Tomcat rewrite [N] flag bug can bypass access controls
An off-by-one error in Apache Tomcat’s RewriteValve restarts rule processing at the wrong point, undermining access checks that depend on rewrite order.
By tarpit#access-control
Tomcat security constraint bypass fixed as CVE-2026-65182
Path ordering could let requests slip past more restrictive access rules on shorter prefixes.
By tarpit