CVE-2026-24733: 
Java vulnerability analysis and mitigation

CVE-2026-24733 is an Improper Input Validation vulnerability in Apache Tomcat that allows unauthenticated remote attackers to bypass HTTP method-based security constraints. Tomcat failed to restrict HTTP/0.9 requests to the GET method, enabling attackers to send a specification-invalid HEAD request over HTTP/0.9 to access URIs where GET is denied but HEAD is permitted. Affected versions include Apache Tomcat 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.49, and 9.0.0.M1 through 9.0.112, as well as older end-of-life versions. The vulnerability was published on February 17, 2026, with a CVSS v3.1 base score of 3.7 (Low) (Apache Mailing List, IBM Advisory).

The root cause is classified as CWE-20 (Improper Input Validation): Tomcat's HTTP/0.9 request handling did not enforce the protocol specification's restriction that HTTP/0.9 only supports GET requests. An attacker can craft a HEAD request using the HTTP/0.9 protocol (which is technically invalid per the specification) and send it to a URI protected by a security constraint that allows HEAD but denies GET. Because Tomcat processes the HTTP/0.9 HEAD request without enforcing the method restriction, the security constraint check is bypassed and the server responds with the resource content. No authentication or special privileges are required, but exploitation requires a specific security constraint configuration — the target URI must explicitly allow HEAD while denying GET — making this a high-complexity attack (Apache Mailing List, IBM Advisory).

Successful exploitation allows an attacker to gain unauthorized read access to resources that should be restricted by HTTP method-based security constraints, resulting in a low integrity impact (unauthorized access to protected data). There is no direct confidentiality or availability impact as scored, though the bypass could expose sensitive application data or administrative endpoints that were intended to be inaccessible via GET. The scope is limited to the affected Tomcat instance; lateral movement potential is low, but the bypass could serve as a stepping stone to further reconnaissance or data exfiltration depending on what resources are protected (IBM Advisory, Apache Mailing List).

1. Reconnaissance: Identify Apache Tomcat instances running affected versions (9.0.0.M1–9.0.112, 10.1.0-M1–10.1.49, 11.0.0-M1–11.0.14) using tools like Shodan, Censys, or banner grabbing.
2. Identify target URIs: Probe the application for URIs where HEAD requests are permitted but GET requests return a 403 Forbidden response, indicating a method-based security constraint is in place.
3. Craft HTTP/0.9 HEAD request: Construct a raw TCP request using the HTTP/0.9 protocol format (which does not include a version string), specifying the HEAD method — e.g., send HEAD /restricted-resource\r\n over a raw socket connection to the server.
4. Bypass security constraint: Because Tomcat does not restrict HTTP/0.9 to GET-only as required by the specification, the server processes the HEAD request without applying the GET-denial constraint, returning headers (and potentially body content) for the protected resource.
5. Retrieve protected data: Analyze the server response to access information from the restricted URI that would otherwise be denied to GET requests (Apache Mailing List, IBM Advisory).

• Network: Inbound TCP connections to Tomcat HTTP ports (8080, 8443, or custom) using raw HTTP/0.9 protocol format (requests lacking an HTTP version string, e.g., HEAD /path\r\n with no HTTP/1.x suffix); unusual HEAD requests to URIs that normally return 403 for GET.
• Logs: Tomcat access logs (localhost_access_log) showing HEAD requests to sensitive or restricted URIs with HTTP/0.9 protocol notation or missing protocol version; 200-series responses to HEAD requests on URIs that return 403 for GET from the same source IP.
• Application: Repeated HEAD method requests from a single IP or user agent targeting multiple restricted endpoints in a short time window, suggesting automated scanning for exploitable constraint configurations.

Apache has released patched versions that fix this issue: Apache Tomcat 11.0.15 or later, 10.1.50 or later, and 9.0.113 or later. Upgrading to one of these versions is the recommended remediation (Apache Mailing List). As an interim workaround, administrators should review security constraints and avoid configurations that allow HEAD while denying GET on the same URI, or add explicit denials for HEAD where GET is also denied. IBM has also released patches for affected products including IBM DevOps Solution Workbench and IBM Storage Defender Copy Data Management (IBM Advisory, IBM Storage Defender Advisory). Consider implementing additional network-layer controls to block or log anomalous HTTP/0.9 requests.

The vulnerability received moderate coverage from security news outlets, with articles from CyberSecurityNews, SecurityOnline, and eSecurity Planet highlighting the HTTP/0.9 protocol bypass mechanism (CyberSecurityNews, SecurityOnline). The Hacker News weekly recap briefly mentioned the vulnerability alongside other security issues. Community sentiment on social media (LinkedIn, Bluesky, Mastodon) was generally measured, noting the low CVSS score but flagging the unusual HTTP/0.9 exploitation vector as technically interesting. The vulnerability was also picked up by Linux distribution security teams, resulting in updates for openSUSE, Mageia, and Amazon Linux 2.