Skip to content

Product

org.apache.tomcat/tomcat vulnerabilities

168 published CVES affecting org.apache.tomcat/tomcat, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
168
Critical
10
High
41
Medium
106
Low
11
Unscored
0
CISA KEV
1

Latest org.apache.tomcat/tomcat CVEs

Newest publication first · page 1 of 7

  3. CVE-2026-65182 Apache Tomcat: Bypass longest prefix security constraint

    Published
    CriticalCVSS 9.1 EPSS 0.65%

    Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through...

  7. CVE-2026-55276 Apache Tomcat: Logged effective web.xml is incomplete

    Published
    CriticalCVSS 9.1 EPSS 0.61%

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 throu...

  8. CVE-2026-53404 Apache Tomcat: Bad ornext processing in RewriteValve

    Published
    HighCVSS 7.3 EPSS 0.70%

    Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 throug...

  9. CVE-2026-50229 Apache Tomcat: XSS in number guess example

    Published
    MediumCVSS 6.1 EPSS 4.1%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 t...

  10. CVE-2026-43515 Apache Tomcat: Security constraints not correctly applied

    Published
    CriticalCVSS 9.1 EPSS 1.2%

    Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through...

  11. CVE-2026-43514 Apache Tomcat: AJP secret compared in non-constant time

    Published
    LowCVSS 3.7 EPSS 0.35%

    Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older u...

  12. CVE-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive

    Published
    HighCVSS 7.5 EPSS 0.50%

    Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older uns...

  14. CVE-2026-41293 Apache Tomcat: HTTP/2 request headers not validated

    Published
    CriticalCVSS 9.8 EPSS 1.7%

    Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users ar...

  15. CVE-2026-42498 Apache Tomcat: WebSocket authentication header exposure

    Published
    HighCVSS 7.3 EPSS 0.69%

    Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, fr...

  18. CVE-2026-34486 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

    Published
    HighCVSS 7.5 EPSS 98.5% CISA KEV added 2026-08-04 Exploited in the wild

    Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.11...

  19. CVE-2026-34483 Apache Tomcat: Incomplete escaping of JSON access logs

    Published
    HighCVSS 7.5 EPSS 0.47%

    Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116. Users are recommended to upgrade to version 1...

  20. CVE-2026-32990 Apache Tomcat: Fix for CVE-2025-66614 is incomplete

    Published
    MediumCVSS 5.3 EPSS 0.31%

    Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10...

  23. CVE-2026-29129 Apache Tomcat: TLS cipher order is not preserved

    Published
    HighCVSS 7.5 EPSS 0.26%

    Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, wh...

  24. CVE-2026-25854 Apache Tomcat: Occasionally open redirect

    Published
    MediumCVSS 6.1 EPSS 0.58%

    Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.