Tomcat rewrite [N] flag bug can bypass access controls
An off-by-one error in Apache Tomcat’s RewriteValve restarts rule processing at the wrong point, undermining access checks that depend on rewrite order.
Apache Tomcat has fixed an important off-by-one flaw in its rewrite valve that can let requests slip past access controls.
CVE-2026-65927 affects the [N] flag on rewrite rules. Because of the error, rewrite processing restarts at the second rule instead of the first. Configurations that rely on rule order to enforce access restrictions can therefore be bypassed.
The issue hits current supported lines: Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, and 9.0.0.M1 through 9.0.120. End-of-life 8.5 releases through 8.5.100 are also known to be affected; Tomcat 7 and earlier are not.
Mark Thomas reported the advisory on behalf of the project. Users should move to 11.0.25, 10.1.58, or 9.0.121. The flaw was found by 4ra1n, pyn3rd, and unam4.