CVE-2026-74049

A flaw was found in Apache Tomcat. The application fails to halt execution after sending an HTTP redirect response, resulting in an Execution After Redirect (EAR) condition. A remote attacker could exploit this flaw by ignoring the redirect instruction to access responses generated after the redirect, potentially leading to unauthorized information disclosure.

A flaw was found in Apache Tomcat. A failure to terminate request execution after dispatching an HTTP redirect results in an Execution After Redirect (EAR) condition. An unauthenticated remote attacker can exploit this by configuring a client to suppress standard HTTP redirect handling and inspect subsequent response bodies, potentially accessing sensitive application data generated post-redirect within the context of the running Tomcat server process and bounded by standard OS-level access controls.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure an upstream reverse proxy or web application firewall to drop response bodies when HTTP 3xx redirect status codes are returned, or update affected custom servlets to explicitly terminate execution immediately following redirect calls.