CVE-2026-24733

Description

Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112. Older, EOL versions are also affected. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.

How to fix CVE-2026-24733

To remediate CVE-2026-24733, upgrade the affected package to a fixed version below.

• —upgrade to 9.0.113 or later
• —upgrade to 10.1.52-1~deb12u1 or later
• —upgrade to 11.0.15-1~deb13u1 or later
• —upgrade to 9.0.70-2 or later
• —upgrade to 11.0.15 or later
• —upgrade to 11.0.15 or later
• —upgrade to 11.0.15 or later

Is CVE-2026-24733 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

• from 0, < 9.0.113, >= 10.1.0, < 10.1.50, >= 11.0.0, < 11.0.15
• from 0, < 10.1.52-1~deb12u1
• from 0, < 11.0.15-1~deb13u1
• from 0, < 9.0.70-2
• >= 11.0.0-M1, < 11.0.15
• >= 11.0.0-M1, < 11.0.15
• >= 11.0.0-M1, < 11.0.15

CVSS scores

References (10)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-24733
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2026-24733
• PATCHgithub.com/apache/tomcat
• WEBgithub.com/apache/tomcat/commit/2e2fa23f2635bbb819759576a2f2f5e64ecf7c5f