Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 t

Summary

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.

Timeline

1. Feb 23, 2018, 11:00 PM UTCCVE published
2. Oct 15, 2026, 5:32 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 15, 2026, 5:32 PM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Tomcat

  Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 9.0.0M1 · fixed in 9.0.5

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 8.5.0 · fixed in 8.5.28

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 7.0.0 · fixed in 7.0.85

References 25