Apache Tomcat (Apache Software Foundation) - vulnerabilities (CVEs)

141 CVEs, 8 in the last 30 days, 13 known versions, newest CVE from 2026-10-20. Vendor: Apache Software Foundation.

CVEs of Apache Tomcat

• CVE-2026-103119 - CVSS 9.1 (critical), 2026-10-20: Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current…
• CVE-2026-101356 - CVSS 9.1 (critical), 2026-10-20: Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response…
• CVE-2026-101296 - CVSS 9.1 (critical), 2026-10-20: A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication…
• CVE-2026-93446, 2026-10-20: Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21…
• CVE-2026-88041, 2026-10-20: Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects…
• CVE-2026-80353, 2026-10-20: Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an…
• CVE-2026-74049, 2026-10-20: Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through…
• CVE-2026-74048, 2026-10-20: Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation…
• CVE-2026-87022 - CVSS 7.5 (high), 2026-09-23: Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This…
• CVE-2026-86350 - CVSS 9.1 (critical), 2026-09-23: Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for…
• CVE-2026-86248 - CVSS 9.8 (critical), 2026-09-23: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache…
• CVE-2026-79677 - CVSS 7.5 (high), 2026-09-23: Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of…
• CVE-2026-78437 - CVSS 7.3 (high), 2026-09-23: Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.…
• CVE-2026-78383 - CVSS 7.5 (high), 2026-09-23: Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread…
• CVE-2026-77791 - CVSS 7.5 (high), 2026-09-23: Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache…
• CVE-2026-77762 - CVSS 8.1 (high), 2026-09-23: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject…
• CVE-2026-77756 - CVSS 3.7 (low), 2026-09-23: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding…
• CVE-2026-76183 - CVSS 9.8 (critical), 2026-09-23: Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue…
• CVE-2026-75973 - CVSS 7.3 (high), 2026-09-23: Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and…
• CVE-2026-73581 - CVSS 6.5 (medium), 2026-09-23: Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate…
• CVE-2026-73180 - CVSS 6.8 (medium), 2026-08-25: Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket…
• CVE-2026-68763 - CVSS 7.5 (high), 2026-08-25: Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue…
• CVE-2026-68569 - CVSS 8.1 (high), 2026-08-25: Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if…
• CVE-2026-68525 - CVSS 9.1 (critical), 2026-08-25: Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access…
• CVE-2026-66422 - CVSS 8.1 (high), 2026-08-25: Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in…
• CVE-2026-65927 - CVSS 7.5 (high), 2026-08-25: Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather…
• CVE-2026-65905 - CVSS 9.8 (critical), 2026-08-25: Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a…
• CVE-2026-65637 - CVSS 9.8 (critical), 2026-08-25: Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through…
• CVE-2026-65183 - CVSS 8.1 (high), 2026-08-25: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access…
• CVE-2026-65182 - CVSS 9.1 (critical), 2026-08-25: Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is…
• CVE-2026-66299 - CVSS 7.5 (high), 2026-07-28: Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24,…
• CVE-2026-59084 - CVSS 9.1 (critical), 2026-07-14: Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly…
• CVE-2026-59083 - CVSS 9.1 (critical), 2026-07-14: Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.…
• CVE-2026-55957 - CVSS 7.3 (high), 2026-06-29: Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers…
• CVE-2026-55956 - CVSS 6.5 (medium), 2026-06-29: Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission…
• CVE-2026-55955 - CVSS 6.5 (medium), 2026-06-29: Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects…
• CVE-2026-55276 - CVSS 9.1 (critical), 2026-06-29: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included…
• CVE-2026-53434 - CVSS 9.1 (critical), 2026-06-29: Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat:…
• CVE-2026-53404 - CVSS 7.3 (high), 2026-06-29: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched,…
• CVE-2026-50229 - CVSS 6.1 (medium), 2026-06-29: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects…
• CVE-2026-43514 - CVSS 3.7 (low), 2026-05-12: Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from…
• CVE-2026-43513 - CVSS 7.5 (high), 2026-05-12: Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from…
• CVE-2026-43515 - CVSS 9.1 (critical), 2026-05-12: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache…
• CVE-2026-41293 - CVSS 9.8 (critical), 2026-05-12: Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54,…
• CVE-2026-43512 - CVSS 9.8 (critical), 2026-05-12: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through…
• CVE-2026-42498 - CVSS 7.3 (high), 2026-05-12: Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat:…
• CVE-2026-41284 - CVSS 7.5 (high), 2026-05-12: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from…
• CVE-2026-34487 - CVSS 7.5 (high), 2026-04-09: Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer…
• CVE-2026-34486 - CVSS 7.5 (high), 2026-04-09: Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This…
