Apache Software Foundation Apache Tomcat
141 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-103119 | 11.0.0-M25 – 11.0.26 | Apache Tomcat: AJP response mix-up | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-101356 | 11.0.22 – 11.0.26 ; 10.1.55 – 10.1.60 ; 9.0.118 – 9.0.122 | Apache Tomcat: HTTP/2 request/response mix-up after error during async processing | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-101296 | 11.0.0-M1 – 11.0.26 ; 10.1.0-M1 – 10.1.60 ; 9.0.0.M1 – 9.0.122 ; … | Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-93446 | 11.0.0-M21 – 11.0.26 ; 10.1.25 – 10.1.60 ; 9.0.90 – 9.0.122 | Apache Tomcat: Possible TLS 1.3 connection failures | 0.3 % | |||
| CVE-2026-88041 | 11.0.0-M23 – 11.0.26 ; 10.1.27 – 10.1.60 ; 9.0.92 – 9.0.122 | Apache Tomcat: HTTP/2 trailer header cross-contamination | 0.3 % | |||
| CVE-2026-80353 | 9.0.47 – 9.0.122 | Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector | 0.2 % | |||
| CVE-2026-74049 | 11.0.0-M1 – 11.0.26 ; 10.1.0-M1 – 10.1.60 ; 9.0.0.M1 – 9.0.122 ; … | Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) | 0.3 % | |||
| CVE-2026-74048 | 11.0.0-M14 – 11.0.26 ; 10.1.22 – 10.1.60 ; 9.0.92 – 9.0.122 | Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up | 0.2 % | |||
| CVE-2026-87022 | 11.0.0-M1 – 11.0.25 ; 10.1.0-M1 – 10.1.59 ; 9.0.0.M1 – 9.0.121 ; … | Apache Tomcat: WebSocket message smuggling with per-message-deflate | HIGH 7.5 | 0.5 % | ||
| CVE-2026-86350 | 11.0.22 – 11.0.25 ; 10.1.55 – 10.1.59 ; 9.0.118 – 9.0.121 | Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-86248 | 11.0.0-M14 – 11.0.25 ; 10.1.22 – 10.1.59 ; 9.0.92 – 9.0.121 | Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-79677 | 11.0.0-M1 – 11.0.25 ; 10.1.0-M1 – 10.1.59 ; 9.0.0.M1 – 9.0.121 ; … | Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout | HIGH 7.5 | 0.4 % | ||
| CVE-2026-78437 | 11.0.19 – 11.0.25 ; 10.1.53 – 10.1.59 ; 9.0.116 – 9.0.121 | Apache Tomcat: HTTP/2 DoS via malformed request | HIGH 7.3 | 0.5 % | ||
| CVE-2026-78383 | 11.0.0-M1 – 11.0.25 ; 10.1.0-M1 – 10.1.59 ; 9.0.0.M1 – 9.0.121 ; … | Apache Tomcat: AJP DoS via missing request body | HIGH 7.5 | 0.5 % | ||
| CVE-2026-77791 | 11.0.0-M5 – 11.0.25 ; 10.1.8 – 10.1.59 ; 9.0.74 – 9.0.121 ; … | Apache Tomcat: DoS via busy wait during WebSocket close | HIGH 7.5 | 0.7 % | ||
| CVE-2026-77762 | 11.0.0-M1 – 11.0.25 ; 10.1.0-M1 – 10.1.59 ; 9.0.39 – 9.0.121 ; … | Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request | HIGH 8.1 | 0.5 % | ||
| CVE-2026-77756 | 11.0.0-M1 – 11.0.25 ; 10.1.0-M1 – 10.1.59 ; 9.0.47 – 9.0.121 ; … | Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests | LOW 3.7 | 0.5 % | ||
| CVE-2026-76183 | 11.0.0-M1 – 11.0.25 ; 10.1.0-M1 – 10.1.59 ; 9.0.0.M1 – 9.0.121 ; … | Apache Tomcat: Bypass of security constraints for WebSocket endpoints | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-75973 | 11.0.0-M1 – 11.0.25 ; 10.1.0-M1 – 10.1.59 ; 9.0.0.M4 – 9.0.121 ; … | Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured | HIGH 7.3 | 0.5 % | ||
