This issue allows an attacker to bypass Tomcat’s security constraints by ordering a longer path constraint before a shorter, more restrictive one. The result is that requests matching the shorter path are allowed to reach protected resources, giving the attacker unauthorized access. The type of weakness is improper access control and incorrect authorization.

Vendor Apache Software Foundation; product Apache Tomcat. Affected are all Tomcat releases from 7.0.0 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, and 11.0.0-M1 through 11.0.24. The fixes are available in Tomcat 11.0.25, 10.1.58 and 9.0.121.

EPSS is less than 1 % and the vulnerability is not listed in CISA KEV, so they provide only a very low indication of exploitation likelihood. The description states that a longer security constraint can precede a more restrictive one, allowing requests that would normally be denied to reach protected resources. This indicates a single path to unauthorized access via ordinary HTTP requests, and the CVSS score of 9.1 classifies this as a high‑severity vulnerability, indicating a potentially wide impact on confidentiality, integrity and availability depending on the resources protected. The attack vector is inferred to be remote web‑application requests against URLs matching the longest‑prefix constraint. The high CVSS score of 9.1 confirms the severity of the problem.