org.apache.tomcat vulnerabilities

Products

• org.apache.tomcat/tomcat 168
• org.apache.tomcat/tomcat-catalina 44
• org.apache.tomcat/tomcat-coyote 34
• org.apache.tomcat/tomcat-util 5
• org.apache.tomcat/tomcat-tribes 4
• org.apache.tomcat/tomcat-coyote-ffm 3
• org.apache.tomcat/tomcat-jasper 3
• org.apache.tomcat/tomcat-websocket 2
• org.apache.tomcat/jasper 1
• org.apache.tomcat/jsp-api 1
• org.apache.tomcat/servlet-api 1
• org.apache.tomcat/tomcat-catalina-jmx-remote 1
• org.apache.tomcat/tomcat-embed-core 1
• org.apache.tomcat/tomcat-juli 1
• org.apache.tomcat/tomcat-servlet-api 1
• org.apache.tomcat/tomcat-util-scan 1

Latest org.apache.tomcat CVEs

Newest publication first · page 1 of 9

1. CVE-2026-68525 Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

   Published 2026-08-25

   Critical·CVSS 9.1 EPSS 0.64%

   Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through...

2. CVE-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication

   Published 2026-08-25

   Critical·CVSS 9.8 EPSS 0.76%

   Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable...

3. CVE-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

   Published 2026-08-25

   Critical·CVSS 9.8 EPSS 0.75%

   Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1...

4. CVE-2026-65182 Apache Tomcat: Bypass longest prefix security constraint

   Published 2026-08-25

   Critical·CVSS 9.1 EPSS 0.65%

   Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through...

5. CVE-2026-55957 Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

   Published 2026-06-29

   High·CVSS 7.3 EPSS 2.9%

   Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, fr...

6. CVE-2026-55956 Apache Tomcat: Security constraints for default servlet ignored method

   Published 2026-06-29

   Medium·CVSS 6.5 EPSS 0.70%

   Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 thro...

7. CVE-2026-55955 Apache Tomcat: EncryptInterceptor not protected against replay attacks

   Published 2026-06-29

   Medium·CVSS 6.5 EPSS 0.44%

   Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 thr...

8. CVE-2026-55276 Apache Tomcat: Logged effective web.xml is incomplete

   Published 2026-06-29

   Critical·CVSS 9.1 EPSS 0.61%

   Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 throu...

9. CVE-2026-53434 Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

   Published 2026-06-29

   Critical·CVSS 9.1 EPSS 0.59%

   Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgr...

10. CVE-2026-53404 Apache Tomcat: Bad ornext processing in RewriteValve

    Published 2026-06-29

    High·CVSS 7.3 EPSS 0.70%

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 throug...

11. CVE-2026-50229 Apache Tomcat: XSS in number guess example

    Published 2026-06-29

    Medium·CVSS 6.1 EPSS 4.1%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 t...

12. CVE-2026-43515 Apache Tomcat: Security constraints not correctly applied

    Published 2026-05-12

    Critical·CVSS 9.1 EPSS 1.2%

    Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through...

13. CVE-2026-43514 Apache Tomcat: AJP secret compared in non-constant time

    Published 2026-05-12

    Low·CVSS 3.7 EPSS 0.35%

    Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older u...

14. CVE-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive

    Published 2026-05-12

    High·CVSS 7.5 EPSS 0.50%

    Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older uns...

15. CVE-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user

    Published 2026-05-12

    Critical·CVSS 9.8 EPSS 1.3%

    DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older...

16. CVE-2026-41293 Apache Tomcat: HTTP/2 request headers not validated

    Published 2026-05-12

    Critical·CVSS 9.8 EPSS 1.7%

    Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users ar...

17. CVE-2026-42498 Apache Tomcat: WebSocket authentication header exposure

    Published 2026-05-12

    High·CVSS 7.3 EPSS 0.69%

    Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, fr...

18. CVE-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

    Published 2026-05-12

    High·CVSS 7.5 EPSS 0.84%

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recomm...

19. CVE-2026-34500 Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

    Published 2026-04-09

    Medium·CVSS 6.5 EPSS 0.46%

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended...

20. CVE-2026-34487 Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

    Published 2026-04-09

    High·CVSS 7.5 EPSS 0.46%

    Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 thro...

21. CVE-2026-34486 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

    Published 2026-04-09

    High·CVSS 7.5 EPSS 98.5% CISA KEV added 2026-08-04 Exploited in the wild

    Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.11...

22. CVE-2026-34483 Apache Tomcat: Incomplete escaping of JSON access logs

    Published 2026-04-09

    High·CVSS 7.5 EPSS 0.47%

    Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116. Users are recommended to upgrade to version 1...

23. CVE-2026-32990 Apache Tomcat: Fix for CVE-2025-66614 is incomplete

    Published 2026-04-09

    Medium·CVSS 5.3 EPSS 0.31%

    Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10...

24. CVE-2026-29146 Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

    Published 2026-04-09

    High·CVSS 7.5 EPSS 8.9%

    Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109....

25. CVE-2026-29145 Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

    Published 2026-04-09

    Critical·CVSS 9.1 EPSS 0.73%

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115;...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.