DEBIAN-CVE-2026-24733
Record from OSV · Published February 17, 2026
Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112. Older, EOL versions are also affected. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| tomcat10 | Debian:13 | 10.1.52-1~deb13u1 |
| tomcat10 | Debian:12 | 10.1.52-1~deb12u1 |
| tomcat11 | Debian:13 | 11.0.15-1~deb13u1 |
| tomcat9 | Debian:12 | 9.0.70-2 |
| tomcat9 | Debian:14 | 9.0.70-2 |
| tomcat9 | Debian:13 | 9.0.70-2 |
| tomcat11 | Debian:14 | 11.0.15-1 |
| tomcat10 | Debian:14 | 10.1.52-1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | tomcat10 | 0, 10.1.52-1~deb12u1, 10.1.46-1 |
| Debian:12 | tomcat10 | 10.1.6-1+deb12u2, 10.1.31-1, 10.1.33-1 |
| Debian:13 | tomcat11 | 0, 11.0.6-1, 11.0.11-1 |
| Debian:12 | tomcat9 | 0 |
| Debian:14 | tomcat9 | 0 |
| Debian:13 | tomcat9 | 0 |
| Debian:14 | tomcat11 | 0, 11.0.11-1, 11.0.15-1~deb13u1 |
| Debian:14 | tomcat10 | 0, 10.1.40-1, 10.1.46-1 |
Timeline
- Feb 17, 2026 CVE Published
- Oct 1, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2026-24733
vulnetix vdb fixes DEBIAN-CVE-2026-24733Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2026-24733/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart