CVE-2026-65927

The record

Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue.

Affected packages

Related vulnerabilities

• CVE-2026-42618 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in… CWE-193
• CVE-2026-106584 In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times… CWE-193
• CVE-2026-90781 alsa-lib through 1.2.16.1 contains a stack buffer overflow in the… CWE-193
• CVE-2026-86297 A vulnerability was identified in D-Link DIR-605 B1v202WWB03. CWE-193
• CVE-2026-81738 OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to… CWE-193
• CVE-2026-57160 PJSIP is a free and open source multimedia communication library written in C. CWE-193
• CVE-2026-17469 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial… CWE-193
• CVE-2026-14368 The LwM2M JSON content formatter's get_string() in subsys/net/lib/lwm2m/lwm2m_rw_json.c… CWE-193