CVE-2026-65927: Off-by-one Error

August 25, 2026 (updated August 27, 2026)

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.

References

lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4
nvd.nist.gov/vuln/detail/CVE-2026-65927

Code Behaviors & Features

Detect and mitigate CVE-2026-65927 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →