CVE-2026-74049
Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE)
CVE-2026-74049: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE). Not in the CISA KEV catalog. Low advisory severity (CVSS 3.7, Red Hat).
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-74049 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Low
- CVSS base score
- 3.7 (Red Hat)
- Weakness
- CWE-698
- Fixed releases
- Apache: 11.0.27, 10.1.61, 9.0.123
- Red Hat: tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1, RHSA-2026:85926
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-74049; bulletin-wide values are not repeated here.
Is CVE-2026-74049 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-74049 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-74049?
Upgrade to a fixed release named by the vendor:
- Apache: 11.0.27, 10.1.61, 9.0.123
- Red Hat: tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1, RHSA-2026:85926
- Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue. (Apache)
Vendor advisory comparison
Apache
1 advisory- Advisory severityUnrated
Advisory [CVE-2026-74049] Execution After Redirect (EAR) vulnerability in Apache Tomcat
CVE-2026-74049Source published Source updated
Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
- Affected products in this advisory
- Apache Tomcat
- Source-reported affected versions
- 11.0.0-M1 through 11.0.26
- 10.1.0-M1 through 10.1.60
- 9.0.0.M1 through 9.0.122.
- 8.5.0 through 8.5.100
3 more entries in the full advisory.
- Source-reported fixed versions
- 11.0.27
- 10.1.61
- 9.0.123
- Mitigation guidance
- Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.
Red Hat
1 advisory- Advisory severityLow3.7
Low [CVE-2026-74049] Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
CVE-2026-74049Source published Source updated
Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE). Red Hat rates this low (CVSS 3.7). Weakness: CWE-698. Red Hat lists fixing advisory RHSA-2026:85926 with package tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
- Related products — impact not confirmed
- Red Hat Hardened Images
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- tomcat10-main-10.1.61-0.1.hum1
- tomcat11-main-11.0.27-0.1.hum1
- RHSA-2026:85926
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.