Apache Tomcat's RewriteValve performs improper URL decoding when handling hex encoded characters, which allows an attacker to craft requests that bypass security constraints defined by the application. This flaw is a classic example of CWE‑177, where encoding or decoding logic is incorrect, leading to a violation of the intended access control policy. The vulnerability can enable any authenticated or unauthenticated user to access protected resources or functionalities they should not be allowed to reach, compromising confidentiality and integrity of protected data.

The mistake exists in Apache Tomcat versions 11.0.0‑M1 through 11.0.23, 10.1.0‑M1 through 10.1.56, 9.0.0.M1 through 9.0.119, and 8.5.0 through 8.5.100. Any deployment of these releases that has not applied the later update is exposed, and older releases that are no longer supported may also be vulnerable.

The flaw is rated CVSS 9.1, indicating high severity, yet the EPSS score is below 1 % and the vulnerability is not included in CISA’s KEV catalog, implying that known exploits are rare. The likely attack vector is through HTTP requests crafted with hex‑encoded characters that the valve mis‑decodes, leading to unauthorized resource access. The attack requires only the ability to submit such requests, so it is feasible in unprotected networks or public-facing services where Tomcat is exposed.