Key points
- The vulnerability affects Apache Tomcat versions 7 through 11, including specific milestone and release candidates.
- Mark Thomas posted the advisory on October 20, classifying the severity as low according to the oss-security mailing list.
- No fix or updated version has been confirmed by the vendor in the source material provided.
Apache Tomcat administrators must review their deployments for a logic flaw in the Jasper JSTL plug-in that permits execution after a redirect. The issue impacts a wide range of software releases, spanning from version 7.0.0 up to 11.0.26. According to the official advisory posted on the oss-security mailing list, the defect allows code to run even when the page processing should have been aborted. This behavior bypasses the intended SKIP_PAGE control flow, potentially allowing unintended operations to complete after a user is redirected to a different location.
In plain English
Web applications often redirect users to new pages for security or navigation reasons. The Jasper JSTL plug-in in Apache Tomcat is supposed to stop processing the original page once a redirect command is issued. However, this flaw means the server continues to execute code from the original page after sending the redirect signal. This creates a window where additional commands can run in the background, even though the user has already moved on. It is a logic error rather than a complex exploit chain, but it undermines the expected safety boundaries of the web container.
The background
Mark Thomas published the details of this vulnerability on October 20 via the oss-security mailing list. He assigned a low severity rating to the issue, identified as CVE-2026-74049. The advisory specifically lists affected version ranges for major releases of Apache Tomcat. These include versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, 9.0.0.M1 through 9.0.122, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. The description notes that the implementation omits the necessary page abort signal, leading to the Execution After Redirect condition.
What changes now
Security teams should assume that any deployment within the listed version ranges is vulnerable until a patch is released. The source material does not indicate that a fix has been provided yet. Organizations relying on these specific builds of Apache Tomcat need to monitor vendor channels closely for updates. Until then, the risk remains present in any environment using the Jasper JSTL plug-in with the affected versions. No mitigations or workarounds were detailed in the initial advisory text.
Who needs to act first
Teams usually prioritize updating systems that face direct internet traffic or handle sensitive user sessions. Check whether your production environments use the affected Tomcat versions and the JSTL plug-in. If a fix becomes available, test it thoroughly in a staging environment before rolling it out to live servers. Back up your current configurations and application code to ensure you can revert if the update causes compatibility issues. Reduce exposure by restricting access to vulnerable endpoints while waiting for the vendor to provide a secure update.
What to do and how to stay safe
- Inventory all Apache Tomcat servers to identify if they fall within the affected version ranges.
- Monitor official Apache security announcements for the release of a patched version.
- Review application logs for unexpected code execution patterns following redirect events.
- Consult with development teams to see if the JSTL plug-in can be temporarily disabled if not required.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Apache Tomcat versions are affected by CVE-2026-74049?
Versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, 9.0.0.M1 through 9.0.122, 8.5.0
