CVE-2026-59083

CRITICAL

Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-59083 has a selected CVSS score of 9.1 (critical); EIP currently links 1 curated repository PoC and 2 lab environments.

Description

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1
Lab environments
2

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 14, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Apache Tomcat

Browse Apache Software Foundation / Apache Tomcat

Default status: unaffected

CVE List11.0.0-M1 to ≤ 11.0.23affected
10.1.0-M1 to ≤ 10.1.56affected
9.0.0.M1 to ≤ 9.0.119affected
8.5.0 to ≤ 8.5.100affected
Before 8.0.0unaffected

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2026-59083Curated repository PoCby exploitintel8Exploit15 files

C · 29.6 KiB · linked to 2 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python 3 exploit for CVE-2026-59083, an Apache Tomcat RewriteValve URL decoding vulnerability. The script sends crafted HTTP GET requests with a literal '+' in the path to bypass security constraints and retrieve protected content.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates a legitimate CVE-2026-59083 security constraint bypass against Apache Tomcat. The Python script sends crafted HTTP requests with a literal '+' in the path to trigger the vulnerability and checks for a known secret marker in the response. No backdoor, concealed payload, or operator-directed harm is present. The code uses only standard library modules, performs no persistence, exfiltration, or unrelated actions, and its behavior is fully explained by the documented vulnerability.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareApache Tomcat
Attack typessecurity control bypasspath traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact poc/poc.py is explicitly described as an exploit in the README and its own header. It actively sends crafted requests to a target to trigger a vulnerability and retrieve protected content, which is the definition of an exploit.

README.md:101poc/poc.py:1-3

Requirements

  • Target Tomcat instance with a vulnerable RewriteValve configuration that carries user-controlled segments into rewritten paths and a serving layer that aliases plus and space forms.README.md:22-38
  • A lab environment with the vulnerable webapp deployed, as the exploit is designed to work against the provided Docker setup.README.md:69-86

Observed behavior

  • Sends baseline HTTP GET requests to /pages/admin/flag and /app/admin/flag to verify that the admin subtree is protected (expects 401/403).poc/poc.py:70-77
  • Sends an attack request to /pages/+admin/flag with a literal '+' in the path, which the vulnerable RewriteValve decodes to a space, bypassing security constraints.poc/poc.py:80-86
  • Sends a second attack request to /pages/%2Badmin/flag, where %2B is decoded to '+' by the connector, then the valve applies the same incorrect decode.poc/poc.py:90-92
  • Checks if the response body contains the secret marker 'payload withheld' and reports success or failure.poc/poc.py:86-107
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldTarget URL for the PoC; user-supplied via command line.poc/poc.py:67
Url
Payload withheldTarget URL for the patched control environment.README.md:81
String
Payload withheldMarker string used to confirm successful bypass; expected in response body.poc/poc.py:48
Review boundaries

What the analysis did not establish

  • The evidence includes only three text files (README.md, poc/poc.py, poc_verification_report.md) from a larger directory. The Dockerfiles, webapp configuration, and other supporting files are not provided, so the full lab environment cannot be independently verified.
  • The analysis is based solely on the supplied text; the code was not executed, and its behavior is inferred from the source code and documentation.
  • Only the three selected text files were reviewed; 12 unclassified files (e.g., Dockerfiles, webapp configs) were not analyzed for text content, though their metadata was inspected and no binaries were flagged.
  • The review does not execute the PoC or verify the exploit's effectiveness; it only assesses the supplied source code for backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

2
GitHub

CVE-2026-59083/docker-compose.control.yml

CVE-2026-59083Created Vuln labCVE-2026-59083Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a patched control build of Apache Tomcat 10.1.57, serving a web application that demonstrates the fix for CVE-2026-59083. The application includes a RewriteValve rule, a security constraint, and a JSP front controller with application-level authorization and slug normalization.

CVE-2026-59083/docker-compose.control.yml:1-14CVE-2026-59083/Dockerfile.patched:1-22CVE-2026-59083/README.md:1-112

Lab assessment

Vulnerability lab

The README explicitly describes the unit as a lab for CVE-2026-59083, providing a patched control environment to verify the fix. The Dockerfile builds a specific Tomcat version (10.1.57) known to contain the fix, and the web application is configured with the vulnerable RewriteValve rule and security constraints to demonstrate the bypass and its mitigation.

CVE-2026-59083/README.md:1-3CVE-2026-59083/README.md:55-62CVE-2026-59083/Dockerfile.patched:1-4
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

patched Tomcat servercontrol environment for CVE-2026-59083

A Docker service built from Dockerfile.patched, running Apache Tomcat 10.1.57 with a web application that includes a RewriteValve rule, a security constraint on /app/admin/*, and a JSP front controller. It exposes port 8080 on the container, mapped to a configurable host port (default 8081). A healthcheck polls /pages/index.