| CVE-2026-73581 | 11.0.0-M1 – 11.0.25 ; 10.1.0-M1 – 10.1.59 ; 9.0.0.M1 – 9.0.121 ; … | Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-73180 | 11.0.0-M1 – 11.0.24 ; 10.1.0-M1 – 10.1.57 ; 9.0.0.M1 – 9.0.120 ; … | Apache Tomcat: Authenticated WebSocket session survives end of HTTP session | MEDIUM 6.8 | 0.4 % | ||
| CVE-2026-68763 | 11.0.0-M1 – 11.0.24 ; 10.1.0-M1 – 10.1.57 ; 9.0.39 – 9.0.120 ; … | Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset | HIGH 7.5 | 0.7 % | ||
| CVE-2026-68569 | 11.0.0-M1 – 11.0.24 ; 10.1.0-M1 – 10.1.57 ; 9.0.0.M1 – 9.0.120 ; … | Apache Tomcat: Principal lookup can fail open in some cases | HIGH 8.1 | 0.5 % | ||
| CVE-2026-68525 | 11.0.0-M1 – 11.0.24 ; 10.1.0-M1 – 10.1.57 ; 9.0.0.M1 – 9.0.120 ; … | Apache Tomcat: Redirect after FORM auth may bypass method specific constraints | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-66422 | 11.0.0-M1 – 11.0.24 ; 10.1.0-M1 – 10.1.57 ; 9.0.25 – 9.0.120 ; … | Apache Tomcat: Servlet role references can bypass declarative role constraints | HIGH 8.1 | 0.4 % | ||
| CVE-2026-65927 | 11.0.0-M1 – 11.0.24 ; 10.1.0-M1 – 10.1.57 ; 9.0.0.M1 – 9.0.120 ; … | Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control | HIGH 7.5 | 0.7 % | ||
| CVE-2026-65905 | 11.0.0-M1 – 11.0.24 ; 10.1.0-M1 – 10.1.57 ; 9.0.0.M1 – 9.0.120 ; … | Apache Tomcat: Limited replay attack possible with DIGEST authentication | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-65637 | 11.0.20 – 11.0.24 ; 10.1.53 – 10.1.57 ; 9.0.115 – 9.0.120 | Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-65183 | 11.0.0-M1 – 11.0.24 ; 10.1.0-M1 – 10.1.57 ; 9.0.42 – 9.0.120 | Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets | HIGH 8.1 | 0.4 % | ||
| CVE-2026-65182 | 11.0.0-M1 – 11.0.24 ; 10.1.0-M1 – 10.1.57 ; 9.0.0.M1 – 9.0.120 ; … | Apache Tomcat: Bypass longest prefix security constraint | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-66299 | 11.0.0-M20 – 11.0.24 ; 10.1.24 – 10.1.57 ; 9.0.89 – 9.0.120 | Apache Tomcat: DoS via WebSocket chat example | HIGH 7.5 | 0.6 % | ||
| CVE-2026-59084 | 11.0.0-M1 – 11.0.23 ; 10.1.0-M1 – 10.1.56 ; 9.0.13 – 9.0.119 ; … | Apache Tomcat: EncryptInterceptor requirements not clearly documented | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-59083 | 11.0.0-M1 – 11.0.23 ; 10.1.0-M1 – 10.1.56 ; 9.0.0.M1 – 9.0.119 ; … | Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-55957 | 11.0.0-M1 – 11.0.4 ; 10.1.0-M1 – 10.1.36 ; 9.0.0.M1 – 9.0.100 ; … | Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind | HIGH 7.3 | 2.9 % | ||
| CVE-2026-55956 | 11.0.0-M1 – 11.0.22 ; 10.1.0-M1 – 10.1.55 ; 9.0.0.M1 – 9.0.118 ; … | Apache Tomcat: Security constraints for default servlet ignored method | MEDIUM 6.5 | 0.7 % | ||
