AW: [EXTERNAL] Re: Why tomcat "Incorrect URL decoding in RewriteValve may allow security control bypass" is rated 'Low' on tomcat page but 'Critical' on NIST ?
"LAURIA Giuseppe via users" <[email protected]> Tue, 21 Jul 2026 16:51:48 +0000
| Newsgroups | gmane.comp.jakarta.tomcat.user |
|---|---|
| Message-ID | <DU7PR04MB110892EA6154027C448A670AD83C22@DU7PR04MB11089.eurprd04.prod.outlook.com> |
VGhhbmsgeW91IHZlcnkgbXVjaCBUaW0gIQ0KDQpVbmZvcnR1bmF0ZWx5LCB0aGlzIGlzIHdoeSBv dXIgVG9tY2F0IG5vdyBlbmRzIHVwIG9uIGEgc2VjdXJpdHkgbGlzdCBhbmQgYmVjYXVzZSBpdCBp cyBjbGFzc2lmaWVkIGFzIENyaXRpY2FsLCBpdCBzaG91bGQgYmUgc29sdmVkIHdpdGhpbiBhIHZl cnkgc2hvcnQgdGltZSBldmVuIHRob3VnaCB3ZSBhcmUgbm90IHVzaW5nIGl0Lg0KQW5kIEkgYXNz dW1lIHRoYXQgdGhpcyB3aWxsIG5vdCBnZXQgYW55IGJldHRlciBpbiB0aGUgZnV0dXJlLCBidXQg dGhhdCBzdWNoIGNhc2VzIGFyZSBzdGlsbCBvZnRlbiBkaXNjb3ZlcmVkIHdoaWNoIGRvIG5vdCBj b25jZXJuIHVzLg0KDQpDb3VsZG7igJl0IHRoZXJlIGJlIHNvbWV0aGluZyBiZXR0ZXIgZnJvbSB0 aGUgVG9tY2F0IGNvcm5lcj8NCg0KQmVzdCByZWdhcmRzLg0KR2l1c2VwcGUNCg0KDQotLS0tLVVy c3Byw7xuZ2xpY2hlIE5hY2hyaWNodC0tLS0tDQpWb246IFRpbSBGdW5rIDxmdW5rbWFuQGFwYWNo ZS5vcmc+IA0KR2VzZW5kZXQ6IERpZW5zdGFnLCAyMS4gSnVsaSAyMDI2IDE4OjQzDQpBbjogVG9t Y2F0IFVzZXJzIExpc3QgPHVzZXJzQHRvbWNhdC5hcGFjaGUub3JnPg0KQmV0cmVmZjogW0VYVEVS TkFMXSBSZTogV2h5IHRvbWNhdCAiSW5jb3JyZWN0IFVSTCBkZWNvZGluZyBpbiBSZXdyaXRlVmFs dmUgbWF5IGFsbG93IHNlY3VyaXR5IGNvbnRyb2wgYnlwYXNzIiBpcyByYXRlZCAnTG93JyBvbiB0 b21jYXQgcGFnZSBidXQgJ0NyaXRpY2FsJyBvbiBOSVNUID8NCg0KVGhlIE5JU1Qgc2NvcmUgaXMg YmFzZWQgb24gYSBmb3JtdWxhIGJhc2VkIG9uIHZhcmlvdXMgZmFjdG9ycy4gV2hpY2ggaXMgaGVh dmlseSB3ZWlnaHRlZCB0byBiZSAnaGlnaCIgaW4gYnVncyBsaWtlIHRoaXMuDQoNCkhlcmUgaXRz IHJhdGVkIExPVyBiZWNhdXNlDQotIFRoZSBWYWx2ZSBuZWVkcyBlbmFibGVkIChieSBkZWZhdWx0 IG5vdCkNCi0gQW5kIHVzZWQgLyBjb25maWd1cmVkDQotIEFuZCAgY29uZmlndXJlZCBpbiBhIHdh eSB0aGF0IGFsbG93cyBleHBsb2l0DQotIEFuZCB1c2VkIGluIGFuIGFwcCB0aGF0IGhhcyBpbiBp