CVE-2026-53404: Apache Tomcat Control Flow Vulnerability

CVE-2026-53404 Overview

CVE-2026-53404 is an Always-Incorrect Control Flow Implementation vulnerability [CWE-670] in the rewrite valve component of Apache Tomcat. The flaw causes the rewrite engine to skip subsequent non-OR conditions when the first condition in an OR chain matches. This logic error can lead to rewrite rules being evaluated incorrectly, potentially bypassing intended security constraints defined in rewrite configurations. The vulnerability affects multiple supported branches of Apache Tomcat, including 11.x, 10.1.x, 9.0.x, and 8.5.x. Apache has released fixed versions 11.0.23, 10.1.56, and 9.0.119 to address the issue.

Critical Impact
Misevaluation of rewrite rules may bypass URL-based access controls or route requests to unintended handlers, affecting confidentiality, integrity, and availability of hosted applications.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.22
Apache Tomcat 10.1.0-M1 through 10.1.55
Apache Tomcat 9.0.0.M1 through 9.0.118
Apache Tomcat 8.5.0 through 8.5.100

Discovery Timeline

2026-06-29 - CVE-2026-53404 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-53404

Vulnerability Analysis

Apache Tomcat's rewrite valve implements URL rewriting logic similar to Apache HTTPD's mod_rewrite. Administrators define rules and conditions using RewriteRule and RewriteCond directives, with conditions optionally chained using the [OR] flag. The rewrite engine evaluates each condition sequentially and determines whether the associated rewrite rule should apply.

The vulnerability stems from an implementation error in the condition-chain evaluation logic. When the first condition in an OR chain evaluates to true, the engine short-circuits and treats the entire chain as matched. However, it also skips subsequent conditions that are not part of the OR chain and should still be evaluated with logical AND semantics. This produces incorrect matches that would otherwise be rejected under proper evaluation.

Because rewrite rules frequently gate access to sensitive paths, enforce redirects, or restrict content types, incorrect evaluation can undermine security assumptions built into the configuration. The result is that unauthorized requests may reach protected resources or bypass intended filtering.

Root Cause

The root cause is faulty control flow in the rewrite valve's condition evaluation routine. The engine incorrectly interprets the boundary between OR-linked and AND-linked conditions, causing non-OR conditions after a matched OR to be silently skipped rather than evaluated.

Attack Vector

Exploitation requires a Tomcat deployment that uses the rewrite valve with rule sets that combine [OR] conditions with additional AND conditions. An unauthenticated remote attacker can send crafted HTTP requests designed to satisfy only the first OR condition, causing the rule to fire even when the AND-guarded conditions would deny it.

The vulnerability manifests entirely through normal HTTP request processing. See the Apache Mailing List Thread for the vendor description and the Openwall OSS Security Update for the coordinated disclosure notice.

Detection Methods for CVE-2026-53404

Indicators of Compromise

Unexpected HTTP 200 responses on paths that should be blocked or redirected by rewrite rules.
Access log entries showing requests reaching protected endpoints without matching the full set of documented rewrite conditions.
Requests that consistently satisfy only the leading OR condition of a compound rewrite rule.

Detection Strategies

Audit rewrite.config files for rule sets that combine [OR] flagged conditions with subsequent non-OR conditions.
Replay historical request samples against a patched Tomcat instance and compare rewrite decisions to production behavior.
Enable rewrite valve debug logging to capture condition evaluation traces and identify skipped conditions.

Monitoring Recommendations

Alert on Tomcat access log anomalies where restricted URIs return successful responses.
Track the running Apache Tomcat version across the fleet and flag hosts on 8.5.x, 9.0.x, 10.1.x, or 11.0.x below the fixed releases.
Monitor for reload events on context.xml or rewrite configuration files that could alter valve behavior.

How to Mitigate CVE-2026-53404

Immediate Actions Required

Upgrade Apache Tomcat to 11.0.23, 10.1.56, or 9.0.119 depending on the deployed branch.
Retire or upgrade Tomcat 8.5.x instances, which are approaching end of support and remain affected up to 8.5.100.
Review all rewrite rules that mix [OR] and non-OR conditions and validate that they enforce intended access decisions after patching.

Patch Information

Apache has released fixed versions 11.0.23, 10.1.56, and 9.0.119. Users on 8.5.x should migrate to a supported branch. Full details are available in the Apache Mailing List Thread.

Workarounds

Temporarily disable the rewrite valve if rule integrity cannot be guaranteed prior to patching.
Rewrite affected rule sets to avoid combining [OR] conditions with trailing AND conditions, decomposing them into independent rules.
Enforce access controls at an upstream reverse proxy or web application firewall until Tomcat is upgraded.

bash

# Verify the running Tomcat version before and after upgrade
$CATALINA_HOME/bin/version.sh

# Example rule refactor: split compound OR/AND conditions into distinct rules
# Before (vulnerable evaluation):
# RewriteCond %{HTTP_HOST} ^example\.com$ [OR]
# RewriteCond %{HTTP_HOST} ^www\.example\.com$
# RewriteCond %{REQUEST_URI} ^/admin/
# RewriteRule ^(.*)$ - [F]

# After (explicit, unambiguous):
# RewriteCond %{HTTP_HOST} ^example\.com$
# RewriteCond %{REQUEST_URI} ^/admin/
# RewriteRule ^(.*)$ - [F]
#
# RewriteCond %{HTTP_HOST} ^www\.example\.com$
# RewriteCond %{REQUEST_URI} ^/admin/
# RewriteRule ^(.*)$ - [F]