The bug resides in Tomcat’s RewriteValve where an OR chain of conditions is evaluated incorrectly; once the first OR condition matches, all following non-OR conditions are silently skipped. This incorrect control flow means the valve may accept and redirect or process requests that were supposed to be blocked or handled elsewhere, thereby violating the intended security logic of the web application. The flaw is a classic instance of a control flow error classified as CWE‐670.

Apache Tomcat versions from 11.0.0‑M1 through 11.0.22, 10.1.0‑M1 through 10.1.55, 9.0.0.M1 through 9.0.118, and 8.5.0 through 8.5.100 are affected. Any other end‑of‑support releases that contain the original RewriteValve implementation may also be vulnerable.

The issue can be exploited by sending crafted HTTP requests that trigger the RewriteValve, requiring no authentication or privileged access. An attacker could manipulate how requests are routed, potentially accessing unintended resources or causing service disruptions. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the current public knowledge suggests low to moderate exposure, but the logic flaw itself is severe; no direct remote code execution or credential escalation is stated in the description. The vulnerability is best addressed by applying the corrected Tomcat releases.