CVE-2026-59083: 
Apache Tomcat vulnerability analysis and mitigation

CVE-2026-59083 is an Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's RewriteValve that allows security constraint bypass for certain configurations. Disclosed on July 14, 2026 by Apache's Mark Thomas, it affects Apache Tomcat 11.0.0-M1 through 11.0.23, 10.1.0-M1 through 10.1.56, 9.0.0.M1 through 9.0.119, and 8.5.0 through 8.5.100; end-of-support versions may also be affected. It carries a CVSS v3.1 base score of 9.1 (Critical) (Apache Advisory, GitHub Advisory, OSS-Sec).

The vulnerability is classified as CWE-177 (Improper Handling of URL Encoding / Hex Encoding) and resides in Tomcat's RewriteValve component. Hexadecimal-encoded characters in URLs are not properly normalized before security constraint validation is applied, enabling attackers to craft URLs that evade access control policies configured in the rewrite valve. Exploitation requires no authentication, no user interaction, and low attack complexity — an attacker simply sends a crafted HTTP request with hex-encoded path segments to a network-accessible Tomcat instance. Relevant attack patterns include CAPEC-64 (Using Slashes and URL Encoding Combined to Bypass Validation Logic), CAPEC-72 (URL Encoding), and CAPEC-120 (Double Encoding) (Apache Advisory, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass security constraints enforced by the RewriteValve, gaining unauthorized access to resources that should be protected by authentication or authorization policies. The impact includes high confidentiality loss (exposure of sensitive data) and high integrity loss (potential unauthorized modification of protected resources), with no direct availability impact. The scope is limited to the affected Tomcat instance, but access to restricted application data could facilitate further lateral movement within an environment (GitHub Advisory, OSS-Sec).

1. Reconnaissance: Identify internet-facing Apache Tomcat instances running affected versions (8.5.0–8.5.100, 9.0.0.M1–9.0.119, 10.1.0-M1–10.1.56, 11.0.0-M1–11.0.23) using tools like Shodan, Censys, or banner grabbing. Confirm that the target uses a RewriteValve configuration with security constraints.
2. Identify protected resources: Map the application's access-controlled URL paths (e.g., /admin/, /secure/, /api/private/) that are protected by security constraints in the RewriteValve rules.
3. Craft hex-encoded URL: Construct a request URL where one or more path segments are hex-encoded (e.g., replacing /admin/ with /%61%64%6d%69%6e/ or using partial encoding) to bypass the pattern matching in the RewriteValve's security constraint evaluation.
4. Send crafted request: Issue an HTTP GET or POST request to the Tomcat server using the hex-encoded URL path. The RewriteValve fails to normalize the encoding before applying security constraints, allowing the request to pass through to the protected resource.
5. Access restricted content: If the bypass is successful, the server returns the protected resource's response without requiring authentication, exposing sensitive data or allowing unauthorized actions (OSS-Sec, GitHub Advisory).

• Network: HTTP requests to protected URL paths using percent-encoded (hex-encoded) characters in path segments (e.g., /%61dmin/, /%73ecure/); unusual access patterns to resources that should require authentication returning HTTP 200 responses.
• Logs: Tomcat access logs (localhost_access_log) showing requests to restricted paths with URL-encoded characters that result in successful (2xx) responses from unauthenticated sources; repeated probing of multiple encoded variants of the same path from a single IP.
• Application Logs: Absence of authentication/authorization log entries for sessions that successfully accessed protected resources, indicating constraint bypass rather than legitimate login.
• Process/Behavior: Unexpected data retrieval or modification activity on resources that should be access-controlled, particularly from external or untrusted IP addresses (OSS-Sec).

Apache has released patched versions addressing this vulnerability: upgrade to Apache Tomcat 11.0.24, 10.1.57, or 9.0.120. Note that a fix for the 8.5.x branch is not explicitly listed in the advisory — users on 8.5.x should prioritize migration to a supported release. As a compensating control, deploy web application firewall (WAF) rules to detect and block HTTP requests containing suspicious hex-encoded URL patterns targeting protected paths. Review and audit RewriteValve security constraint configurations to minimize exposure. Instances running end-of-support versions should be migrated to a supported and patched release immediately (Apache Advisory, OSS-Sec).

The vulnerability was disclosed by Apache Tomcat committer Mark Thomas via the oss-security mailing list on July 14, 2026, with an official severity rating of "low" from Apache despite the CVSS 9.1 Critical score — reflecting that exploitation requires a specific RewriteValve configuration rather than being universally applicable (OSS-Sec). Tenable released Nessus detection plugins (IDs 326732 and 327124) and a WAS plugin (115305) shortly after disclosure. HeroDevs noted the vulnerability in the context of Spring Boot managed dependencies and end-of-life component risks (HeroDevs Blog). Community discussion on Bluesky and Mastodon/infosec.exchange was limited, consistent with the absence of active exploitation.