Every CVE Search/ Get API key

CVE-2026-55957

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

7.3 HighPublic exploitFix available

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

2.85%Up 2.6 points since Jun 30, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.3

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Record
CVE-2026-55957
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-304
Updated
2026-11-02
EUVDEUVD-2026-40233 7.3

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Record
EUVD-2026-40233
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-7895-gffq-w6jq 7.3

Apache Tomcat has a Missing Critical Step in Authentication vulnerability

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without providing the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Record
GHSA-7895-gffq-w6jq
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-304
Updated
2026-11-04
NVD 7.3

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Record
CVE-2026-55957
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-304
Updated
2026-11-02
OSV 7.3

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Record
CVE-2026-55957
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-304
Updated
2026-11-04
OSVDEBIAN-CVE-2026-55957 7.3

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Record
DEBIAN-CVE-2026-55957
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
Show 33 moreShow less
OSVGHSA-7895-gffq-w6jq 7.3

Apache Tomcat has a Missing Critical Step in Authentication vulnerability

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without providing the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Record
GHSA-7895-gffq-w6jq
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-304
Updated
2026-11-04
OSVOESA-2026-2947 9.1

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-50229)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-53404)

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.(CVE-2026-53434)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.(CVE-2026-55276)

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.(CVE-2026-55955)

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-55956)

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.(CVE-2026-55957)

Record
OESA-2026-2947
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-2948 9.1

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-50229)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-53404)

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.(CVE-2026-53434)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.(CVE-2026-55276)

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.(CVE-2026-55955)

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-55956)

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.(CVE-2026-55957)

Record
OESA-2026-2948
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-2949 9.1

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-50229)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-53404)

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.(CVE-2026-53434)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.(CVE-2026-55276)

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.(CVE-2026-55955)

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-55956)

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.(CVE-2026-55957)

Record
OESA-2026-2949
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-2950 9.1

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-50229)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-53404)

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.(CVE-2026-53434)

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.(CVE-2026-55276)

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue.(CVE-2026-55955)

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.(CVE-2026-55956)

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.(CVE-2026-55957)

Record
OESA-2026-2950
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:18536 7.5

Red Hat Security Advisory: tomcat9 security update

Record
RHSA-2026:18536
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:18537 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:18537
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:18916 7.4

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:18916
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:29203 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:29203
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:32960 7.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:32960
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:67163 7.5

Red Hat Security Advisory: tomcat9 security update

Record
RHSA-2026:67163
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:67164 7.3

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:67164
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:68659 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:68659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:68677 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:68677
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:68678 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:68678
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:68679 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:68679
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:68680 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:68680
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:68677 7.3

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)

  • tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)

  • tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)

  • tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)

  • tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)

  • tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)

  • tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)

  • tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:68677
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-55957 7.3

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Record
UBUNTU-CVE-2026-55957
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVALSA-2026:68677 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
  • tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
  • tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
  • tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
  • tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
  • tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)
  • tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
  • tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:68677
Updated
2026-11-02
OSVBIT-tomcat-2026-55957 No score

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.4, from 10.1.0 through 10.1.36, from 9.0.0 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Record
BIT-tomcat-2026-55957
Updated
2026-11-04
OSVCLSA-2026-1783351984 No score

Fix CVE(s): CVE-2026-55956, CVE-2026-55957

  • SECURITY UPDATE: authentication bypass in JNDIRealm with GSSAPI
    • debian/patches/CVE-2026-55957.patch: don't reuse GSSAPI SASL auth when validating user credentials in java/org/apache/catalina/realm/JNDIRealm.java
    • CVE-2026-55957
  • SECURITY UPDATE: default servlet security constraint method bypass
    • debian/patches/CVE-2026-55956.patch: honour per-method constraints mapped to "/" in java/org/apache/catalina/realm/RealmBase.java
    • CVE-2026-55956
Record
CLSA-2026-1783351984
Updated
2026-11-02
OSVCLSA-2026-1783352184 No score

Fix CVE(s): CVE-2026-55956, CVE-2026-55957

  • SECURITY UPDATE: authentication bypass in JNDIRealm with GSSAPI
    • debian/patches/CVE-2026-55957.patch: don't reuse GSSAPI SASL auth when validating user credentials in java/org/apache/catalina/realm/JNDIRealm.java
    • CVE-2026-55957
  • SECURITY UPDATE: default servlet security constraint method bypass
    • debian/patches/CVE-2026-55956.patch: honour per-method constraints mapped to "/" in java/org/apache/catalina/realm/RealmBase.java
    • CVE-2026-55956
Record
CLSA-2026-1783352184
Updated
2026-11-02
OSVCLSA-2026-1783356847 No score

tomcat: Fix of 2 CVEs

  • CVE-2026-55957: don't reuse GSSAPI SASL authentication when validating user-provided credentials in JNDIRealm, closing an LDAP bind authentication bypass (upstream tomcat 9.0.102)
  • CVE-2026-55956: honour per-method security constraints mapped to "/" so method omissions on the default servlet are no longer ignored (upstream tomcat 9.0.119)
Record
CLSA-2026-1783356847
Updated
2026-11-02
OSVCLSA-2026-1783522891 No score

