CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-74049: Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE)

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 10812

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-74049: Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE)

CVE-2026-74049 is an Execution After Redirect (EAR) vulnerability in Apache Tomcat's Jasper JSTL plug-in that omits page abort functionality. The issue affects Tomcat versions 7.0.0 through 11.0.26 across multiple release lines and is rated low severity.

Why it matters: Organizations running Tomcat 7.x, 8.5.x, 9.0.x, 10.1.x, or 11.0.x should evaluate whether this EAR flaw creates risk in their JSP implementations and apply patches when available.

CVEsCVE-2026-74049
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary