Skip to main content

Always-Incorrect Control Flow Implementation

CVE-2026-53404

High
7.3/10

Summary

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat versions prior to 9.0.119, 10.x prior to 10.1.56 and 11.x prior to 11.0.23. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • LOW

CWE-670 - Always-Incorrect Control Flow Implementation

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

References

Advisory Timeline

  • Published