| CVE-2026-55955 | 11.0.0-M1 – 11.0.22 ; 10.1.0-M1 – 10.1.55 ; 9.0.13 – 9.0.118 ; … | Apache Tomcat: EncryptInterceptor not protected against replay attacks | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-55276 | 11.0.0-M1 – 11.0.22 ; 10.1.0-M1 – 10.1.55 ; 9.0.0.M1 – 9.0.118 ; … | Apache Tomcat: Logged effective web.xml is incomplete | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-53434 | 11.0.0-M1 – 11.0.22 ; 10.1.0-M7 – 10.1.55 ; 9.0.83 – 9.0.118 | Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector | CRITICAL 9.1 | 0.6 % | ||
| CVE-2026-53404 | 11.0.0-M1 – 11.0.22 ; 10.1.0-M1 – 10.1.55 ; 9.0.0.M1 – 9.0.118 ; … | Apache Tomcat: Bad ornext processing in RewriteValve | HIGH 7.3 | 0.7 % | ||
| CVE-2026-50229 | 11.0.0-M1 – 11.0.22 ; 10.1.0-M1 – 10.1.55 ; 9.0.0.M1 – 9.0.118 ; … | Apache Tomcat: XSS in number guess example | MEDIUM 6.1 | 4.1 % | ||
| CVE-2026-43515 | 11.0.0-M1 – 11.0.21 ; 10.1.0-M1 – 10.1.54 ; 9.0.0.M1 – 9.0.117 ; … | Apache Tomcat: Security constraints not correctly applied | CRITICAL 9.1 | 1.2 % | ||
| CVE-2026-43514 | 11.0.0-M1 – 11.0.21 ; 10.1.0-M1 – 10.1.54 ; 9.0.0.M1 – 9.0.117 ; … | Apache Tomcat: AJP secret compared in non-constant time | LOW 3.7 | 0.4 % | ||
| CVE-2026-43513 | 11.0.0-M1 – 11.0.21 ; 10.1.0-M1 – 10.1.54 ; 9.0.0.M1 – 9.0.117 ; … | Apache Tomcat: LockOutRealm treats user names as case-sensitive | HIGH 7.5 | 0.5 % | ||
| CVE-2026-43512 | 11.0.0-M1 – 11.0.21 ; 10.1.0-M1 – 10.1.54 ; 9.0.0.M1 – 9.0.117 ; … | Apache Tomcat: Digest authenticator will authenticate any unknown user | CRITICAL 9.8 | 1.3 % | ||
| CVE-2026-41293 | 11.0.0-M1 – 11.0.21 ; 10.1.0-M1 – 10.1.54 ; 9.0.0.M1 – 9.0.117 ; … | Apache Tomcat: HTTP/2 request headers not validated | CRITICAL 9.8 | 1.7 % | ||
| CVE-2026-42498 | 11.0.0-M1 – 11.0.21 ; 10.1.0-M1 – 10.1.54 ; 9.0.2 – 9.0.117 ; … | Apache Tomcat: WebSocket authentication header exposure | HIGH 7.3 | 0.6 % | ||
| CVE-2026-41284 | 11.0.0-M1 – 11.0.21 ; 10.1.0-M1 – 10.1.54 ; 9.0.0.M1 – 9.0.117 ; … | Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling | HIGH 7.5 | 0.8 % | ||
| CVE-2026-34500 | 11.0.0-M14 – 11.0.20 ; 10.1.22 – 10.1.53 ; 9.0.92 – 9.0.116 | Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-34487 | 11.0.0-M1 – 11.0.20 ; 10.1.0-M1 – 10.1.53 ; 9.0.13 – 9.0.116 | Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token | HIGH 7.5 | 0.4 % | ||
| CVE-2026-34486 | 11.0.20 ; 10.1.53 ; 9.0.116 | Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor | HIGH 7.5 | 99 % | KEV | |
| CVE-2026-34483 | 11.0.0-M1 – 11.0.20 ; 10.1.0-M1 – 10.1.53 ; 9.0.40 – 9.0.116 ; … | Apache Tomcat: Incomplete escaping of JSON access logs | HIGH 7.5 | 0.5 % | ||
| CVE-2026-32990 | 11.0.15 – 11.0.19 ; 10.1.50 – 10.1.52 ; 9.0.113 – 9.0.115 | Apache Tomcat: Fix for CVE-2025-66614 is incomplete | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-29146 | 11.0.0-M1 – 11.0.18 ; 10.0.0-M1 – 10.1.52 ; 9.0.13 – 9.0.115 ; … | Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default | HIGH 7.5 | 8.8 % | ||
