UnratedFix available

DEBIAN-CVE-2026-24733

Type: advisorySource: OSV1 source record

Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112. Older, EOL versions are also affected. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.

Announced 17 Feb 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-24733

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-24733

tomcat10

Source reference: /affected/0/package/name

Affected versions: 10.1.10-1
Source reference: /affected/0/versions
10.1.13-1
Source reference: /affected/0/versions
10.1.14-1
Source reference: /affected/0/versions
10.1.15-1
Source reference: /affected/0/versions
10.1.16-1
Source reference: /affected/0/versions
10.1.20-1
Source reference: /affected/0/versions
10.1.23-1
Source reference: /affected/0/versions
10.1.25-1
Source reference: /affected/0/versions
10.1.25-1~bpo12+1
Source reference: /affected/0/versions
10.1.25-2
Source reference: /affected/0/versions
10.1.30-1
Source reference: /affected/0/versions
10.1.30-1~bpo12+1
Source reference: /affected/0/versions
10.1.31-1
Source reference: /affected/0/versions
10.1.33-1
Source reference: /affected/0/versions
10.1.33-1~bpo12+1
Source reference: /affected/0/versions
10.1.34-0+deb12u1
Source reference: /affected/0/versions
10.1.34-0+deb12u2
Source reference: /affected/0/versions
10.1.34-1
Source reference: /affected/0/versions
10.1.35-1
Source reference: /affected/0/versions
10.1.40-1
Source reference: /affected/0/versions
10.1.40-1~bpo12+1
Source reference: /affected/0/versions
10.1.46-1
Source reference: /affected/0/versions
10.1.6-1
Source reference: /affected/0/versions
10.1.6-1+deb12u1
Source reference: /affected/0/versions
10.1.6-1+deb12u2
Source reference: /affected/0/versions
10.1.7-1
Source reference: /affected/0/versions
10.1.8-1
Source reference: /affected/0/versions
10.1.9-1
Source reference: /affected/0/versions
Fixed versions: 10.1.52-1~deb12u1
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

tomcat10

Source reference: /affected/1/package/name

Affected versions: 10.1.40-1
Source reference: /affected/1/versions
10.1.46-1
Source reference: /affected/1/versions
10.1.52-1~deb12u1
Source reference: /affected/1/versions
Fixed versions: 10.1.52-1~deb13u1
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

tomcat10

Source reference: /affected/2/package/name

Affected versions: 10.1.40-1
Source reference: /affected/2/versions
10.1.46-1
Source reference: /affected/2/versions
10.1.52-1~deb12u1
Source reference: /affected/2/versions
10.1.52-1~deb13u1
Source reference: /affected/2/versions
Fixed versions: 10.1.52-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

tomcat11

Source reference: /affected/3/package/name

Affected versions: 11.0.11-1
Source reference: /affected/3/versions
11.0.6-1
Source reference: /affected/3/versions
Fixed versions: 11.0.15-1~deb13u1
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

tomcat11

Source reference: /affected/4/package/name

Affected versions: 11.0.11-1
Source reference: /affected/4/versions
11.0.15-1~deb13u1
Source reference: /affected/4/versions
11.0.6-1
Source reference: /affected/4/versions
Fixed versions: 11.0.15-1
Source reference: /affected/4/ranges
Prerequisites: Not stated in this record

tomcat9

Source reference: /affected/5/package/name

Affected versions: Not stated in this record
Fixed versions: 9.0.70-2
Source reference: /affected/5/ranges
Prerequisites: Not stated in this record

tomcat9

Source reference: /affected/6/package/name

Affected versions: Not stated in this record
Fixed versions: 9.0.70-2
Source reference: /affected/6/ranges
Prerequisites: Not stated in this record

tomcat9

Source reference: /affected/7/package/name

Affected versions: Not stated in this record
Fixed versions: 9.0.70-2
Source reference: /affected/7/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "10.1.52-1~deb12u1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat10",
      "purl": "pkg:deb/debian/tomcat10?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "10.1.10-1",
      "10.1.13-1",
      "10.1.14-1",
      "10.1.15-1",
      "10.1.16-1",
      "10.1.20-1",
      "10.1.23-1",
      "10.1.25-1",
      "10.1.25-1~bpo12+1",
      "10.1.25-2",
      "10.1.30-1",
      "10.1.30-1~bpo12+1",
      "10.1.31-1",
      "10.1.33-1",
      "10.1.33-1~bpo12+1",
      "10.1.34-0+deb12u1",
      "10.1.34-0+deb12u2",
      "10.1.34-1",
      "10.1.35-1",
      "10.1.40-1",
      "10.1.40-1~bpo12+1",
      "10.1.46-1",
      "10.1.6-1",
      "10.1.6-1+deb12u1",
      "10.1.6-1+deb12u2",
      "10.1.7-1",
      "10.1.8-1",
      "10.1.9-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24733.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "10.1.52-1~deb13u1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat10",
      "purl": "pkg:deb/debian/tomcat10?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "10.1.40-1",
      "10.1.46-1",
      "10.1.52-1~deb12u1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24733.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "10.1.52-1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat10",
      "purl": "pkg:deb/debian/tomcat10?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "10.1.40-1",
      "10.1.46-1",
      "10.1.52-1~deb12u1",
      "10.1.52-1~deb13u1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24733.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "11.0.15-1~deb13u1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat11",
      "purl": "pkg:deb/debian/tomcat11?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "11.0.11-1",
      "11.0.6-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24733.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "11.0.15-1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat11",
      "purl": "pkg:deb/debian/tomcat11?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "11.0.11-1",
      "11.0.15-1~deb13u1",
      "11.0.6-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24733.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "9.0.70-2"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat9",
      "purl": "pkg:deb/debian/tomcat9?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24733.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "9.0.70-2"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat9",
      "purl": "pkg:deb/debian/tomcat9?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24733.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "9.0.70-2"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat9",
      "purl": "pkg:deb/debian/tomcat9?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24733.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #56685 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 16:46:05 GMT
Publisher date: Tue, 17 Feb 2026 19:21:56 GMT

Read the original announcement