CVE-2026-59083/docker-compose.control.yml:2-13CVE-2026-59083/Dockerfile.patched:1-22

app.jsp

front controllerapplication-level authorizationslug-normalizing page resolver

A JSP page mapped to /app/* that implements application-level authorization (checking for a Bearer token on /admin paths) and resolves page slugs after normalizing whitespace around path separators. It serves a public index page and a protected admin flag page.

CVE-2026-59083/webapp/WEB-INF/app.jsp:1-47

rewrite.config

RewriteValve ruleURL rewriting

A RewriteValve configuration that rewrites requests from /pages/* to /app/*, enabling the attack path for CVE-2026-59083.

CVE-2026-59083/webapp/WEB-INF/rewrite.config:1-3

web.xml

declarative security constraintservlet mapping

The deployment descriptor that maps the app servlet to /app/* and enforces a security constraint requiring the admin role for /app/admin/*, using BASIC authentication.

CVE-2026-59083/webapp/WEB-INF/web.xml:1-38

tomcat-users.xml

user realmauthentication

Defines a single user 'admin' with password 'lab-admin-password' and role 'admin', used for the BASIC authentication required by the security constraint.

CVE-2026-59083/config/tomcat-users.xml:1-8

context.xml

RewriteValve activation

Enables the RewriteValve for the web application context.

CVE-2026-59083/webapp/META-INF/context.xml:1-4
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-59083

Supported by supplied evidence

The lab is explicitly built to demonstrate CVE-2026-59083. The README describes the vulnerability as an incorrect URL decoding in RewriteValve, the Dockerfile builds the patched version (10.1.57) that contains the fix, and the PoC script targets the exact bypass. The unit path is named after the CVE.

CVE-2026-59083/README.md:1-3CVE-2026-59083/README.md:15-20CVE-2026-59083/Dockerfile.patched:3-4CVE-2026-59083/poc/poc.py:1-5
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker with Compose installed, as stated in the README.CVE-2026-59083/README.md:55
  • The patched control environment must be built and started using 'docker compose -f docker-compose.control.yml up -d --build'.CVE-2026-59083/README.md:62-63
  • The PoC script (poc/poc.py) requires Python 3 with standard library only.CVE-2026-59083/README.md:67CVE-2026-59083/poc/poc.py:1

Evidence-described exercise path

  1. Build and start the patched control environment: docker compose -f docker-compose.control.yml up -d --buildCVE-2026-59083/README.md:62-63
  2. Run the PoC script against the control environment: python3 poc/poc.py http://127.0.0.1:8081CVE-2026-59083/README.md:63
  3. Observe that the PoC reports [FAILED], confirming the bypass does not work on the patched version.CVE-2026-59083/README.md:63CVE-2026-59083/poc_verification_report.md:1-3
  4. Tear down the environment: docker compose -f docker-compose.control.yml down -vCVE-2026-59083/README.md:66
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained Docker Compose lab for a specific CVE. It builds a patched Tomcat server, exposes a port for testing, and runs a PoC script that only makes HTTP requests to the lab's own target. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior is present. The healthcheck uses curl against localhost, which is normal for container readiness.

CVE-2026-59083/docker-compose.control.yml:1-14CVE-2026-59083/Dockerfile.patched:1-22CVE-2026-59083/poc/poc.py:1-111
Review boundaries

What the analysis did not establish

  • The packet includes only the patched control Compose file (docker-compose.control.yml); the vulnerable Compose file (docker-compose.yml) is referenced in the README and file inventory but its content is not provided in evidence_files, limiting full environment comparison.
  • The PoC script (poc/poc.py) is a Python script that makes HTTP requests; its behavior is fully visible in the supplied text, but it is not executed in this analysis.
  • The Dockerfile downloads a Tomcat tarball from archive.apache.org at build time; the URL is pinned with a SHA-256 hash, but the download itself is not inspected.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

CVE-2026-59083/docker-compose.yml

CVE-2026-59083Created Vuln labCVE-2026-59083Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that builds and runs a vulnerable Apache Tomcat 10.1.56 instance with a custom web application demonstrating CVE-2026-59083, a RewriteValve URL decoding security constraint bypass.

CVE-2026-59083/docker-compose.yml:1-14CVE-2026-59083/Dockerfile.vulnerable:1-22CVE-2026-59083/README.md:1-112

Lab assessment

Vulnerability lab

The environment is explicitly designed to reproduce CVE-2026-59083, a security constraint bypass in Apache Tomcat's RewriteValve. It includes a vulnerable Tomcat version, a custom webapp with a rewrite rule and protected resource, a PoC script, and documentation describing the vulnerability and reproduction steps.

CVE-2026-59083/README.md:1-5CVE-2026-59083/README.md:45-55CVE-2026-59083/poc/poc.py:1-5
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

web

vulnerable targetTomcat application server

A Docker service built from Dockerfile.vulnerable, running Apache Tomcat 10.1.56 with a custom webapp that includes a RewriteValve rule, a security constraint on /app/admin/*, and a JSP front controller with application-level authorization and slug normalization. It exposes port 8080 and has a healthcheck.

CVE-2026-59083/docker-compose.yml:2-13CVE-2026-59083/Dockerfile.vulnerable:1-22CVE-2026-59083/webapp/WEB-INF/web.xml:1-38CVE-2026-59083/webapp/WEB-INF/app.jsp:1-47

poc.py

exploit scriptverification tool

A Python 3 script that sends crafted HTTP requests to the target to verify the CVE-2026-59083 bypass. It checks baseline protection, sends a request with a literal '+' in the path, and confirms the protected content is returned without authentication.

CVE-2026-59083/poc/poc.py:1-111

app.jsp

front controllervulnerable application logic

A JSP page that acts as a front controller for the webapp. It performs application-level authorization based on pathInfo, applies slug normalization (whitespace trimming), and serves pages from an in-memory map, including a protected admin flag.

CVE-2026-59083/webapp/WEB-INF/app.jsp:1-47

rewrite.config

rewrite rule configuration

A RewriteValve configuration file that defines a rule rewriting /pages/* to /app/*, which is the entry point for the bypass attack.

CVE-2026-59083/webapp/WEB-INF/rewrite.config:1-3

web.xml

declarative security configuration

The web application deployment descriptor that maps the app servlet to /app/* and defines a security constraint requiring the admin role for /app/admin/*, with BASIC authentication.

CVE-2026-59083/webapp/WEB-INF/web.xml:1-38

tomcat-users.xml

user credentials for declarative security

Defines a user 'admin' with password 'lab-admin-password' and role 'admin', used for the BASIC auth constraint in web.xml.

CVE-2026-59083/config/tomcat-users.xml:1-8
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-59083

Supported by supplied evidence

The lab explicitly targets CVE-2026-59083. The README, PoC script, and verification report all describe the vulnerability as a RewriteValve URL decoding bypass. The vulnerable Dockerfile uses Tomcat 10.1.56, which is within the affected range, and the webapp configuration matches the described attack chain.

CVE-2026-59083/README.md:1-5CVE-2026-59083/README.md:45-55CVE-2026-59083/poc/poc.py:1-5CVE-2026-59083/Dockerfile.vulnerable:4
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker with Compose installed.CVE-2026-59083/README.md:57
  • Network access to archive.apache.org to download the Tomcat tarball during build.CVE-2026-59083/Dockerfile.vulnerable:8-9
  • Python 3 with standard library for running the PoC script.CVE-2026-59083/README.md:67

Evidence-described exercise path

  1. Build and start the vulnerable environment: docker compose -f docker-compose.yml up -d --buildCVE-2026-59083/README.md:62-63
  2. Run the PoC script against the vulnerable target: python3 poc/poc.py http://127.0.0.1:8080CVE-2026-59083/README.md:64
  3. Observe the output: the script sends baseline requests expecting 401, then a bypass request with /pages/+admin/flag expecting 200 and the secret flag.CVE-2026-59083/poc/poc.py:70-100
  4. Optionally, run the patched control environment to confirm the bypass fails: docker compose -f docker-compose.control.yml up -d --build && python3 poc/poc.py http://127.0.0.1:8081CVE-2026-59083/README.md:66-68
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. The Dockerfile builds a Tomcat instance from a pinned archive, copies local webapp files, and exposes port 8080. The PoC script only sends HTTP requests to the local target. No evidence of host escape, external connectivity beyond the declared archive download, persistence, credential theft, or destructive behavior. The lab's behavior is directed solely at its own vulnerable target.

CVE-2026-59083/docker-compose.yml:1-14CVE-2026-59083/Dockerfile.vulnerable:1-22CVE-2026-59083/poc/poc.py:1-111
Review boundaries

What the analysis did not establish

  • The packet includes only the vulnerable environment's compose file and Dockerfile; the patched control environment (docker-compose.control.yml, Dockerfile.patched) is referenced but not included in evidence_files, so its behavior cannot be assessed.
  • The PoC verification report references lab-internal artifacts (e.g., artifacts/poc_run.txt) that are not included, so the claimed reproduction ratio cannot be independently confirmed from the supplied evidence.
  • The Dockerfile downloads a Tomcat tarball from archive.apache.org at build time; the packet does not include the tarball, so the build depends on external network access and the integrity of the remote archive.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

3