| CVE-2026-29145 | 11.0.0-M1 – 11.0.18 ; 10.1.0-M7 – 10.1.52 ; 9.0.83 – 9.0.115 | Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled | CRITICAL 9.1 | 0.7 % | ||
| CVE-2026-29129 | 11.0.16 – 11.0.18 ; 10.1.51 – 10.1.52 ; 9.0.114 – 9.0.115 | Apache Tomcat: TLS cipher order is not preserved | HIGH 7.5 | 0.3 % | ||
| CVE-2026-25854 | 11.0.0-M1 – 11.0.18 ; 10.1.0-M1 – 10.1.52 ; 9.0.0.M23 – 9.0.115 ; … | Apache Tomcat: Occasionally open redirect | MEDIUM 6.1 | 0.5 % | ||
| CVE-2026-24880 | 11.0.0-M1 – 11.0.18 ; 10.1.0-M1 – 10.1.52 ; 9.0.0.M1 – 9.0.115 ; … | Apache Tomcat: Request smuggling via invalid chunk extension | HIGH 7.5 | 0.7 % | ||
| CVE-2026-24734 | 11.0.0-M1 – 11.0.17 ; 10.1.0-M7 – 10.1.51 ; 9.0.83 – 9.0.114 | Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass | HIGH 7.5 | 0.6 % | ||
| CVE-2026-24733 | 11.0.0-M1 – 11.0.14 ; 10.1.0-M1 – 10.1.49 ; 9.0.0.M1 – 9.0.112 ; … | Apache Tomcat: Security constraint bypass with HTTP/0.9 | MEDIUM 6.5 | 0.6 % | ||
| CVE-2025-66614 | 11.0.0-M1 – 11.0.14 ; 10.1.0-M1 – 10.1.49 ; 9.0.0-M1 – 9.0.112 ; … | Apache Tomcat: Client certificate verification bypass due to virtual host mapping | CRITICAL 9.1 | 0.3 % | ||
| CVE-2025-61795 | 11.0.0-M1 – 11.0.11 ; 10.1.0-M1 – 10.1.46 ; 9.0.0.M1 – 9.0.109 ; … | Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS | MEDIUM 5.3 | 1.2 % | ||
| CVE-2025-55752 | 11.0.0-M1 – 11.0.10 ; 10.1.0-M1 – 10.1.44 ; 9.0.0.M11 – 9.0.108 ; … | Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled | HIGH 7.5 | 64 % | ||
| CVE-2025-55754 | 11.0.0-M1 – 11.0.10 ; 10.1.0-M1 – 10.1.44 ; 9.0.40 – 9.0.108 ; … | Apache Tomcat: console manipulation via escape sequences in log messages | CRITICAL 9.6 | 10 % | ||
| CVE-2025-55668 | 11.0.0-M1 – 11.0.7 ; 10.1.0-M1 – 10.1.41 ; 9.0.0.M1 – 9.0.105 | Apache Tomcat: session fixation via rewrite valve | MEDIUM 6.5 | 0.9 % | ||
| CVE-2025-48989 | 11.0.0-M1 – 11.0.9 ; 10.1.0-M1 – 10.1.43 ; 9.0.0.M1 – 9.0.107 | Apache Tomcat: h2 DoS - Made You Reset | HIGH 7.5 | 3.7 % | ||
| CVE-2025-53506 | 11.0.0-M1 – 11.0.8 ; 10.1.0-M1 – 10.1.42 ; 9.0.0.M1 – 9.0.106 ; … | Apache Tomcat: DoS via excessive h2 streams at connection start | HIGH 7.5 | 2.1 % | ||
| CVE-2025-52520 | 11.0.0-M1 – 11.0.8 ; 10.1.0-M1 – 10.1.42 ; 9.0.0.M1 – 9.0.106 ; … | Apache Tomcat: DoS via integer overflow in multipart file upload | HIGH 7.5 | 2.2 % | ||
| CVE-2025-52434 | 9.0.0.M1 – 9.0.106 ; 8.5.0 – 8.5.100 | Apache Tomcat: APR/Native Connector crash leading to DoS | HIGH 7.5 | 2.1 % | ||
| CVE-2025-49124 | 11.0.0-M1 – 11.0.7 ; 10.1.0 – 10.1.41 ; 9.0.23 – 9.0.105 ; … | Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows | HIGH 8.4 | 0.4 % | ||
| CVE-2025-49125 | 11.0.0-M1 – 11.0.7 ; 10.1.0-M1 – 10.1.41 ; 9.0.0.M1 – 9.0.105 ; … | Apache Tomcat: Security constraint bypass for pre/post-resources | HIGH 7.5 | 3.4 % | ||
| CVE-2025-48988 | 11.0.0-M1 – 11.0.7 ; 10.1.0-M1 – 10.1.41 ; 9.0.0.M1 – 9.0.105 ; … | Apache Tomcat: FileUpload large number of parts with headers DoS | HIGH 7.5 | 30 % | ||
