Description

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-25T22:17:05.433Z",
  "pubdate": "2026-08-25T22:17:05.433Z",
  "executiveSummary": "An off-by-one error vulnerability exists within the rewrite valve processing logic of Apache Tomcat, specifically concerning the handling of the [N] (Next) flag. This flaw causes the rewrite engine to incorrectly resume rule processing at the second rule instead of restarting from the first rule. The vulnerability impacts Apache Tomcat versions 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120. EOL versions from 8.5.0 through 8.5.100 are also confirmed to be affected. The issue represents a critical logic flaw in request routing and URL manipulation capabilities. An attacker may leverage this improper rule execution flow to bypass intended URL rewrite logic, potentially leading to unauthorized access to restricted application paths, security filter bypasses, or unexpected application state transitions. Successful exploitation does not inherently require authentication, as the rewrite valve processes incoming requests globally or at the context level. The risk is primarily associated with the integrity of the request processing chain and security policy enforcement handled via rewrite rules.",
  "technicalDetails": "The vulnerability resides in the RewriteValve component of Apache Tomcat, specifically within the state machine responsible for processing mod_rewrite style rules. The [N] flag in Apache Tomcat rewrite rules is intended to trigger a loop by re-evaluating the current request URI against the entire ruleset, starting from the first rule. Due to an off-by-one programming error in the internal index tracking the rewrite rule set, the loop mechanism erroneously sets the resume index to the second rule in the configuration file rather than the first.\nThe attack flow initiates when an administrator has configured rewrite rules that rely on the [N] flag to normalize or re-process URLs iteratively. An attacker, recognizing that the first rule in the configuration is skipped during the re-evaluation cycle triggered by the [N] flag, can craft specific HTTP requests that are handled incorrectly. By bypassing the initial rule, which may contain security-critical conditions—such as URL pattern filtering, directory blocking, or access control headers—the attacker can reach subsequent rules that were not intended to be evaluated for that specific request context.\nBecause the rewrite engine does not correctly reset the pointer, the engine loses the ability to re-apply the full context of the security policy. This essentially creates a 'logic bypass' where the intended request transformation chain is truncated. The scope of the impact depends heavily on the specific configuration of the `rewrite.config` file. If the first rule acts as a security gatekeeper (e.g., blocking access to sensitive admin endpoints or forcing HTTPS), the off-by-one error allows a request to bypass this check upon re-processing.\nThis vulnerability is triggered through standard network exposure, as the rewrite valve processes incoming traffic at the HTTP/HTTPS layer. It does not require specific application-level privileges to initiate, though the impact is bounded by the existing rewrite rules defined by the system administrator. Post-exploitation, the attacker may be able to access resources that were explicitly protected by the skipped rule or inject unexpected request parameters that modify the backend application behavior. No special payload is required; the vulnerability manifests solely due to the malformed logic execution flow when the [N] flag is invoked during request parsing."
}