The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4

Summary

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.

Timeline

1. Feb 28, 2018, 8:00 PM UTCCVE published
2. Oct 15, 2026, 5:31 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 15, 2026, 5:31 PM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Tomcat

  Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 9.0.0 · fixed in 9.0.5

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 8.5.0 · fixed in 8.5.28

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 8.0.0 · fixed in 8.0.51

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 7.0.0 · fixed in 7.0.86

References 25