| CVE-2025-46701 | 11.0.0-M1 – 11.0.6 ; 10.1.0-M1 – 10.1.40 ; 9.0.0.M1 – 9.0.104 ; … | Apache Tomcat: Security constraint bypass for CGI scripts | HIGH 7.3 | 3.1 % | ||
| CVE-2025-31651 | 11.0.0-M1 – 11.0.5 ; 10.1.0-M1 – 10.1.39 ; 9.0.0.M1 – 9.0.102 ; … | Apache Tomcat: Bypass of rules in Rewrite Valve | CRITICAL 9.8 | 4.2 % | ||
| CVE-2025-31650 | 9.0.76 – 9.0.102 ; 10.1.10 – 10.1.39 ; 11.0.0-M2 – 11.0.5 ; … | Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame | HIGH 7.5 | 61 % | ||
| CVE-2025-24813 | 11.0.0-M1 – 11.0.2 ; 10.1.0-M1 – 10.1.34 ; 9.0.0.M1 – 9.0.98 ; … | Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT | CRITICAL 10.0 | 100 % | KEV | |
| CVE-2024-56337 | 11.0.0-M1 – 11.0.1 ; 10.1.0-M1 – 10.1.33 ; 9.0.0.M1 – 9.0.97 ; … | Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete | CRITICAL 9.8 | 9.0 % | ||
| CVE-2024-54677 | 11.0.0-M1 – 11.0.1 ; 10.1.0-M1 – 10.1.33 ; 9.0.0.M1 – 9.0.97 ; … | Apache Tomcat: DoS in examples web application | MEDIUM 5.3 | 1.9 % | ||
| CVE-2024-50379 | 11.0.0-M1 – 11.0.1 ; 10.1.0-M1 – 10.1.33 ; 9.0.0.M1 – 9.0.97 ; … | Apache Tomcat: RCE due to TOCTOU issue in JSP compilation | CRITICAL 9.8 | 32 % | ||
| CVE-2024-52318 | 11.0.0 ; 10.1.31 ; 9.0.96 | Apache Tomcat: Incorrect JSP tag recycling leads to XSS | MEDIUM 6.1 | 1.9 % | ||
| CVE-2024-52317 | 11.0.0-M23 – 11.0.0-M26 ; 10.1.27 – 10.1.30 ; 9.0.92 – 9.0.95 | Apache Tomcat: Request/response mix-up with HTTP/2 | MEDIUM 6.5 | 2.1 % | ||
| CVE-2024-52316 | 11.0.0-M1 – 11.0.0-M26 ; 10.1.0-M1 – 10.1.30 ; 9.0.0-M1 – 9.0.95 ; … | Apache Tomcat: Authentication bypass when using Jakarta Authentication API | CRITICAL 9.8 | 6.2 % | ||
| CVE-2024-38286 | 11.0.0-M1 – 11.0.0-M20 ; 10.1.0-M1 – 10.1.24 ; 9.0.13 – 9.0.89 ; … | Apache Tomcat: Denial of Service | HIGH 8.6 | 1.7 % | ||
| CVE-2024-34750 | 11.0.0-M1 – 11.0.0-M20 ; 10.1.0-M1 – 10.1.24 ; 9.0.0-M1 – 9.0.89 ; … | Apache Tomcat: HTTP/2 excess header handling DoS | HIGH 7.5 | 4.6 % | ||
| CVE-2024-23672 | 11.0.0-M1 – 11.0.0-M16 ; 10.1.0-M1 – 10.1.18 ; 9.0.0-M1 – 9.0.85 ; … | Apache Tomcat: WebSocket DoS with incomplete closing handshake | MEDIUM 6.3 | 2.3 % | ||
| CVE-2024-24549 | 11.0.0-M1 – 11.0.0-M16 ; 10.1.0-M1 – 10.1.18 ; 9.0.0-M1 – 9.0.85 ; … | Apache Tomcat: HTTP/2 header handling DoS | HIGH 7.5 | 23 % | ||
| CVE-2024-21733 | 8.5.7 – 8.5.63 ; 9.0.0-M11 – 9.0.43 | Apache Tomcat: Leaking of unrelated request bodies in default error page | MEDIUM 5.3 | 14 % | ||
| CVE-2023-46589 | 11.0.0-M1 – 11.0.0-M10 ; 10.1.0-M1 – 10.1.15 ; 9.0.0-M1 – 9.0.82 ; … | Apache Tomcat: HTTP request smuggling via malformed trailer headers | HIGH 7.5 | 2.7 % | ||
| CVE-2023-45648 | 11.0.0-M1 – 11.0.0-M11 ; 10.1.0-M1 – 10.1.13 ; 9.0.0-M1 – 9.0.81 ; … | Apache Tomcat: Trailer header parsing too lenient | MEDIUM 5.3 | 5.9 % | ||
