Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if…

CVE-2026-53404 is a control-flow bug in Apache Tomcat's RewriteValve — the optional URL rewriting filter modeled on Apache httpd's mod_rewrite. When a RewriteRule is guarded by a chain of RewriteCond directives that mixes [OR] flags and plain (AND) conditions, the valve short-circuits the moment the first OR condition matches and never evaluates the remaining AND conditions. The rewrite then fires even though the full predicate was never satisfied. Affected: Tomcat 11.0.0-M1 through 11.0.22 and Tomcat 9.0.0.M1 through 9.0.118. Fixed in 11.0.23 / 9.0.119 (commits b647cb58 and fe06ae8a).

Apache marked this Low, and that's the right call. The bug only manifests if (a) you've enabled the rewrite valve at all — it ships off by default — and (b) your rewrite.config actually mixes [OR]-flagged and unflagged conditions guarding a single rule, AND (c) one of those conditions is acting as a security gate (e.g., requiring an internal IP or specific Host header before allowing an internal-only path). That's a small slice of the install base, and the worst-case outcome is rule misfire — typically an internal URL being rewritten/exposed — not RCE, not auth bypass to admin. Vendor severity matches reality.

Why this verdict

• Non-default component: RewriteValve is opt-in. The vast majority of Tomcat deployments never load it — fronting nginx/httpd/F5 handles rewrites.
• Configuration-dependent bug: Even with the valve enabled, the defect only manifests when an [OR] chain is mixed with unflagged AND conditions guarding the same rule. Cosmetic rewrites (canonical host, trailing slash) are unaffected.
• Anti-pattern dependency: Exploiting it for security impact requires that the operator used rewrite conditions as an access-control gate — long discouraged by Tomcat and httpd documentation alike.
• Bounded blast radius: Successful exploitation surfaces whatever the rewrite target exposes. Any sane app behind it has its own authn. No RCE, no deserialization, no admin takeover from this CVE alone.
• Role multiplier: Tomcat itself is widely deployed, but the affected component (RewriteValve) is never the identity, hypervisor, CI, backup, or kernel-agent layer. Even on a high-value host running Tomcat (e.g., an internal app server), the bug yields at most an unauthorized URL rewrite — not fleet-scale or domain-scale compromise. Floor stays at LOW.
• No KEV / no PoC / no in-the-wild: Disclosed 2026-06-29; nothing weaponized. EPSS will settle near zero.

Why not higher?

MEDIUM would require either a default-on configuration, a security-gating use pattern that's common in the wild, or a chained impact (auth bypass, RCE) that this CVE does not provide. HIGH would require KEV listing or an authentication-layer breakthrough — neither is present.

Why not lower?

IGNORE is wrong because the defect IS exploitable in the narrow shops that do gate internal paths via mixed-OR rewrites, and patching is a cheap point-release bump. It deserves backlog tracking, not active suppression.

1. Audit rewrite.config for [OR] mixed with unflagged RewriteCond blocks — Grep every Catalina host config and WEB-INF/rewrite.config for [OR]. Any rule that mixes [OR] and AND-style conditions, AND uses one of them as a security predicate (IP, Host, mTLS attr), is a live exposure. Splitting into two separate rules or restructuring the predicate eliminates the bug pre-patch. Complete within the noisgate remediation window for LOW (backlog hygiene, ~365 days), but if any flagged rule is a security gate, treat it as a CRITICAL config error and fix immediately.
2. Disable RewriteValve where it is not actively used — Many Tomcat installs inherited the valve from a template and never use it. Remove the <Valve className="...rewrite.RewriteValve"/> entry from server.xml / context.xml on hosts that don't need rewrites. Eliminates this CVE and reduces overall attack surface.
3. Move security predicates out of mod_rewrite-style logic — IP allowlists belong in RemoteAddrValve / RemoteIpValve or upstream NGFW/WAF rules — not in RewriteCond. Refactor any configs that use rewrite as authorization within the LOW remediation window.
4. Patch to Tomcat 9.0.119 or 11.0.23 — No mitigation SLA applies at LOW. Apply via your normal Tomcat point-release cycle alongside other Q3 advisories — noisgate remediation SLA of ≤ 365 days is the deadline.

Run this on each Tomcat host as a user able to read $CATALINA_HOME/conf/ and $CATALINA_BASE/webapps/*/WEB-INF/. Invoke as ./check-cve-2026-53404.sh /opt/tomcat. Prints VULNERABLE, PATCHED, or UNKNOWN and exits 1/0/2 respectively.

#!/usr/bin/env bash
# check-cve-2026-53404.sh — Tomcat RewriteValve [OR] short-circuit
# Usage: ./check-cve-2026-53404.sh <CATALINA_HOME>
set -u
CATALINA_HOME="${1:-/opt/tomcat}"

if [[ ! -d "$CATALINA_HOME" ]]; then
  echo "UNKNOWN: $CATALINA_HOME not found"; exit 2
fi

# 1) Version detection
VER="$("$CATALINA_HOME/bin/version.sh" 2>/dev/null | awk -F': ' '/Server number/ {print $2}')"
if [[ -z "$VER" ]]; then
  echo "UNKNOWN: cannot determine Tomcat version"; exit 2
fi

# 2) Compare against fixed versions
vuln=0
IFS='.' read -r MA MI PA <<<"$VER"
case "$MA" in
  9)  [[ "$MI" -eq 0 && "$PA" -lt 119 ]] && vuln=1 ;;
  11) [[ "$MI" -eq 0 && "$PA" -lt 23 ]]  && vuln=1 ;;
  *)  : ;;  # 10.1 / 8.5 / future — confirm via advisory
esac

# 3) RewriteValve usage check
rv=0
rx=0
while IFS= read -r f; do
  grep -lq 'org.apache.catalina.valves.rewrite.RewriteValve' "$f" && rv=1
done < <(find "$CATALINA_HOME" -type f \( -name 'server.xml' -o -name 'context.xml' \) 2>/dev/null)

while IFS= read -r cfg; do
  if grep -qE '^[[:space:]]*RewriteCond[^#]*\[OR\]' "$cfg" \
     && grep -qE '^[[:space:]]*RewriteCond[^#]*$' "$cfg"; then
    rx=1
  fi
done < <(find "$CATALINA_HOME" -type f -name 'rewrite.config' 2>/dev/null)

# 4) Verdict
if [[ $vuln -eq 0 ]]; then
  echo "PATCHED: Tomcat $VER is at or above fixed release"
  exit 0
fi

if [[ $rv -eq 1 && $rx -eq 1 ]]; then
  echo "VULNERABLE: Tomcat $VER, RewriteValve enabled, mixed [OR]+AND RewriteCond present"
  exit 1
elif [[ $rv -eq 1 ]]; then
  echo "VULNERABLE (low impact): Tomcat $VER with RewriteValve enabled; no mixed-OR ruleset found, but patch recommended"
  exit 1
else
  echo "PATCHED (effective): Tomcat $VER vulnerable build, but RewriteValve not enabled — defect unreachable"
  exit 0
fi

Sources

1. Apache Tomcat 11 security advisories
2. Apache Tomcat 9 security advisories
3. Apache Tomcat 10 security advisories
4. Tomcat 9 RewriteValve documentation
5. Tomcat 11 RewriteValve documentation
6. RewriteValve API (Tomcat 11)
7. OpenCVE — Apache Tomcat CVE index
8. CWE-670: Always-Incorrect Control Flow Implementation