AW: [EXTERNAL] Re: Why tomcat "Incorrect URL decoding in RewriteValve may allow security control bypass" is rated 'Low' on tomcat page but 'Critical' on NIST ?

"LAURIA Giuseppe via users" <[email protected]> Tue, 21 Jul 2026 16:51:48 +0000
Newsgroups gmane.comp.jakarta.tomcat.user
Message-ID <DU7PR04MB110892EA6154027C448A670AD83C22@DU7PR04MB11089.eurprd04.prod.outlook.com>
VGhhbmsgeW91IHZlcnkgbXVjaCBUaW0gIQ0KDQpVbmZvcnR1bmF0ZWx5LCB0aGlzIGlzIHdoeSBv
dXIgVG9tY2F0IG5vdyBlbmRzIHVwIG9uIGEgc2VjdXJpdHkgbGlzdCBhbmQgYmVjYXVzZSBpdCBp
cyBjbGFzc2lmaWVkIGFzIENyaXRpY2FsLCBpdCBzaG91bGQgYmUgc29sdmVkIHdpdGhpbiBhIHZl
cnkgc2hvcnQgdGltZSBldmVuIHRob3VnaCB3ZSBhcmUgbm90IHVzaW5nIGl0Lg0KQW5kIEkgYXNz
dW1lIHRoYXQgdGhpcyB3aWxsIG5vdCBnZXQgYW55IGJldHRlciBpbiB0aGUgZnV0dXJlLCBidXQg
dGhhdCBzdWNoIGNhc2VzIGFyZSBzdGlsbCBvZnRlbiBkaXNjb3ZlcmVkIHdoaWNoIGRvIG5vdCBj
b25jZXJuIHVzLg0KDQpDb3VsZG7igJl0IHRoZXJlIGJlIHNvbWV0aGluZyBiZXR0ZXIgZnJvbSB0
aGUgVG9tY2F0IGNvcm5lcj8NCg0KQmVzdCByZWdhcmRzLg0KR2l1c2VwcGUNCg0KDQotLS0tLVVy
c3Byw7xuZ2xpY2hlIE5hY2hyaWNodC0tLS0tDQpWb246IFRpbSBGdW5rIDxmdW5rbWFuQGFwYWNo
ZS5vcmc+IA0KR2VzZW5kZXQ6IERpZW5zdGFnLCAyMS4gSnVsaSAyMDI2IDE4OjQzDQpBbjogVG9t
Y2F0IFVzZXJzIExpc3QgPHVzZXJzQHRvbWNhdC5hcGFjaGUub3JnPg0KQmV0cmVmZjogW0VYVEVS
TkFMXSBSZTogV2h5IHRvbWNhdCAiSW5jb3JyZWN0IFVSTCBkZWNvZGluZyBpbiBSZXdyaXRlVmFs
dmUgbWF5IGFsbG93IHNlY3VyaXR5IGNvbnRyb2wgYnlwYXNzIiBpcyByYXRlZCAnTG93JyBvbiB0
b21jYXQgcGFnZSBidXQgJ0NyaXRpY2FsJyBvbiBOSVNUID8NCg0KVGhlIE5JU1Qgc2NvcmUgaXMg
YmFzZWQgb24gYSBmb3JtdWxhIGJhc2VkIG9uIHZhcmlvdXMgZmFjdG9ycy4gV2hpY2ggaXMgaGVh
dmlseSB3ZWlnaHRlZCB0byBiZSAnaGlnaCIgaW4gYnVncyBsaWtlIHRoaXMuDQoNCkhlcmUgaXRz
IHJhdGVkIExPVyBiZWNhdXNlDQotIFRoZSBWYWx2ZSBuZWVkcyBlbmFibGVkIChieSBkZWZhdWx0
IG5vdCkNCi0gQW5kIHVzZWQgLyBjb25maWd1cmVkDQotIEFuZCAgY29uZmlndXJlZCBpbiBhIHdh
eSB0aGF0IGFsbG93cyBleHBsb2l0DQotIEFuZCB1c2VkIGluIGFuIGFwcCB0aGF0IGhhcyBpbiBp
