CVE-2026-24733

{"id": "CVE-2026-24733", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2026-02-17T19:21:56.820", "references": [{"url": "https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Improper Input Validation vulnerability in Apache Tomcat.\n\n\nTomcat did not limit HTTP/0.9 requests to the GET method. If a security \nconstraint was configured to allow HEAD requests to a URI but deny GET \nrequests, the user could bypass that constraint on GET requests by \nsending a (specification invalid) HEAD request using HTTP/0.9.\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.\n\n\nOlder, EOL versions are also affected.\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de validaci\u00f3n de entrada inadecuada en Apache Tomcat.\n\nTomcat no limitaba las solicitudes HTTP/0.9 al m\u00e9todo GET. Si una restricci\u00f3n de seguridad estaba configurada para permitir solicitudes HEAD a una URI pero denegar solicitudes GET, el usuario pod\u00eda eludir esa restricci\u00f3n en las solicitudes GET enviando una solicitud HEAD (inv\u00e1lida seg\u00fan la especificaci\u00f3n) usando HTTP/0.9.\n\nEste problema afecta a Apache Tomcat: desde 11.0.0-M1 hasta 11.0.14, desde 10.1.0-M1 hasta 10.1.49, desde 9.0.0.M1 hasta 9.0.112.\n\nLas versiones m\u00e1s antiguas, EOL, tambi\u00e9n est\u00e1n afectadas.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 11.0.15 o posterior, 10.1.50 o posterior o 9.0.113 o posterior, lo que soluciona el problema."}], "lastModified": "2026-03-11T16:16:29.773", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B76D20D5-8512-40CD-8B59-B0D4FBFBE7F3", "versionEndExcluding": "9.0.113", "versionStartIncluding": "9.0.1"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A9BCC2E-EB49-4C74-B150-564AEDE6D8BB", "versionEndExcluding": "10.1.50", "versionStartIncluding": "10.1.1"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9307BA8D-D3BD-41B0-89F3-124704B7EA6A", "versionEndExcluding": "11.0.15", "versionStartIncluding": "11.0.1"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D0689FE-4BC0-4F53-8C79-34B21F9B86C2"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89B129B2-FB6F-4EF9-BF12-E589A87996CF"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B6787B6-54A8-475E-BA1C-AB99334B2535"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EABB6FBC-7486-44D5-A6AD-FFF1D3F677E1"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E10C03BC-EE6B-45B2-83AE-9E8DFB58D7DB"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A6DA0BE-908C-4DA8-A191-A0113235E99A"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39029C72-28B4-46A4-BFF5-EC822CFB2A4C"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A2E05A3-014F-4C4D-81E5-88E725FBD6AD"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "166C533C-0833-41D5-99B6-17A4FAB3CAF0"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3768C60-21FA-4B92-B98C-C3A2602D1BC4"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDD510FA-A2E4-4BAF-A0DE-F4E5777E9325"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F542E12-6BA8-4504-A494-DA83E7E19BD5"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2409CC7-6A85-4A66-A457-0D62B9895DC1"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B392A7E5-4455-4B1C-8FAC-AE6DDC70689E"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF411DDA-2601-449A-9046-D250419A0E1A"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7D8F2F4-AFE2-47EA-A3FD-79B54324DE02"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B4FBF97-DE16-4E5E-BE19-471E01818D40"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B266B1E-24B5-47EE-A421-E0E3CC0C7471"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29614C3A-6FB3-41C7-B56E-9CC3F45B04F0"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6AB156C-8FF6-4727-AF75-590D0DCB3F9D"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0C5F004-F7D8-45DB-B173-351C50B0EC16"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1902D2E-1896-4D3D-9E1C-3A675255072C"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49AAF4DF-F61D-47A8-8788-A21E317A145D"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "454211D0-60A2-4661-AECA-4C0121413FEB"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0686F977-889F-4960-8E0B-7784B73A7F2D"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "558703AE-DB5E-4DFF-B497-C36694DD7B24"}, {"criteria": "cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED6273F2-1165-47A4-8DD7-9E9B2472941B"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90CD7E85-4FF9-4158-AC78-4BFCBC882A65"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83B9FF07-1B93-4F8C-AC56-7CA74E61B724"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7EA56B52-1015-40CD-B10C-393768094269"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "501B0D4A-D636-4736-979B-D5023599CEFB"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94E7764F-BF9E-463E-B446-A9A8DB92BB97"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53A9F7EE-AF2A-43E5-B708-0198784AB45A"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC872C5F-63AF-4BB8-8629-334FC9704AE8"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94B95C95-DF3E-49C1-9CA0-4474DD7EF7B8"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "310B0163-01DE-40DA-A2EA-FFA4A6100037"}, {"criteria": "cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75420449-A951-4133-A5F1-4C01F2DF843B"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D1AA7FF6-E8E7-4BF6-983E-0A99B0183008"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "57088BDD-A136-45EF-A8A1-2EBF79CEC2CE"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B32D1D7A-A04F-444E-8F45-BB9A9E4B0199"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0092FB35-3B00-484F-A24D-7828396A4FF6"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB557E88-FA9D-4B69-AA6F-EAEE7F9B01AC"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72D3C6F1-84FA-4F82-96C1-9A8DA1C1F30F"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3521C81B-37D9-48FC-9540-D0D333B9A4A4"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02A84634-A8F2-4BA9-B9F3-BEF36AEC5480"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ECBBC1F1-C86B-40AF-B740-A99F6B27682A"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D2206B2-F3FF-43F2-B3E2-3CAAC64C691D"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0495A538-4102-40D0-A35C-0179CFD52A9D"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AAD52CE-94F5-4F98-A027-9A7E68818CB6"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77BA6600-0890-4BA1-B447-EC1746BAB4FD"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7914D26B-CBD6-4846-9BD3-403708D69319"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "123C6285-03BE-49FC-B821-8BDB25D02863"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A28C2E2-B7BC-46CE-94E4-AE3EF172AA47"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "069B0D8E-8223-4C4E-A834-C6235D6C3450"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6282085-5716-4874-B0B0-180ECDEE128F"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "899B6FF0-8701-47E7-8EDA-428A6D48786D"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1F981F5-035A-4EDD-8A9F-481EE8BC7FF7"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03A171AF-2EC8-4422-912C-547CDB58CAAA"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "538E68C4-0BA4-495F-AEF8-4EF6EE7963CF"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49350A6E-5E1D-45B2-A874-3B8601B3ADCC"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F50942F-DF54-46C0-8371-9A476DD3EEA3"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D12C2C95-B79F-4AA4-8CE3-99A3EE7991AB"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98792138-DD56-42DF-9612-3BDC65EEC117"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}