org.apache.tomcat.embed/tomcat-embed-core vulnerabilities

Latest org.apache.tomcat.embed/tomcat-embed-core CVEs

Newest publication first · page 1 of 4

1. CVE-2026-68525 Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

   Published 2026-08-25

   Critical·CVSS 9.1 EPSS 0.64%

   Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through...

2. CVE-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication

   Published 2026-08-25

   Critical·CVSS 9.8 EPSS 0.76%

   Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable...

3. CVE-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

   Published 2026-08-25

   Critical·CVSS 9.8 EPSS 0.75%

   Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1...

4. CVE-2026-65182 Apache Tomcat: Bypass longest prefix security constraint

   Published 2026-08-25

   Critical·CVSS 9.1 EPSS 0.65%

   Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through...

5. CVE-2026-55957 Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

   Published 2026-06-29

   High·CVSS 7.3 EPSS 2.9%

   Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, fr...

6. CVE-2026-55956 Apache Tomcat: Security constraints for default servlet ignored method

   Published 2026-06-29

   Medium·CVSS 6.5 EPSS 0.70%

   Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 thro...

7. CVE-2026-55276 Apache Tomcat: Logged effective web.xml is incomplete

   Published 2026-06-29

   Critical·CVSS 9.1 EPSS 0.61%

   Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 throu...

8. CVE-2026-53404 Apache Tomcat: Bad ornext processing in RewriteValve

   Published 2026-06-29

   High·CVSS 7.3 EPSS 0.70%

   Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 throug...

9. CVE-2026-43515 Apache Tomcat: Security constraints not correctly applied

   Published 2026-05-12

   Critical·CVSS 9.1 EPSS 1.2%

   Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through...

10. CVE-2026-43514 Apache Tomcat: AJP secret compared in non-constant time

    Published 2026-05-12

    Low·CVSS 3.7 EPSS 0.35%

    Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older u...

11. CVE-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive

    Published 2026-05-12

    High·CVSS 7.5 EPSS 0.50%

    Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older uns...

12. CVE-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user

    Published 2026-05-12

    Critical·CVSS 9.8 EPSS 1.3%

    DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older...

13. CVE-2026-41293 Apache Tomcat: HTTP/2 request headers not validated

    Published 2026-05-12

    Critical·CVSS 9.8 EPSS 1.7%

    Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users ar...

14. CVE-2026-42498 Apache Tomcat: WebSocket authentication header exposure

    Published 2026-05-12

    High·CVSS 7.3 EPSS 0.69%

    Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, fr...

15. CVE-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

    Published 2026-05-12

    High·CVSS 7.5 EPSS 0.84%

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recomm...

16. CVE-2026-34487 Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

    Published 2026-04-09

    High·CVSS 7.5 EPSS 0.46%

    Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 thro...

17. CVE-2026-34483 Apache Tomcat: Incomplete escaping of JSON access logs

    Published 2026-04-09

    High·CVSS 7.5 EPSS 0.47%

    Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116. Users are recommended to upgrade to version 1...

18. CVE-2026-32990 Apache Tomcat: Fix for CVE-2025-66614 is incomplete

    Published 2026-04-09

    Medium·CVSS 5.3 EPSS 0.31%

    Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10...

19. CVE-2026-29129 Apache Tomcat: TLS cipher order is not preserved

    Published 2026-04-09

    High·CVSS 7.5 EPSS 0.26%

    Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, wh...

20. CVE-2026-25854 Apache Tomcat: Occasionally open redirect

    Published 2026-04-09

    Medium·CVSS 6.1 EPSS 0.58%

    Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8...

21. CVE-2026-24880 Apache Tomcat: Request smuggling via invalid chunk extension

    Published 2026-04-09

    High·CVSS 7.5 EPSS 0.71%

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0...

22. CVE-2026-24734 Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

    Published 2026-02-17

    High·CVSS 7.5 EPSS 0.58%

    Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revoc...

23. CVE-2025-66614 Apache Tomcat: Client certificate verification bypass due to virtual host mapping

    Published 2026-02-17

    Critical·CVSS 9.1 EPSS 0.29%

    Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8....

24. CVE-2025-61795 Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS

    Published 2025-10-27

    Medium·CVSS 5.3 EPSS 1.2%

    Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage col...

25. CVE-2025-55752 Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

    Published 2025-10-27

    High·CVSS 7.5 EPSS 64.4%

    Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.