• CVE-2026-34500 - CVSS 6.5 (medium), 2026-04-09: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache…
• CVE-2026-29129 - CVSS 7.5 (high), 2026-04-09: Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51…
• CVE-2026-32990 - CVSS 5.3 (medium), 2026-04-09: Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through…
• CVE-2026-25854 - CVSS 6.1 (medium), 2026-04-09: Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache…
• CVE-2026-29146 - CVSS 7.5 (high), 2026-04-09: Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through…
• CVE-2026-24880 - CVSS 7.5 (high), 2026-04-09: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue…
• CVE-2026-29145 - CVSS 9.1 (critical), 2026-04-09: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This…
• CVE-2026-34483 - CVSS 7.5 (high), 2026-04-09: Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1…
• CVE-2026-24734 - CVSS 7.5 (high), 2026-02-17: Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the…
• CVE-2026-24733 - CVSS 6.5 (medium), 2026-02-17: Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to…
• CVE-2025-66614 - CVSS 9.1 (critical), 2026-02-17: Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1…
• CVE-2025-61795 - CVSS 5.3 (medium), 2025-10-27: Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart…
• CVE-2025-55754 - CVSS 9.6 (critical), 2025-10-27: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If…
• CVE-2025-55752 - CVSS 7.5 (high), 2025-10-27: Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was…
• CVE-2025-55668 - CVSS 6.5 (medium), 2025-08-13: Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through…
• CVE-2025-48989 - CVSS 7.5 (high), 2025-08-13: Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat:…
• CVE-2025-53506 - CVSS 7.5 (high), 2025-07-10: Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum…
• CVE-2025-52434 - CVSS 7.5 (high), 2025-07-10: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native…
• CVE-2025-52520 - CVSS 7.5 (high), 2025-07-10: For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.…
• CVE-2025-48988 - CVSS 7.5 (high), 2025-06-16: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from…
• CVE-2025-49125 - CVSS 7.5 (high), 2025-06-16: Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the…
• CVE-2025-49124 - CVSS 8.4 (high), 2025-06-16: Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without…
• CVE-2025-46701 - CVSS 7.3 (high), 2025-05-29: Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the…
• CVE-2025-31650 - CVSS 7.5 (high), 2025-04-28: Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of…
• CVE-2025-31651 - CVSS 9.8 (critical), 2025-04-28: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was…
• CVE-2025-24813 - CVSS 10 (critical), 2025-03-10: Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files…
• CVE-2024-56337 - CVSS 9.8 (critical), 2024-12-20: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from…
• CVE-2024-50379 - CVSS 9.8 (critical), 2024-12-17: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when…
• CVE-2024-54677 - CVSS 5.3 (medium), 2024-12-17: Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects…
• CVE-2024-52318 - CVSS 6.1 (medium), 2024-11-18: Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to…
• CVE-2024-52316 - CVSS 9.8 (critical), 2024-11-18: Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext…
• CVE-2024-52317 - CVSS 6.5 (medium), 2024-11-18: Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to…
• CVE-2024-38286 - CVSS 8.6 (high), 2024-11-07: Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from…
• CVE-2024-34750 - CVSS 7.5 (high), 2024-07-03: Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did…
• CVE-2024-24549 - CVSS 7.5 (high), 2024-03-13: Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request…
• CVE-2024-23672 - CVSS 6.3 (medium), 2024-03-13: Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to…
• CVE-2024-21733 - CVSS 5.3 (medium), 2024-01-19: Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from…
• CVE-2023-46589 - CVSS 7.5 (high), 2023-11-28: Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through…
• CVE-2023-45648 - CVSS 5.3 (medium), 2023-10-10: Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through…
• CVE-2023-42794 - CVSS 5.9 (medium), 2023-10-10: Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85…
• CVE-2023-42795 - CVSS 5.3 (medium), 2023-10-10: Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1…
• CVE-2023-41080 - CVSS 6.1 (medium), 2023-08-25: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from…
• CVE-2023-34981 - CVSS 7.5 (high), 2023-06-21: A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP…
• CVE-2023-28709 - CVSS 7.5 (high), 2023-05-22: The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default…
• CVE-2023-28708 - CVSS 4.3 (medium), 2023-03-22: When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies…
• CVE-2023-24998 - CVSS 7.5 (high), 2023-02-20: Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS…
• CVE-2022-45143 - CVSS 7.5 (high), 2023-01-03: The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some…
• CVE-2022-42252 - CVSS 7.5 (high), 2022-11-01: If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting…
• CVE-2021-43980 - CVSS 3.7 (low), 2022-09-28: The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but…
• CVE-2022-34305 - CVSS 6.1 (medium), 2022-06-23: In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web…
• CVE-2022-25762 - CVSS 8.6 (high), 2022-05-13: If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache…