CVE-2026-65927

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's [N] flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls.

This is an Important flaw in Apache Tomcat due to an off-by-one error in the RewriteValve's [N] flag processing. This vulnerability can lead to an access control bypass, allowing unauthorized access to resources in applications that utilize the RewriteValve with the [N] flag.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.