Apache Tomcat 9/10/11 Off-by-one Error in Rewrite Valve [N] Flag (v<9.0.121)
CVE-2026-65927 Published on August 25, 2026
Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.
Vulnerability Analysis
CVE-2026-65927 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is an off-by-five Vulnerability?
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CVE-2026-65927 has been classified to as an off-by-five vulnerability or weakness.
Products Associated with CVE-2026-65927
Want to know whenever a new CVE is published for Apache Tomcat? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Tomcat:- Version 11.0.0-M1, <= 11.0.24 is affected.
- Version 10.1.0-M1, <= 10.1.57 is affected.
- Version 9.0.0.M1, <= 9.0.120 is affected.
- Version 8.5.0, <= 8.5.100 is affected.
- Version 7.0.0, <= 7.0.109 is unaffected.
- Before 7.0.0 is unaffected.