org.apache.tomcat/tomcat-util vulnerabilities

Latest org.apache.tomcat/tomcat-util CVEs

Newest publication first

1. CVE-2026-53434 Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

   Published 2026-06-29

   Critical·CVSS 9.1 EPSS 0.59%

   Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgr...

2. CVE-2023-42795 Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

   Published 2023-10-10

   Medium·CVSS 5.3 EPSS 2.5%

   Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts...

3. CVE-2022-45143 Apache Tomcat: JsonErrorReportValve escaping

   Published 2023-01-03

   High·CVSS 7.5 EPSS 2.7%

   The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that inv...

4. CVE-2016-8745 Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat

   Published 2017-08-10

   High·CVSS 7.5 EPSS 16.0%

   A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple time...

5. CVE-2014-0099 Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat

   Published 2014-05-31

   Medium·CVSS 4.3 EPSS 8.8%

   Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.