CVE-2026-74049
Fixed in a distro release EPSS <1%
Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
Products: Apache Software Foundation Apache Tomcat
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | tomcat10 | no fix |
| Debian:12 | tomcat9 | 9.0.70-2 |
| Debian:13 | tomcat10 | no fix |
| Debian:13 | tomcat11 | no fix |
| Debian:13 | tomcat9 | 9.0.70-2 |
| Debian:14 | tomcat10 | no fix |
| Debian:14 | tomcat11 | no fix |
| Debian:14 | tomcat9 | 9.0.70-2 |
| Ubuntu:24.04:LTS | tomcat10 | no fix |
| Ubuntu:24.04:LTS | tomcat9 | no fix |
| Ubuntu:26.04:LTS | tomcat10 | no fix |
| Ubuntu:26.04:LTS | tomcat11 | no fix |
| Ubuntu:26.04:LTS | tomcat9 | no fix |
| Ubuntu:26.10 | tomcat10 | no fix |
| Ubuntu:26.10 | tomcat11 | no fix |
| Ubuntu:26.10 | tomcat9 | no fix |
| Ubuntu:Pro:14.04:LTS | tomcat6 | no fix |
| Ubuntu:Pro:14.04:LTS | tomcat7 | no fix |
| Ubuntu:Pro:16.04:LTS | tomcat7 | no fix |
| Ubuntu:Pro:16.04:LTS | tomcat8 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat8 | no fix |
| Ubuntu:Pro:18.04:LTS | tomcat9 | no fix |
| Ubuntu:Pro:20.04:LTS | tomcat9 | no fix |
| Ubuntu:Pro:22.04:LTS | tomcat9 | no fix |
| openSUSE:Tumbleweed | tomcat | 9.0.123-1.1 |
| openSUSE:Tumbleweed | tomcat10 | 10.1.61-1.1 |
| openSUSE:Tumbleweed | tomcat11 | 11.0.27-1.1 |