Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-59083 – Security Constraint Bypass via RewriteValve URL Decoding Flaw – Apache Tomcat 8….

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-59083 is a critical-severity (CVSS 9.1) Improper Handling of URL Encoding vulnerability in Apache Tomcat’s RewriteValve component, publicly disclosed on July 14, 2026. The flaw allows unauthenticated, remote attackers to bypass security constraints in affected configurations by sending specially crafted HTTP requests that exploit incorrect URL decoding behavior in the RewriteValve. The vulnerability spans four major version branches of Apache Tomcat, covering the vast majority of active deployments.

Technical details

  • Root cause: The RewriteValve incorrectly decodes the + character in rewritten URIs as a single space. Because Tomcat’s security constraint evaluation and the RewriteValve resolve the URI differently, an attacker can craft a request with +-encoded characters that passes through the RewriteValve but matches a path that security constraints were intended to protect — effectively deceiving the access control layer.
  • Trigger conditions: The vulnerability is exploitable on instances where the RewriteValve (org.apache.catalina.valves.rewrite.RewriteValve) is configured in the server. Apache notes this affects "some configurations."
  • Attack vector: Remote, unauthenticated. An attacker sends a crafted HTTP request — no credentials, no user interaction, and no local access required.
  • Impact: Successful exploitation results in security constraint bypass, potentially exposing protected endpoints, administrative interfaces, or sensitive application functionality to unauthenticated access. CVSS impact scores are Confidentiality: HIGH and Integrity: HIGH.
  • CWE: CWE-177 – Improper Handling of URL Encoding (Hex Encoding).
  • No public proof-of-concept exploit was identified at time of publication.

Affected software

  • Apache Tomcat 11.0.0-M1 through 11.0.23
  • Apache Tomcat 10.1.0-M1 through 10.1.56
  • Apache Tomcat 9.0.0.M1 through 9.0.119
  • Apache Tomcat 8.5.0 through 8.5.100
  • Other versions that have reached end of support may also be affected.

Severity

CVSS v3.1 Base Score: 9.1 (Critical)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Mitigation and recommended actions

  • Immediate patch: Upgrade to one of the following fixed releases:
    • Apache Tomcat 11.0.24 or later
    • Apache Tomcat 10.1.57 or later
    • Apache Tomcat 9.0.120 or later
  • Apache Tomcat 8.5.x users: No patch has been issued for the 8.5.x branch. Organizations running 8.5.x should treat this branch as end of life and migrate to a supported version branch (9.0.120+, 10.1.57+, or 11.0.24+) immediately.
  • Configuration-level mitigation: If upgrading is not immediately feasible, review and audit all RewriteValve rules in use. Where feasible, temporarily disabling the RewriteValve removes the attack surface — though this may impact application functionality and should be tested carefully.
  • Network segmentation: Ensure that Tomcat management interfaces and sensitive application paths are not unnecessarily exposed to the public internet.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge