Apache Tomcat Vulnerability Circumvents Access Rules

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apache Tomcat Vulnerability Allows Bypass of Access Controls Apache disclosed a vulnerability in Tomcat (CVE-2026-24733) that allows attackers to bypass access controls through legacy HTTP/0.9 requests under specific configurations. This low-severity issue was identified by the Apache Tomcat security team and affects systems using certain access-control rules. The original advisory was published on February 17, 2026. 2 sources 30