CVE-2011-2526: Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for t...

Security readout for executives and security teams

This Tomcat issue affects older 5.5, 6, and 7 releases when sendfile is enabled on APR or NIO HTTP connectors. An untrusted local web application could misuse internal request attributes to bypass file restrictions or destabilize the server. The business risk is mainly legacy app-server exposure, data exposure, and service disruption. Exposure is most likely in legacy Tomcat deployments using affected 5.5.x, 6.x, or 7.x versions with sendfile enabled on APR or NIO HTTP connectors, especially shared hosting or multi-application servers where untrusted web applications run in the same Tomcat instance. Treat this as a legacy-risk cleanup item with moderate urgency. It is not supported here as actively exploited, but affected Tomcat versions are very old and can create avoidable data-access and availability risk where shared or untrusted applications exist. Mitigation focus: Upgrade Tomcat to 5.5.34, 6.0.33, 7.0.19, or later supported releases.; Review Apache and operating-system vendor advisories for package-specific fixes.; Disable sendfile on affected APR or NIO HTTP connectors if upgrade timing requires compensating controls..

Prepared

Jun 27, 2026, 18:09 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.