| CVE-2023-42795 | 11.0.0-M1 – 11.0.0-M11 ; 10.1.0-M1 – 10.1.13 ; 9.0.0-M1 – 9.0.80 ; … | Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests | MEDIUM 5.3 | 2.5 % | ||
| CVE-2023-42794 | 9.0.70 – 9.0.80 ; 8.5.85 – 8.5.93 | Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows | MEDIUM 5.9 | 2.3 % | ||
| CVE-2023-41080 | 11.0.0-M1 – 11.0.0-M10 ; 10.1.0-M1 – 10.0.12 ; 9.0.0-M1 – 9.0.79 ; … | Apache Tomcat: Open redirect with FORM authentication | MEDIUM 6.1 | 6.5 % | ||
| CVE-2023-34981 | 11.0.0-M5 ; 10.1.8 ; 9.0.74 ; … | Apache Tomcat: AJP response header mix-up | HIGH 7.5 | 1.1 % | ||
| CVE-2023-28709 | 11.0.0-M2 – 11.0.0-M4 ; 10.1.5 – 10.1.7 ; 9.0.71 – 9.0.73 ; … | Apache Tomcat: Fix for CVE-2023-24998 is incomplete | HIGH 7.5 | 48 % | ||
| CVE-2023-28708 | 11.0.0-M1 – 11.0.0-M2 ; 10.1.0-M1 – 10.1.5 ; 9.0.0-M1 – 9.0.71 ; … | Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations | MEDIUM 4.3 | 1.8 % | ||
| CVE-2023-24998 | 11.0.0-M1 ; 10.0.0-M1 – 10.1.4 ; 9.0.0-M1 – 9.0.70 ; … | Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts | HIGH 7.5 | 49 % | ||
| CVE-2022-45143 | 10.1.0-M1 – 10.1.1 ; 9.0.40 – 9.0.68 ; 8.5.83 | Apache Tomcat: JsonErrorReportValve escaping | HIGH 7.5 | 2.6 % | ||
| CVE-2022-42252 | 10.1.0-M1 – 10.1.0 ; 10.0.0-M1 – 10.0.26 ; 9.0.0-M1 – 9.0.67 ; … | Apache Tomcat request smuggling via malformed content-length | HIGH 7.5 | 1.6 % | ||
| CVE-2021-43980 | 10.1.0-M1 to 10.1.0-M12 ; 10.0.0-M1 to 10.0.18 ; 9.0.0-M1 to 9.0.60 ; … | Apache Tomcat: Information disclosure | LOW 3.7 | 2.4 % | ||
| CVE-2022-34305 | Apache Tomcat 8.5 8.5.50 to 8.5.81 ; Apache Tomcat 9 9.0.30 to 9.0.64 ; Apache Tomcat 10.0 10.0.0-M1 to 10.0.22 ; … | XSS in examples web application | MEDIUM 6.1 | 6.7 % | ||
| CVE-2022-25762 | Apache Tomcat 9 9.0.0.M1 to 9.0.20 ; Apache Tomcat 8.5 8.5.0 to 8.5.75 | Response mix-up with WebSocket concurrent send and close | HIGH 8.6 | 8.4 % | ||
| CVE-2022-29885 | Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14 ; Apache Tomcat 10 10.0.0-M1 to 10.0.20 ; Apache Tomcat 9 9.0.13 to 9.0.62 ; … | EncryptInterceptor does not provide complete protection on insecure networks | HIGH 7.5 | 73 % | ||
| CVE-2022-23181 | Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M8 ; Apache Tomcat 10.0 10.0.0-M5 to 10.0.14 ; Apache Tomcat 9 9.0.35 to 9.0.56 ; … | Local privilege escalation with FileStore | HIGH 7.0 | 0.7 % | ||
| CVE-2021-42340 | Apache Tomcat 10 10.0.0-M10 to 10.0.11 ; Apache Tomcat 10 10.1.0-M1 to 10.1.0-M5 ; Apache Tomcat 9 9.0.40 to 9.0.53 ; … | DoS via memory leak with WebSocket connections | HIGH 7.5 | 12 % | ||
| CVE-2021-41079 | Apache Tomcat 8.5 8.5.0 to 8.5.63 ; Apache Tomcat 9 9.0.0-M1 to 9.0.43 ; Apache Tomcat 10 10.0.0-M1 to 10.0.2 | Apache Tomcat DoS with unexpected TLS packet | HIGH 7.5 | 7.2 % | ||
| CVE-2021-33037 | Apache Tomcat 10 10.0.0-M1 to 10.0.6 ; Apache Tomcat 9 9.0.0.M1 to 9.0.46 ; Apache Tomcat 8 8.5.0 to 8.5.66 | Incorrect Transfer-Encoding handling with HTTP/1.0 | MEDIUM 5.3 | 75 % | ||
