Back Cybersecuritynews

Apache Tomcat Vulnerabilities Let Attackers Bypass Security Constraints via HTTP/0.9 Requests

Cybersecuritynews •Guru Baran • February 20, 2026

Apache Tomcat has disclosed CVE-2026-24733, a Low-severity security constraint bypass that can be triggered via HTTP/0.9 requests when certain access-control rules are configured in a specific way. The Apache Tomcat security team identified the issue, and the original advisory was published on 2026-02-17. At a high level, the vulnerability stems from Tomcat not restricting HTTP/0.9 […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apache Tomcat Vulnerability Allows Bypass of Access Controls Apache disclosed a vulnerability in Tomcat (CVE-2026-24733) that allows attackers to bypass access controls through legacy HTTP/0.9 requests under specific configurations. This low-severity issue was identified by the Apache Tomcat security team and affects systems using certain access-control rules. The original advisory was published on February 17, 2026. 2 sources 30

Extracted Entities

CVEs (1)

CVE-2026-24733

Platforms (1)

Apache Tomcat