Apache Tomcat failed to limit HTTP/0.9 requests to the GET method. When a security constraint permits HEAD but denies GET for a URI, an attacker can send a non‑standard HEAD request using HTTP/0.9 to trick Tomcat into treating it as a legitimate GET request. This bypass allows the attacker to access resources that should have been protected, exposing confidential data or enabling unauthorized modifications. The weakness is an input validation flaw (CWE‑20).

This vulnerability affects Apache Tomcat releases 9.x through 9.0.112, 10.1.x up to 10.1.49, and 11.0.x from 11.0.0‑M1 through 11.0.14, as well as older end‑of‑life versions. All installations using these versions are susceptible until upgraded to the patched releases.

The CVSS v3 score of 6.5 indicates medium severity, while an EPSS score of < 1 % reflects a low likelihood of exploitation in the wild. The vulnerability is remote and can be triggered over the network via HTTP requests, but requires the ability to send a malformed HTTP/0.9 HEAD request. The issue is not listed in CISA's KEV catalog, yet the attack vector remains viable for organizations maintaining unsupported Tomcat versions.