Apache Tomcat - Security constraint bypass with HTTP/0.9

🗓️ 17 Feb 2026 21:31:13Reported by GitHub Advisory DatabaseType

Tomcat HTTP/0.9 HEAD requests can bypass GET security constraints; upgrade to fixed releases.

Reporter	Title	Published	Views	Family All 148
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tomcat-embed-core-9.0.110.jar	28 Apr 202622:39	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache Tomcat affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Jun 202613:47	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat and Lodash might affect IBM Storage Defender Copy Data Management	4 May 202616:20	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Apache Tomcat and mchange-commons-java, IBM ApplinX is vulnerable to Improper Input Validation vulnerablities (CVE-2025-66614, CVE-2026-24733, CVE-2026-24734) and an 'Injection' vulnerability (CVE-2026-27727).	8 Apr 202609:12	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which is vulnerable to multiple CVEs.	27 Apr 202607:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Build addresses multiple vulnerabilities.	25 Mar 202613:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Release	31 Mar 202609:44	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat Server (CVE-2025-61795, CVE-2025-66614, CVE-2026-24733, CVE-2026-24734) affect Power HMC.	31 Mar 202615:28	–	ibm
ATTACKERKB	CVE-2026-24733	17 Feb 202618:50	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2026-1496)	30 Mar 202600:00	–	nessus

Vulners

Node

org.apache.tomcat tomcat-coyoteRange<9.0.113maven

org.apache.tomcat tomcat-coyoteRange10.1.0-M1–10.1.50maven

org.apache.tomcat tomcat-coyoteRange11.0.0-M1–11.0.15maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-24733
lists	www.lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f
github	www.github.com/apache/tomcat/commit/2e2fa23f2635bbb819759576a2f2f5e64ecf7c5f
github	www.github.com/apache/tomcat/commit/6c73d74ff281260d74c836370ff6b82f1da8048b
github	www.github.com/apache/tomcat/commit/711b465cf22684a1acf0cb43501cdbbce9b6c5f4
tomcat	www.tomcat.apache.org/security-10.html
tomcat	www.tomcat.apache.org/security-11.html
tomcat	www.tomcat.apache.org/security-9.html
github	www.github.com/advisories/GHSA-qq5r-98hh-rxc9

29 Jun 2026 20:37Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.13.7 - 6.5

EPSS0.00494

SSVC

CWE-20