Vulnpedia
← Search CVEs

CVE-2026-74049

N/A

Published 2026-10-20 · Last modified 2026-10-20

Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 18th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

—CVSS · not scored

  • No impact metrics

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Apache Software Foundation

Products Apache Tomcat

Weakness (CWE)

  • CWE-698: Execution After Redirect (EAR)

CVSS vector

Not yet scored.

References and research data (JSON)

Vendor product assessments

Showing 32 of 153 vendor product statements; 121 omitted. Read the full vendor advisory.

  • tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat10-common-0:10.1.61-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat10-lib-0:10.1.61-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat11-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat11-el-6.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat11-user-instance-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat-servlet-6.0-api as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-servlet-6.0-api

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat9-jsp-2.3-api as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat9-jsp-2.3-api

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat6-admin-webapps as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat6-admin-webapps

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat6-log4j as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat6-log4j

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat-el-2.2-api as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-el-2.2-api

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat-webapps as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-webapps

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat-admin-webapps as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-admin-webapps

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat.src as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat?arch=src

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • tomcat-docs-webapp as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-docs-webapp

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • jws5-tomcat as a component of Red Hat JBoss Web Server 5 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws5-tomcat

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • jws5-tomcat-javadoc as a component of Red Hat JBoss Web Server 5 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws5-tomcat-javadoc

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • jws5-tomcat-webapps as a component of Red Hat JBoss Web Server 5 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws5-tomcat-webapps

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • jws6-tomcat-jsp-3.1-api as a component of Red Hat JBoss Web Server 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws6-tomcat-jsp-3.1-api

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • jws7-tomcat.src as a component of Red Hat JBoss Web Server 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws7-tomcat?arch=src

    • workaround: Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.
    • none available: Fix deferred
    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00
  • hi/tomcat as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/tomcat?repository_url=registry.redhat.io/hi/tomcat

    Red Hat · CVE-2026-74049 · Updated 2026-10-22T21:20:56+00:00

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS