CVE-2018-11759: Apache Tomcat JK Connector path normalization flaw allows proxy bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 7.5 with network reachability, no authentication and high confidentiality impact, plus a very high EPSS score, though no confirmed in-the-wild exploitation is documented.

What it is

The Apache httpd-specific path normalization code in Apache Tomcat JK (mod_jk) Connector 1.2.0 through 1.2.44 mishandled certain edge cases before matching requests to the URI-worker map. A crafted request can reach application functionality that was not meant to be exposed through the reverse proxy, and in some configurations can bypass httpd access controls.

Impact

An unauthenticated remote attacker can access proxied application endpoints or functionality that the reverse proxy was configured to hide, and may bypass httpd-enforced access controls. The CVSS vector indicates high confidentiality impact only, with no integrity or availability impact.

Attack surface

Reachable over the network via HTTP requests to the httpd reverse proxy fronting Tomcat through mod_jk. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS is very high (0.90647 probability, 99.797th percentile), but the references are advisories and vendor errata only, with no public exploit or PoC tags.

What to do

• Upgrade mod_jk Connector to a version later than 1.2.44, or apply the vendor-supplied fix for your distribution.
• Apply the referenced Red Hat, Debian and Oracle errata if you use those packaged builds.
• Review httpd access control rules and URI-worker mappings to confirm no sensitive application paths are exposed through the proxy.
• Where patching is delayed, restrict network access to the httpd reverse proxy and add request filtering for suspicious path encodings.

Detection

• Inspect httpd and mod_jk access logs for requests containing unusual path encodings, dot-segments or repeated slashes that do not match normal application traffic.
• Alert on requests reaching backend Tomcat URIs that are not present in the intended public URI-worker map.
• Correlate httpd access logs with Tomcat access logs to find proxied requests for paths that should have been blocked by httpd access controls.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.