL).

How severe is CVE-2026-59083? +

CVE-2026-59083 has a CVSS v3.1 score of 9.1 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately. The EPSS score is 0.0037, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2026-59083? +

CVE-2026-59083 affects products from apache, specifically: tomcat. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-59083? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-23983

Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.

CVE-2026-41041 9.1

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. …

CVE-2026-76172 7.5

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and …

CVE-2026-67448 6.5

Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the …

CVE-2026-6414 5.9

@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal …

CVE-2024-48866 5.3

An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions. If …

CVE-2026-59083