dHMgYXBwbGljYXRpb24gcGxhbmUgc2VjdXJpdHkgY29udHJvbHMgdGhhdCBjb3VsZCBiZSBieXBh c3NlZA0KDQpBS0EgLi4uIEEgbm90IG5vcm1hbCBjb21iaW5hdGlvbiBvZiBmYWN0b3JzLg0KDQot VGltDQoNCk9uIFR1ZSwgSnVsIDIxLCAyMDI2IGF0IDEyOjE44oCvUE0gTEFVUklBIEdpdXNlcHBl IHZpYSB1c2VycyA8IHVzZXJzQHRvbWNhdC5hcGFjaGUub3JnPiB3cm90ZToNCg0KPiBIaSBUb21j YXQgdXNlcnMuDQo+DQo+DQo+DQo+IFdlIGFyZSB1c2luZyBUb21jYXQgdjkuMC4xMTkgYW5kIGFy ZSBub3cgZm9yY2VkIHRvIGltbWVkaWF0ZWx5IHVzZQ0KPiB2OS4wLjEyMCBiZWNhdXNlIHRoZSDi gJwqSW5jb3JyZWN0IFVSTCBkZWNvZGluZyBpbiBSZXdyaXRlVmFsdmUgbWF5IA0KPiBhbGxvdyBz ZWN1cml0eSBjb250cm9sIGJ5cGFzc+KAnSAqdnVsbmVyYWJpbGl0eSBpbiBUb21jYXQgaXMgcmF0 ZWQgOS4xIA0KPiBvbiBOSVNUIHdoaWNoIGlzIENSSVRJQ0FMLiAtPiANCj4gaHR0cHM6Ly91cmxk ZWZlbnNlLmNvbS92My9fX2h0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDI2 LQ0KPiA1OTA4M19fOyEhQm5rVjlwZGg1VjAhQkNvNURLQ083WV9vemhkcUwtR29QQ3luN0xnVjlG cWxxdUtfWEdaX2Jjak1GaE9MDQo+IGNOM0dBR012cEFwLUtFWmEwNGhOZE9RUkNRMlVwU3p2MW9t MCQNCj4NCj4NCj4NCj4gQnV0IG9uIHRoZSBUb21jYXQgc2VjdXJpdHkgcGFnZSB0aGlzIHZ1bG5l cmFiaWxpdHkgaXMgcmF0ZWQg4oCYTE9X4oCZLg0KPg0KPiBodHRwczovL3VybGRlZmVuc2UuY29t L3YzL19faHR0cHM6Ly90b21jYXQuYXBhY2hlLm9yZy9zZWN1cml0eS05Lmh0bWxfDQo+IF87ISFC bmtWOXBkaDVWMCFCQ281REtDTzdZX296aGRxTC1Hb1BDeW43TGdWOUZxbHF1S19YR1pfYmNqTUZo T0xjTjNHQUcNCj4gTXZwQXAtS0VaYTA0aE5kT1FSQ1EyVXBjbkdTUXc2JA0KPg0KPg0KPiBXaG8g aXMgd3JvbmcgPw0KPg0KPg0KPg0KPg0KPg0KPiBXZSBhcmUgbm90IHVzaW5nIOKAnHJld3JpdGUg VmFsdmXigJ0gYW5kIHRoZXJlZm9yZSB0aGluayB3ZSBhcmUgbm90IGFmZmVjdGVkLg0KPg0KPiBX aHkgdGhlcmUgaXMgbm8gZGV0YWlsZWQgZXhwbGFuYXRpb24gb24gdGhlIE5JU1QgcGFnZSB0aGF0 IG9ubHkgVG9tY2F0IA0KPiB1c2VycyAqdXNpbmcgcmV3cml0ZSBWYWx2ZSogYXJlIGFmZmVjdGVk ID8NCj4NCj4NCj4N DQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0NClRvIHVuc3Vic2NyaWJlLCBlLW1haWw6IHVzZXJzLXVuc3Vi c2NyaWJlQHRvbWNhdC5hcGFjaGUub3JnDQpGb3IgYWRkaXRpb25hbCBjb21tYW5kcywgZS1t YWlsOiB1c2Vycy1oZWxwQHRvbWNhdC5hcGFjaGUub3JnDQoN