Apache Tomcat EAR Vulnerability (CVE-2026-74049) Fixed in 11.0.27/10.1.61/9.0.123
CVE-2026-74049 Published on October 20, 2026
Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
Weakness Type
What is a Redirect Without Exit Vulnerability?
The web application sends a redirect to another location, but instead of exiting, it executes additional code.
CVE-2026-74049 has been classified to as a Redirect Without Exit vulnerability or weakness.
Products Associated with CVE-2026-74049
Want to know whenever a new CVE is published for Apache Tomcat? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Tomcat:- Version 11.0.0-M1, <= 11.0.26 is affected.
- Version 10.1.0-M1, <= 10.1.60 is affected.
- Version 9.0.0.M1, <= 9.0.122 is affected.
- Version 8.5.0, <= 8.5.100 is affected.
- Version 7.0.0, <= 7.0.109 is affected.