| CVE-2021-30640 | Apache Tomcat 10 10.0.0-M1 to 10.0.5 ; Apache Tomcat 9 9.0.0.M1 to 9.0.45 ; Apache Tomcat 8.5 8.5.0 to 8.5.65 ; … | Auth weakness in JNDIRealm | MEDIUM 6.5 | 9.9 % | ||
| CVE-2021-30639 | Apache Tomcat 10 10.0.3 to 10.0.4 ; Apache Tomcat 9 9.0.44 ; Apache Tomcat 8.5 8.5.64 | DoS after non-blocking IO error | HIGH 7.5 | 6.9 % | ||
| CVE-2021-25329 | Apache Tomcat 10 – < 10.0.0 ; Apache Tomcat 9 – < 9.0.41 ; Apache Tomcat 8.5 – < 8.5.61 ; … | Incomplete fix for CVE-2020-9484 | HIGH 7.0 | 9.5 % | ||
| CVE-2021-25122 | Apache Tomcat 10 – < 10.0.2 ; Apache Tomcat 9 – < 9.0.42 ; Apache Tomcat 8.5 – < 8.5.62 | Apache Tomcat h2c request mix-up | HIGH 7.5 | 18 % | ||
| CVE-2021-24122 | Apache Tomcat 10 – < 10.0.0-M10 ; Apache Tomcat 9 – < 9.0.40 ; Apache Tomcat 8.5 – < 8.5.60 ; … | Apache Tomcat information disclosure | MEDIUM 5.9 | 23 % | ||
| CVE-2020-17527 | Apache Tomcat 10 10.0.0-M1 to 10.0.0-M9 ; Apache Tomcat 9 9.0.0-M1 to 9.0.39 ; Apache Tomcat 8.5 8.5.0 to 8.5.59 | Apache Tomcat: Request header mix-up between HTTP/2 streams | HIGH 7.5 | 25 % | ||
| CVE-2019-12418 | 9.0.0.M1 to 9.0.28 ; 8.5.0 to 8.5.47 ; 7.0.0 to 7.0.97 | When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attac | HIGH 7.0 | 1.2 % | ||
| CVE-2019-17563 | 9.0.0.M1 to 9.0.29 ; 8.5.0 to 8.5.49 ; 7.0.0 to 7.0.98 | When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an | HIGH 7.5 | 11 % | ||
| CVE-2018-11784 | 9.0.0.M1 to 9.0.11 ; 8.5.0 to 8.5.33 ; 7.0.23 to 7.0.90 | When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directo | MEDIUM 4.3 | 98 % | ||
| CVE-2018-8037 | 9.0.0.M9 to 9.0.9 ; 8.5.5 to 8.5.31 | If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed | MEDIUM 5.9 | 11 % | ||
| CVE-2018-1336 | 9.0.0.M9 to 9.0.7 ; 8.5.0 to 8.5.30 ; 8.0.0.RC1 to 8.0.51 ; … | An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Den | HIGH 7.5 | 20 % | ||
| CVE-2018-8034 | 9.0.0.M1 to 9.0.9 ; 8.5.0 to 8.5.31 ; 8.0.0.RC1 to 8.0.52 ; … | The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tom | HIGH 7.5 | 21 % | ||
| CVE-2018-8014 | 9.0.0.M1 to 9.0.8 ; 8.5.0 to 8.5.31 ; 8.0.0.RC1 to 8.0.52 ; … | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.8 | CRITICAL 9.8 | 21 % | ||
| CVE-2018-1304 | Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84 | The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4 | MEDIUM 5.9 | 17 % | ||
| CVE-2018-1305 | Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84 | Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 t | MEDIUM 6.5 | 14 % | ||
| CVE-2017-15706 | 9.0.0.M22 to 9.0.1 ; 8.5.16 to 8.5.23 ; 8.0.45 to 8.0.47 ; … | As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7 | MEDIUM 5.3 | 6.1 % | ||
| CVE-2017-12617 | 9.0.0.M1 to 9.0.0 ; 8.5.0 to 8.5.22 ; 8.0.0.RC1 to 8.0.46 ; … | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. | HIGH 8.1 | 100 % | KEV | |
| CVE-2017-12616 | 7.0.0 to 7.0.80 | When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code | HIGH 7.5 | 70 % | ||
