Apache Tomcat’s Jasper JSTL plug‑in implementation for the <c:redirect> tag neglects to perform a page abort (SKIP_PAGE) after executing a redirect. This flaw means that after the redirect the JSP page continues to evaluate and render subsequent content or headers, which can lead to unintended processing, mixed content, or leakage of confidential data. The weakness is identified as CWE-698, an Execution After Redirect vulnerability that allows control flow after a redirect to be exploited.

The vulnerability affects Apache Tomcat releases from 11.0.0‑M1 through 11.0.26, from 10.1.0‑M1 through 10.1.60, and from 9.0.0‑M1 through 9.0.122, as well as the older end‑of‑life ranges 8.5.0 through 8.5.100 and 7.0.0 through 7.0.109. Any Tomcat deployment using these versions—and particularly enterprise sites that rely on JSP templates that include the <c:redirect> tag—may be exposed. Unpatched Tomcat instances running on unsupported versions are also at risk.

Without the KEV flag the vulnerability is not part of the CISA Known Exploited Vulnerabilities catalog, and the EPSS score is < 1%, indicating limited public exploitation data. The CVSS score of 6.1 indicates medium severity. Based on the description, the likely attack scenario involves an attacker inserting a crafted <c:redirect> tag into a JSP page that a user can trigger, which may result in the server continuing to process the page after sending a redirect. This inferred exploit could lead to the client being redirected to malicious destinations while the server processes additional content, potentially facilitating phishing, drive‑by download attacks, or leakage of application data. The risk remains confined to the application context, affecting confidentiality and possibly integrity, but it is unlikely to compromise the underlying host.