CVE-2026-74049: Apache Tomcat EAR Vulnerability

CVE-2026-74049 Overview

CVE-2026-74049 is an Execution After Redirect (EAR) vulnerability affecting Apache Tomcat. The flaw stems from improper behavior following an HTTP redirect, where application logic continues to execute after a redirect response has been issued. This can expose server-side logic that developers intended to gate behind a redirect, potentially bypassing security controls.

The vulnerability affects Apache Tomcat 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122. End-of-life branches 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109 are also known to be affected.

Critical Impact
Application code that should not run after a redirect may still execute, potentially bypassing authorization checks and exposing sensitive processing paths.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.26
Apache Tomcat 10.1.0-M1 through 10.1.60
Apache Tomcat 9.0.0.M1 through 9.0.122
Apache Tomcat 8.5.0 through 8.5.100 (EOL)
Apache Tomcat 7.0.0 through 7.0.109 (EOL)

Discovery Timeline

2026-10-20 - CVE-2026-74049 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-74049

Vulnerability Analysis

Execution After Redirect occurs when a servlet or filter issues an HTTP redirect but fails to halt subsequent processing. The response buffer is marked for redirection, yet the request lifecycle continues executing downstream code. Any logic following the redirect call runs with the original request context, including security-sensitive operations the developer assumed were short-circuited.

The weakness is classified under CWE-698: Execution After Redirect (EAR). In Tomcat, this behavior can allow request handlers to continue reading or writing data, invoking business logic, or returning content that should have been suppressed by the redirect. Attackers who understand the application flow may craft requests that trigger the redirect path while still receiving or influencing the post-redirect output.

The current EPSS probability indicates low near-term exploitation likelihood, but the issue remains relevant for any Tomcat deployment that relies on redirects for access control, authentication gates, or workflow enforcement.

Root Cause

The root cause lies in how Tomcat's request processing pipeline handles redirect responses issued via HttpServletResponse.sendRedirect(). Instead of fully terminating request processing after the redirect is committed, the container permits additional handler code to execute. Developers often assume a redirect implicitly ends processing, which is not guaranteed by the servlet specification.

Attack Vector

An attacker sends a crafted HTTP request to an endpoint that performs a conditional redirect, such as a login gate or role check. Because downstream code still runs, the response can leak data, perform state changes, or render content intended to be inaccessible. The precise exploitation path depends on how the hosted application structures its servlets and filters. Refer to the Apache mailing list thread and the OpenWall OSS-Security post for additional technical detail.

Detection Methods for CVE-2026-74049

Indicators of Compromise

HTTP responses that contain both a 3xx redirect status and an unexpected response body or additional headers from downstream handlers.
Access log entries showing successful request completion against endpoints that should have terminated at a redirect to a login or error page.
Application log evidence of business-logic methods executing on requests whose response is a redirect.

Detection Strategies

Inspect servlet and filter code for calls to sendRedirect() that are not immediately followed by return statements or explicit chain termination.
Enable verbose access logging in Tomcat and correlate HTTP status codes with response byte counts to identify redirects with unusually large payloads.
Perform dynamic testing against authentication and authorization endpoints to confirm that redirected requests do not return protected content.

Monitoring Recommendations

Track installed Apache Tomcat versions across the environment and alert on hosts running affected 7.x, 8.5.x, 9.x, 10.1.x, or 11.0.x builds.
Monitor web application responses for anomalous combinations of redirect status codes and payload content.
Review web application firewall telemetry for repeated probing of login, logout, and role-gated endpoints.

How to Mitigate CVE-2026-74049

Immediate Actions Required

Upgrade Apache Tomcat to a fixed release: 11.0.27, 10.1.61, or 9.0.123.
Migrate off end-of-life Tomcat 7.x and 8.5.x branches, which do not receive patches for this issue.
Audit custom servlets and filters to ensure every sendRedirect() or forward() is followed by an explicit return.

Patch Information

The Apache Tomcat project has released fixed versions 11.0.27, 10.1.61, and 9.0.123 that address CVE-2026-74049. Administrators running supported branches should upgrade to these versions. For deployments pinned to EOL branches, migration to a supported branch is the only sustainable remediation path. See the Apache mailing list announcement for official release details.

Workarounds

Review application code for redirect patterns and add explicit control-flow termination after every redirect call.
Place authorization checks in filters that return before dispatching to protected servlets, rather than relying on redirects inside servlet logic.
Deploy web application firewall rules to flag or block requests that return redirect status codes with unexpected response bodies on sensitive endpoints.

bash

# Verify installed Apache Tomcat version
$CATALINA_HOME/bin/version.sh

# Example: upgrade check on Linux
ls -l $CATALINA_HOME/lib/catalina.jar
unzip -p $CATALINA_HOME/lib/catalina.jar META-INF/MANIFEST.MF | grep Implementation-Version