Apache Tomcat 9/10/11 Off-by-one Error in Rewrite Valve [N] Flag (v<9.0.121)
CVE-2026-65927 Published on August 25, 2026
Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.
Weakness Type
What is an off-by-five Vulnerability?
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVE-2026-65927 has been classified to as an off-by-five vulnerability or weakness.
Products Associated with CVE-2026-65927
Want to know whenever a new CVE is published for Apache Tomcat? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Tomcat:- Version 11.0.0-M1, <= 11.0.24 is affected.
- Version 10.1.0-M1, <= 10.1.57 is affected.
- Version 9.0.0.M1, <= 9.0.120 is affected.
- Version 8.5.0, <= 8.5.100 is affected.
- Version 7.0.0, <= 7.0.109 is unaffected.
- Before 7.0.0 is unaffected.