| CVE-2017-12615 | 7.0.0 to 7.0.79 | When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the | HIGH 8.1 | 100 % | KEV | |
| CVE-2017-7675 | 9.0.0.M1 to 9.0.0.M21 ; 8.5.0 to 8.5.15 | The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented dir | HIGH 7.5 | 10 % | ||
| CVE-2017-7674 | 9.0.0.M1 to 9.0.0.M21 ; 8.5.0 to 8.5.15 ; 8.0.0.RC1 to 8.0.44 ; … | The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary h | MEDIUM 4.3 | 8.0 % | ||
| CVE-2016-6796 | 9.0.0.M1 to 9.0.0.M9 ; 8.5.0 to 8.5.4 ; 8.0.0.RC1 to 8.0.36 ; … | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to | HIGH 7.5 | 8.3 % | ||
| CVE-2016-8745 | 9.0.0.M1 to 9.0.0.M13 ; 8.5.0 to 8.5.8 ; 8.0.0.RC1 to 8.0.39 ; … | A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.R | HIGH 7.5 | 16 % | ||
| CVE-2016-6817 | 9.0.0.M1 to 9.0.0.M11 ; 8.5.0 to 8.5.6 | The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that wa | HIGH 7.5 | 7.2 % | ||
| CVE-2016-6797 | 9.0.0.M1 to 9.0.0.M9 ; 8.5.0 to 8.5.4 ; 8.0.0.RC1 to 8.0.36 ; … | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 | HIGH 7.5 | 8.1 % | ||
| CVE-2016-6794 | 9.0.0.M1 to 9.0.0.M9 ; 8.5.0 to 8.5.4 ; 8.0.0.RC1 to 8.0.36 ; … | When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In | MEDIUM 5.3 | 7.2 % | ||
| CVE-2016-5018 | 9.0.0.M1 to 9.0.0.M9 ; 8.5.0 to 8.5.4 ; 8.0.0.RC1 to 8.0.36 ; … | In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application | CRITICAL 9.1 | 10 % | ||
| CVE-2016-0762 | 9.0.0.M1 to 9.0.0.M9 ; 8.5.0 to 8.5.4 ; 8.0.0.RC1 to 8.0.36 ; … | The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to | MEDIUM 5.9 | 8.0 % | ||
| CVE-2017-5664 | 9.0.0.M1 to 9.0.0.M20 ; 8.5.0 to 8.5.14 ; 8.0.0.RC1 to 8.0.43 ; … | The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error | HIGH 7.5 | 17 % | ||
| CVE-2017-5651 | 9.0.0.M1 to 9.0.0.M18 ; 8.5.0 to 8.5.12 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file | CRITICAL 9.8 | 7.8 % | ||
| CVE-2017-5650 | 9.0.0.M1 to 9.0.0.M18 ; 8.5.0 to 8.5.12 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams as | HIGH 7.5 | 8.3 % | ||
| CVE-2017-5648 | 9.0.0.M1 to 9.0.0.M17 ; 8.5.0 to 8.5.11 ; 8.0.0.RC1 to 8.0.41 ; … | While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5. | CRITICAL 9.1 | 13 % | ||
| CVE-2017-5647 | 9.0.0.M1 to 9.0.0.M18 ; 8.5.0 to 8.5.12 ; 8.0.0.RC1 to 8.0.42 ; … | A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.7 | HIGH 7.5 | 17 % | ||
| CVE-2016-8735 | before 6.0.48 ; 7.x before 7.0.73 ; 8.x before 8.0.39 ; … | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before | CRITICAL 9.8 | 90 % | KEV | |
| CVE-2016-6816 | 9.0.0.M1 to 9.0.0.M11 ; 8.5.0 to 8.5.6 ; 8.0.0.RC1 to 8.0.38 ; … | The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the H | HIGH 7.1 | 40 % | ||
| CVE-2016-8747 | 8.5.7 to 8.5.9 ; 9.0.0.M11 to 9.0.0.M15 | An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. H | HIGH 7.5 | 7.1 % |