CVE-2018-1304: The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled i...

Security readout for executives and security teams

Apache Tomcat could ignore a protection rule for the application root when the rule used the empty-string URL pattern. In affected versions, unauthorized users might reach web application resources intended to be protected. Exposure depends on applications using that specific security-constraint pattern. Organizations are most exposed if they run the listed Tomcat versions and deploy applications with web security constraints for the context root using the empty-string URL pattern. Tomcat deployments without that specific constraint pattern are not indicated as affected by the provided description. Treat as a targeted configuration-dependent access-control issue. Prioritize systems hosting sensitive applications on affected Tomcat versions, especially externally reachable services. Urgency is lower than a broadly exploitable remote-code issue, but protected content exposure can still carry business impact. Mitigation focus: Inventory Apache Tomcat versions across internet-facing and internal applications.; Prioritize upgrades or vendor package updates for versions in the affected ranges.; Review vendor advisories from Apache, Red Hat, Debian, Ubuntu, Oracle, and NetApp as applicable..

Prepared

Jun 7, 2026, 14:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.