apache tomcat vulnerabilities

Latest apache tomcat CVEs

Newest publication first · page 1 of 11

1. CVE-2026-73180 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session

   Published 2026-08-25

   Medium·CVSS 6.8 EPSS 0.44%

   Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required...

2. CVE-2026-68763 Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

   Published 2026-08-25

   High·CVSS 7.5 EPSS 0.75%

   Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The followi...

3. CVE-2026-68569 Apache Tomcat: Principal lookup can fail open in some cases

   Published 2026-08-25

   High·CVSS 8.1 EPSS 0.46%

   Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1...

4. CVE-2026-68525 Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

   Published 2026-08-25

   Critical·CVSS 9.1 EPSS 0.64%

   Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through...

5. CVE-2026-66422 Apache Tomcat: Servlet role references can bypass declarative role constraints

   Published 2026-08-25

   High·CVSS 8.1 EPSS 0.43%

   Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, f...

6. CVE-2026-65927 Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

   Published 2026-08-25

   High·CVSS 7.5 EPSS 0.68%

   Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from...

7. CVE-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication

   Published 2026-08-25

   Critical·CVSS 9.8 EPSS 0.76%

   Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable...

8. CVE-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

   Published 2026-08-25

   Critical·CVSS 9.8 EPSS 0.75%

   Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1...

9. CVE-2026-65183 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets

   Published 2026-08-25

   High·CVSS 8.1 EPSS 0.40%

   Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57,...

10. CVE-2026-65182 Apache Tomcat: Bypass longest prefix security constraint

    Published 2026-08-25

    Critical·CVSS 9.1 EPSS 0.65%

    Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through...

11. CVE-2026-66299 Apache Tomcat: DoS via WebSocket chat example

    Published 2026-07-28

    Medium·CVSS 5.3 EPSS 0.55%

    Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the exa...

12. CVE-2026-59084 Apache Tomcat: EncryptInterceptor requirements not clearly documented

    Published 2026-07-14

    Critical·CVSS 9.1 EPSS 0.51%

    Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 throu...

13. CVE-2026-59083 Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass

    Published 2026-07-14

    Critical·CVSS 9.1 EPSS 0.52%

    Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0....

14. CVE-2026-55957 Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

    Published 2026-06-29

    High·CVSS 7.3 EPSS 2.9%

    Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, fr...

15. CVE-2026-55956 Apache Tomcat: Security constraints for default servlet ignored method

    Published 2026-06-29

    Medium·CVSS 6.5 EPSS 0.70%

    Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 thro...

16. CVE-2026-55955 Apache Tomcat: EncryptInterceptor not protected against replay attacks

    Published 2026-06-29

    Medium·CVSS 6.5 EPSS 0.44%

    Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 thr...

17. CVE-2026-55276 Apache Tomcat: Logged effective web.xml is incomplete

    Published 2026-06-29

    Critical·CVSS 9.1 EPSS 0.61%

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 throu...

18. CVE-2026-53434 Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

    Published 2026-06-29

    Critical·CVSS 9.1 EPSS 0.59%

    Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgr...

19. CVE-2026-53404 Apache Tomcat: Bad ornext processing in RewriteValve

    Published 2026-06-29

    High·CVSS 7.3 EPSS 0.70%

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 throug...

20. CVE-2026-50229 Apache Tomcat: XSS in number guess example

    Published 2026-06-29

    Medium·CVSS 6.1 EPSS 4.1%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 t...

21. CVE-2026-43515 Apache Tomcat: Security constraints not correctly applied

    Published 2026-05-12

    Critical·CVSS 9.1 EPSS 1.2%

    Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through...

22. CVE-2026-43514 Apache Tomcat: AJP secret compared in non-constant time

    Published 2026-05-12

    Low·CVSS 3.7 EPSS 0.35%

    Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older u...

23. CVE-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive

    Published 2026-05-12

    High·CVSS 7.5 EPSS 0.50%

    Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older uns...

24. CVE-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user

    Published 2026-05-12

    Critical·CVSS 9.8 EPSS 1.3%

    DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older...

25. CVE-2026-41293 Apache Tomcat: HTTP/2 request headers not validated

    Published 2026-05-12

    Critical·CVSS 9.8 EPSS 1.7%

    Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users ar...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.