Tomcat (Apache) - vulnerabilities (CVEs)

274 CVEs, 0 in the last 30 days, 830 known versions, newest CVE from 2026-08-25. Vendor: Apache.

CVEs of Tomcat

CVE-2026-73180 - CVSS 6.8 (medium), 2026-08-25: Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket…
CVE-2026-68763 - CVSS 7.5 (high), 2026-08-25: Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue…
CVE-2026-68569 - CVSS 8.1 (high), 2026-08-25: Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if…
CVE-2026-68525 - CVSS 9.1 (critical), 2026-08-25: Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access…
CVE-2026-66422 - CVSS 8.1 (high), 2026-08-25: Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in…
CVE-2026-65927 - CVSS 7.5 (high), 2026-08-25: Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather…
CVE-2026-65905 - CVSS 9.8 (critical), 2026-08-25: Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a…
CVE-2026-65637 - CVSS 9.8 (critical), 2026-08-25: Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through…
CVE-2026-65183 - CVSS 8.1 (high), 2026-08-25: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access…
CVE-2026-65182 - CVSS 9.1 (critical), 2026-08-25: Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is…
CVE-2026-66299 - CVSS 7.5 (high), 2026-07-28: Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24,…
CVE-2026-59084 - CVSS 9.1 (critical), 2026-07-14: Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly…
CVE-2026-59083 - CVSS 9.1 (critical), 2026-07-14: Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.…
CVE-2026-55957 - CVSS 7.3 (high), 2026-06-29: Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers…
CVE-2026-55956 - CVSS 6.5 (medium), 2026-06-29: Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission…
CVE-2026-55955 - CVSS 6.5 (medium), 2026-06-29: Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects…
CVE-2026-55276 - CVSS 9.1 (critical), 2026-06-29: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included…
CVE-2026-53434 - CVSS 9.1 (critical), 2026-06-29: Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat:…
CVE-2026-53404 - CVSS 7.3 (high), 2026-06-29: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched,…
CVE-2026-50229 - CVSS 6.1 (medium), 2026-06-29: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects…
CVE-2026-43514 - CVSS 3.7 (low), 2026-05-12: Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from…
CVE-2026-43513 - CVSS 7.5 (high), 2026-05-12: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from…
CVE-2026-43515 - CVSS 9.1 (critical), 2026-05-12: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache…
CVE-2026-42498 - CVSS 7.3 (high), 2026-05-12: Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat:…
CVE-2026-41293 - CVSS 9.8 (critical), 2026-05-12: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54,…
CVE-2026-43512 - CVSS 9.8 (critical), 2026-05-12: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through…
CVE-2026-41284 - CVSS 7.5 (high), 2026-05-12: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from…
CVE-2026-34500 - CVSS 6.5 (medium), 2026-04-09: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache…
CVE-2026-34487 - CVSS 7.5 (high), 2026-04-09: Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer…
CVE-2026-34486 - CVSS 7.5 (high), 2026-04-09: Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This…
CVE-2026-34483 - CVSS 7.5 (high), 2026-04-09: Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1…
CVE-2026-29129 - CVSS 7.5 (high), 2026-04-09: Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51…
CVE-2026-32990 - CVSS 5.3 (medium), 2026-04-09: Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through…
CVE-2026-25854 - CVSS 6.1 (medium), 2026-04-09: Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache…
CVE-2026-29146 - CVSS 7.5 (high), 2026-04-09: Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through…
CVE-2026-24880 - CVSS 7.5 (high), 2026-04-09: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue…
CVE-2026-29145 - CVSS 9.1 (critical), 2026-04-09: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This…
CVE-2026-24734 - CVSS 7.5 (high), 2026-02-17: Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the…
CVE-2026-24733 - CVSS 6.5 (medium), 2026-02-17: Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to…
CVE-2025-66614 - CVSS 9.1 (critical), 2026-02-17: Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1…
CVE-2025-61795 - CVSS 5.3 (medium), 2025-10-27: Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart…
CVE-2025-55754 - CVSS 9.6 (critical), 2025-10-27: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If…
CVE-2025-55752 - CVSS 7.5 (high), 2025-10-27: Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was…
CVE-2025-55668 - CVSS 6.5 (medium), 2025-08-13: Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through…
CVE-2025-48989 - CVSS 7.5 (high), 2025-08-13: Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat:…
CVE-2025-53506 - CVSS 7.5 (high), 2025-07-10: Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum…
CVE-2025-52520 - CVSS 7.5 (high), 2025-07-10: For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.…
CVE-2025-52434 - CVSS 7.5 (high), 2025-07-10: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native…
CVE-2025-48988 - CVSS 7.5 (high), 2025-06-16: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from…
CVE-2025-49125 - CVSS 7.5 (high), 2025-06-16: Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the…
CVE-2025-49124 - CVSS 8.4 (high), 2025-06-16: Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without…
CVE-2025-46701 - CVSS 7.3 (high), 2025-05-29: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the…
CVE-2025-31650 - CVSS 7.5 (high), 2025-04-28: Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of…
CVE-2025-31651 - CVSS 9.8 (critical), 2025-04-28: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was…
CVE-2025-24813 - CVSS 10 (critical), 2025-03-10: Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files…
CVE-2024-56337 - CVSS 9.8 (critical), 2024-12-20: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from…
CVE-2024-54677 - CVSS 5.3 (medium), 2024-12-17: Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects…
CVE-2024-50379 - CVSS 9.8 (critical), 2024-12-17: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when…
CVE-2024-52318 - CVSS 6.1 (medium), 2024-11-18: Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to…
CVE-2024-52317 - CVSS 6.5 (medium), 2024-11-18: Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to…
CVE-2024-52316 - CVSS 9.8 (critical), 2024-11-18: Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext…
CVE-2024-38286 - CVSS 8.6 (high), 2024-11-07: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from…
CVE-2024-34750 - CVSS 7.5 (high), 2024-07-03: Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did…
CVE-2024-24549 - CVSS 7.5 (high), 2024-03-13: Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request…
CVE-2024-23672 - CVSS 6.3 (medium), 2024-03-13: Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to…
CVE-2024-21733 - CVSS 5.3 (medium), 2024-01-19: Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from…
CVE-2023-46589 - CVSS 7.5 (high), 2023-11-28: Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through…
CVE-2023-45648 - CVSS 5.3 (medium), 2023-10-10: Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through…
CVE-2023-42794 - CVSS 5.9 (medium), 2023-10-10: Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85…
CVE-2023-42795 - CVSS 5.3 (medium), 2023-10-10: Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1…
CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
CVE-2023-41080 - CVSS 6.1 (medium), 2023-08-25: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from…
CVE-2023-34981 - CVSS 7.5 (high), 2023-06-21: A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP…
CVE-2023-28709 - CVSS 7.5 (high), 2023-05-22: The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default…
CVE-2023-28708 - CVSS 4.3 (medium), 2023-03-22: When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies…
CVE-2022-45143 - CVSS 7.5 (high), 2023-01-03: The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some…
CVE-2022-42252 - CVSS 7.5 (high), 2022-11-01: If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting…
CVE-2021-43980 - CVSS 3.7 (low), 2022-09-28: The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but…
CVE-2022-34305 - CVSS 6.1 (medium), 2022-06-23: In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web…
CVE-2022-25762 - CVSS 8.6 (high), 2022-05-13: If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache…
CVE-2022-29885 - CVSS 7.5 (high), 2022-05-12: The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly…
CVE-2022-23181 - CVSS 7 (high), 2022-01-27: The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to…
CVE-2021-42340 - CVSS 7.5 (high), 2021-10-14: The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak.…
CVE-2021-41079 - CVSS 7.5 (high), 2021-09-16: Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use…
CVE-2021-30640 - CVSS 6.5 (medium), 2021-07-12: A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the…
CVE-2021-30639 - CVSS 7.5 (high), 2021-07-12: A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling…
CVE-2021-33037 - CVSS 5.3 (medium), 2021-07-12: Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some…
CVE-2021-25329 - CVSS 7 (high), 2021-03-01: The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a…
CVE-2021-25122 - CVSS 7.5 (high), 2021-03-01: When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request…
CVE-2021-24122 - CVSS 5.9 (medium), 2021-01-14: When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59…
CVE-2020-17527 - CVSS 7.5 (high), 2020-12-03: While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request…
CVE-2020-13943 - CVSS 4.3 (medium), 2020-10-12: If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent…
CVE-2020-13935 - CVSS 7.5 (high), 2020-07-14: The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to…
CVE-2020-13934 - CVSS 7.5 (high), 2020-07-14: An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the…
CVE-2020-8022 - CVSS 7.8 (high), 2020-06-29: A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux…
CVE-2020-11996 - CVSS 7.5 (high), 2020-06-26: A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU…
CVE-2020-9484 - CVSS 7 (high), 2020-05-20: When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the…
CVE-2020-1938 - CVSS 9.8 (critical), 2020-02-24: When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having…
CVE-2020-1935 - CVSS 4.8 (medium), 2020-02-24: In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed…
CVE-2019-17569 - CVSS 4.8 (medium), 2020-02-24: The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was…