Apache Software Foundation Apache Tomcat Native
8 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-86247 | 2.0.0 – 2.0.15 ; 1.3.0 – 1.3.8 | Apache Tomcat Native: Client certificate requirements can be down-graded | HIGH 7.4 | 0.2 % | ||
| CVE-2026-86246 | 2.0.0 – 2.0.15 ; 1.3.0 – 1.3.8 | Apache Tomcat Native: Insecure OpenSSL options enabled | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-86243 | 2.0.0 – 2.0.15 ; 1.3.0 – 1.3.8 | Apache Tomcat Native: DoS via TLS handshake | HIGH 7.5 | 0.6 % | ||
| CVE-2026-29145 | 1.1.23 – 1.1.34 ; 1.2.0 – 1.2.39 ; 1.3.0 – 1.3.6 ; … | Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled | CRITICAL 9.1 | 0.7 % | ||
| CVE-2026-24734 | 1.1.23 – 1.1.34 ; 1.2.0 – 1.2.39 ; 1.3.0 – 1.3.4 ; … | Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass | HIGH 7.5 | 0.6 % | ||
| CVE-2018-8020 | 1.2.0 to 1.2.16 ; 1.1.23 to 1.1.34 | Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lis | HIGH 7.4 | 4.1 % | ||
| CVE-2018-8019 | 1.2.0 to 1.2.16 ; 1.1.23 to 1.1.34 | When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allo | HIGH 7.4 | 4.0 % | ||
| CVE-2017-15698 | 1.2.0 to 1.2.14 ; 1.1.23 to 1.1.34 | When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not co | MEDIUM 5.9 | 3.5 % |