dHMgYXBwbGljYXRpb24gcGxhbmUgc2VjdXJpdHkgY29udHJvbHMgdGhhdCBjb3VsZCBiZSBieXBh
c3NlZA0KDQpBS0EgLi4uIEEgbm90IG5vcm1hbCBjb21iaW5hdGlvbiBvZiBmYWN0b3JzLg0KDQot
VGltDQoNCk9uIFR1ZSwgSnVsIDIxLCAyMDI2IGF0IDEyOjE44oCvUE0gTEFVUklBIEdpdXNlcHBl
IHZpYSB1c2VycyA8IHVzZXJzQHRvbWNhdC5hcGFjaGUub3JnPiB3cm90ZToNCg0KPiBIaSBUb21j
YXQgdXNlcnMuDQo+DQo+DQo+DQo+IFdlIGFyZSB1c2luZyBUb21jYXQgdjkuMC4xMTkgYW5kIGFy
ZSBub3cgZm9yY2VkIHRvIGltbWVkaWF0ZWx5IHVzZQ0KPiB2OS4wLjEyMCBiZWNhdXNlIHRoZSDi
gJwqSW5jb3JyZWN0IFVSTCBkZWNvZGluZyBpbiBSZXdyaXRlVmFsdmUgbWF5IA0KPiBhbGxvdyBz
ZWN1cml0eSBjb250cm9sIGJ5cGFzc+KAnSAqdnVsbmVyYWJpbGl0eSBpbiBUb21jYXQgaXMgcmF0
ZWQgOS4xIA0KPiBvbiBOSVNUIHdoaWNoIGlzIENSSVRJQ0FMLiAtPiANCj4gaHR0cHM6Ly91cmxk
ZWZlbnNlLmNvbS92My9fX2h0dHBzOi8vbnZkLm5pc3QuZ292L3Z1bG4vZGV0YWlsL0NWRS0yMDI2
LQ0KPiA1OTA4M19fOyEhQm5rVjlwZGg1VjAhQkNvNURLQ083WV9vemhkcUwtR29QQ3luN0xnVjlG
cWxxdUtfWEdaX2Jjak1GaE9MDQo+IGNOM0dBR012cEFwLUtFWmEwNGhOZE9RUkNRMlVwU3p2MW9t
MCQNCj4NCj4NCj4NCj4gQnV0IG9uIHRoZSBUb21jYXQgc2VjdXJpdHkgcGFnZSB0aGlzIHZ1bG5l
cmFiaWxpdHkgaXMgcmF0ZWQg4oCYTE9X4oCZLg0KPg0KPiBodHRwczovL3VybGRlZmVuc2UuY29t
L3YzL19faHR0cHM6Ly90b21jYXQuYXBhY2hlLm9yZy9zZWN1cml0eS05Lmh0bWxfDQo+IF87ISFC
bmtWOXBkaDVWMCFCQ281REtDTzdZX296aGRxTC1Hb1BDeW43TGdWOUZxbHF1S19YR1pfYmNqTUZo
T0xjTjNHQUcNCj4gTXZwQXAtS0VaYTA0aE5kT1FSQ1EyVXBjbkdTUXc2JA0KPg0KPg0KPiBXaG8g
aXMgd3JvbmcgPw0KPg0KPg0KPg0KPg0KPg0KPiBXZSBhcmUgbm90IHVzaW5nIOKAnHJld3JpdGUg
VmFsdmXigJ0gYW5kIHRoZXJlZm9yZSB0aGluayB3ZSBhcmUgbm90IGFmZmVjdGVkLg0KPg0KPiBX
aHkgdGhlcmUgaXMgbm8gZGV0YWlsZWQgZXhwbGFuYXRpb24gb24gdGhlIE5JU1QgcGFnZSB0aGF0
IG9ubHkgVG9tY2F0IA0KPiB1c2VycyAqdXNpbmcgcmV3cml0ZSBWYWx2ZSogYXJlIGFmZmVjdGVk
ID8NCj4NCj4NCj4N
DQotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0NClRvIHVuc3Vic2NyaWJlLCBlLW1haWw6IHVzZXJzLXVuc3Vi
c2NyaWJlQHRvbWNhdC5hcGFjaGUub3JnDQpGb3IgYWRkaXRpb25hbCBjb21tYW5kcywgZS1t
YWlsOiB1c2Vycy1oZWxwQHRvbWNhdC5hcGFjaGUub3JnDQoN