CVE-2011-1582: Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constra...

Security readout for executives and security teams

Apache Tomcat 7.0.12 and 7.0.13 could ignore annotation-based access controls on the first request to a servlet. For affected applications, a remote user might reach content or functions that were intended to require authorization. Exposure is most likely in legacy Apache Tomcat 7.0.12 or 7.0.13 deployments using annotation-defined servlet security constraints. The provided data does not establish impact for other Tomcat branches or configurations. Treat confirmed exposure as urgent because the issue can bypass access controls. The business priority depends on whether legacy Tomcat 7.0.12 or 7.0.13 is still deployed and protecting sensitive functions. Mitigation focus: Inventory Tomcat 7.0.12 and 7.0.13 instances, including embedded or bundled deployments.; Upgrade affected systems to Apache Tomcat 7.0.14 or later.; Review vendor or distribution guidance before applying package-specific fixes..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.