The bug resides in Tomcat’s RewriteValve where an OR chain of conditions is evaluated incorrectly; once the first OR condition matches, all following non-OR conditions are silently skipped. This incorrect control flow means the valve may accept and redirect or process requests that were supposed to be blocked or handled elsewhere, thereby violating the intended security logic of the web application. The flaw is a classic instance of a control flow error classified as CWE‑670.

Apache Tomcat versions from 11.0.0‑M1 through 11.0.22, 10.1.0‑M1 through 10.1.55, 9.0.0.M1 through 9.0.118, and 8.5.0 through 8.5.100 are affected. Any other end‑of‑support releases that contain the original RewriteValve implementation may also be vulnerable.

The issue can be exploited by sending crafted HTTP requests that trigger the RewriteValve, and no authentication or privileged access appears to be required, based on the description. An attacker could manipulate how requests are routed, potentially accessing unintended resources or causing service disruptions. The CVSS score of 7.3 indicates a high overall risk; the EPSS score of 0.00174 (≈0.17%) suggests a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The logic flaw itself is serious, but there is no direct remote code execution or credential escalation capability described. The vulnerability is best addressed by applying the corrected Tomcat releases.