The vulnerability allows an attacker to exploit improperly enforced security constraints in Apache Tomcat. When multiple method constraints define an HTTP method for the same URL extension, the server may incorrectly apply one of those constraints, permitting unauthorized HTTP method execution. This incorrect application can lead to bypassing access controls and exposing resources that should be protected, potentially violating confidentiality and integrity of the application data.

This flaw affects all Apache Tomcat releases from version 7.0.0 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.117, 10.1.0-M1 through 10.1.54, and 11.0.0-M1 through 11.0.21. Administrators of any of these versions should review deployment configurations and verify which Tomcat instance is in use.

The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, but the data does not indicate a known public exploit. However, the flaw can be exploited remotely via HTTP requests that target conflicting method constraints, making it possible for an attacker to perform unauthorized actions without authentication. The CVSS score of 9.1 indicates a high severity, and the potential to bypass authorization warrants prompt remediation.