CVE-2026-24733

What is CVE-2026-24733? Apache Tomcat incorrectly handled an HTTP/0.9-style HEAD request under certain security-constraint configurations.

CVE-2026-24733 Defensive Verifier

A lightweight, dependency-free Python security verifier for CVE-2026-24733, an Apache Tomcat HTTP/0.9 HEAD security-constraint bypass.

The project is designed for:

• Blue teams
• SOC analysts
• Vulnerability-management teams
• Penetration testers with authorization
• Security researchers
• CI/CD security checks
• Internal asset validation

Authorized testing only. Only scan systems that you own or have explicit permission to test.

What is CVE-2026-24733?

Apache Tomcat incorrectly handled an HTTP/0.9-style HEAD request under certain security-constraint configurations.

The relevant condition is a configuration where:

• GET access to a resource is restricted
• HEAD is permitted
• the server receives an HTTP/0.9-style HEAD request

Under the affected Tomcat versions, this could result in a security-constraint bypass.

This is primarily a configuration-dependent behavioral vulnerability. Therefore, detecting an affected Tomcat version alone should not automatically be treated as proof of exploitation.

Fixed versions

According to the Apache Tomcat security advisories:

Affected versions are the corresponding earlier versions in those supported branches.

Always consult the official Apache advisory before making remediation decisions.

Requirements

Python 3.9+.

No third-party Python packages are required.

The verifier uses only Python's standard library.

Usage

Basic HTTP:

python3 cve_2026_24733.py \
    http://127.0.0.1:8080/protected

HTTPS:

python3 cve_2026_24733.py \
    https://127.0.0.1:8443/protected

For an authorized lab using a self-signed certificate:

python3 cve_2026_24733.py \
    --insecure \
    https://127.0.0.1:8443/protected

JSON output For automation and SIEM/CI pipelines:

python3 cve_2026_24733.py \
    --json \
    https://127.0.0.1:8443/protected

Example:

{
  "cve": "CVE-2026-24733",
  "verdict": "INCONCLUSIVE",
  "confidence": "medium",
  "version": "10.1.49",
  "version_assessment": "affected-range"
}

Exit codes Code Meaning 0 Not vulnerable / vulnerability not confirmed 1 Potentially vulnerable 2 Inconclusive or scanner error

This makes the tool suitable for CI/CD:

python3 cve_2026_24733.py \
    --json \
    https://target.example/protected

if [ $? -eq 1 ]; then
    echo "Potential CVE-2026-24733 exposure"
    exit 1
fi

Detection methodology The verifier performs two limited requests against the explicit path provided by the operator:

1. Normal HTTP/1.1 GET A conventional request is sent to establish the normal access behavior.

2. HTTP/0.9-style HEAD The verifier sends an intentionally HTTP/0.9-style request:

HEAD /protected

The request intentionally does not contain an HTTP version or HTTP/1.x headers.

The two observations are compared.

A particularly interesting result is:

GET /protected -> 401/403 HTTP/0.9 HEAD -> response received

When combined with an affected Tomcat version, this is reported as:

POTENTIALLY VULNERABLE

The tool deliberately uses the word potentially because network components, reverse proxies, application routing, and endpoint-specific security policies can affect the observation.

False positives This verifier is intentionally conservative.

A POTENTIALLY_VULNERABLE result should be investigated rather than blindly treated as confirmed exploitation.

Possible causes include:

Reverse proxies

WAF behavior

Load balancers

Different backend nodes

Custom servlet filters

Application-level authorization

Endpoint-specific configuration

Non-Tomcat HTTP servers in front of Tomcat

For high-confidence remediation, inspect the Tomcat version and the corresponding security constraints.

Safety design The verifier intentionally does not:

crawl the target

enumerate directories

brute-force URLs

bypass authentication

extract protected application data

execute commands

upload files

modify server state

attempt privilege escalation

chain the issue into another vulnerability

The operator explicitly supplies the endpoint being tested.

Response collection is capped to prevent unnecessarily downloading large responses.

Recommended defensive workflow If the tool reports:

POTENTIALLY VULNERABLE

Identify the actual Tomcat backend version.

Verify whether the endpoint uses a GET-restricted / HEAD-allowed security constraint.

Check reverse-proxy/WAF routing.

Upgrade Tomcat to the appropriate fixed release.

Retest the same endpoint.

Review logs for unexpected HTTP/0.9 traffic.

If necessary, temporarily block malformed HTTP/0.9 requests at the reverse proxy while remediation is performed.

Responsible disclosure If testing identifies a previously unknown security issue:

Do not publicly disclose sensitive target information.

Preserve relevant evidence.

Notify the affected organization.

Follow the vendor's security-reporting process.

Coordinate disclosure timelines responsibly.

References Apache Tomcat Security Advisories:

https://tomcat.apache.org/security-9

https://tomcat.apache.org/security-10

https://tomcat.apache.org/security-11

CVE:

https://www.cve.org/CVERecord?id=CVE-2026-24733

NVD:

https://nvd.nist.gov/vuln/detail/CVE-2026-24733

License MIT License.

Use responsibly and only against systems for which you have authorization.