A high-severity off-by-one error in Apache Tomcat rewrite valve processing allows unauthenticated remote attackers to trigger a denial of service condition.

This is an off-by-one error (CWE-193) located in the rewrite valve logic. The vulnerability is exploitable by unauthenticated remote attackers who can manipulate request processing to cause an infinite loop or incorrect rule execution, resulting in service disruption.

Successful exploitation results in a denial of service, which can significantly impact business continuity by rendering web applications unavailable to users. With a CVSS score of 7.5, this high-severity flaw poses a direct risk to system availability, particularly for environments relying on Tomcat for critical service delivery.

Immediate Action: Upgrade to Apache Tomcat version 11.0.25, 10.1.58, or 9.0.121 to apply the necessary fix for the rewrite valve processing logic.

Proactive Monitoring: Monitor server resource utilization and access logs for signs of repeated, abnormal rewrite rule processing patterns or unexpected service crashes.

Compensating Controls: If immediate patching is not feasible, consider disabling the affected rewrite valve configurations or implementing WAF rules to restrict requests that trigger complex rewrite sequences.

Public Exploit Available: No

This vulnerability represents a significant risk to application availability due to the potential for service disruption. Administrators should prioritize the deployment of the vendor-provided updates (11.0.25, 10.1.58, or 9.0.121) to eliminate the underlying logic error and prevent potential denial of service attacks.