tomcat: Fix of CVE-2026-55957

  • CVE-2026-55957: fix JNDIRealm GSSAPI credential validation bypass by snapshotting the JNDI environment before bind, removing SECURITY_AUTHENTICATION when set to GSSAPI, and restoring it in a finally block that also releases user credentials
Record
CLSA-2026-1783522891
Updated
2026-11-02
OSVCLSA-2026-1783591320 No score

tomcat: Fix of CVE-2026-55957

  • CVE-2026-55957: fix authentication bypass in JNDIRealm GSSAPI bind authentication (High)
Record
CLSA-2026-1783591320
Updated
2026-11-02
OSVCLSA-2026-1783595407 No score

Fix CVE(s): CVE-2026-55956, CVE-2026-55957

  • SECURITY UPDATE: authentication bypass in JNDIRealm with GSSAPI
    • debian/patches/CVE-2026-55957.patch: don't reuse GSSAPI SASL auth when validating user credentials in java/org/apache/catalina/realm/JNDIRealm.java
    • CVE-2026-55957
  • SECURITY UPDATE: default servlet security constraint method bypass
    • debian/patches/CVE-2026-55956.patch: honour per-method constraints mapped to "/" in java/org/apache/catalina/realm/RealmBase.java
    • CVE-2026-55956
Record
CLSA-2026-1783595407
Updated
2026-11-02
OSVCLSA-2026-1783686686 No score

Fix CVE(s): CVE-2026-55956, CVE-2026-55957

  • SECURITY UPDATE: authentication bypass in JNDIRealm with GSSAPI
    • debian/patches/CVE-2026-55957.patch: don't reuse GSSAPI SASL auth when validating user credentials in java/org/apache/catalina/realm/JNDIRealm.java
    • CVE-2026-55957
  • SECURITY UPDATE: default servlet security constraint method bypass
    • debian/patches/CVE-2026-55956.patch: honour per-method constraints mapped to "/" in java/org/apache/catalina/realm/RealmBase.java
    • CVE-2026-55956
Record
CLSA-2026-1783686686
Updated
2026-11-02
OSVCLSA-2026-1784541319 No score

Fix CVE(s): CVE-2026-55957

  • SECURITY UPDATE: JNDIRealm credential validation bypass when configured to use GSSAPI
    • debian/patches/CVE-2026-55957.patch: in bindAsUser preserve the current SASL environment, move userCredentialsAdd inside the try, strip Context.SECURITY_AUTHENTICATION="GSSAPI" before the LDAP bind so the provided username/password are actually validated, and restore the original SASL setting in a finally block along with userCredentialsRemove. Also updates docs/config/realm.xml to document that GSSAPI is skipped for calls made via HttpServletRequest.login(String, String).
    • CVE-2026-55957
Record
CLSA-2026-1784541319
Updated
2026-11-02
OSVCLSA-2026-1785309072 No score

Fix CVE(s): CVE-2026-55957

  • SECURITY UPDATE: JNDIRealm bypass when configured with GSSAPI authentication - HttpServletRequest.login(username, password) calls validated credentials via the GSSAPI SASL mechanism instead of a plain LDAP bind, silently accepting arbitrary passwords
    • debian/patches/CVE-2026-55957.patch: preserve DirContext environment, drop the GSSAPI SECURITY_AUTHENTICATION setting before the user-credential bind, and restore it in a finally block via the existing restoreEnvironmentParameter() helper
    • CVE-2026-55957
Record
CLSA-2026-1785309072
Updated
2026-11-02
OSVCLSA-2026-1786880824 No score

tomcat6: Fix of CVE-2026-55957

  • CVE-2026-55957: tomcat6: JNDIRealm GSSAPI authenticated bind allowed authentication without the correct password
Record
CLSA-2026-1786880824
Updated
2026-11-02
OSVCLSA-2026-1786880926 No score

tomcat6: Fix of CVE-2026-55957

  • CVE-2026-55957: tomcat6: JNDIRealm GSSAPI authenticated bind allowed authentication without the correct password
Record
CLSA-2026-1786880926
Updated
2026-11-02
OSVMGASA-2026-0323 No score

Updated tomcat packages fix security vulnerabilities

The updated packages fix security vulnerabilities: XSS in number guess example. (CVE-2026-50229) Bad ornext processing in RewriteValve. (CVE-2026-53404) Invalid CRL configuration doesn't trigger failure for FFM Connector. (CVE-2026-53434) Logged effective web.xml is incomplete. (CVE-2026-55276) EncryptInterceptor not protected against replay attacks. (CVE-2026-55955) Security constraints for default servlet ignored method. (CVE-2026-55956) Authentication bypass with JNDIRealm and GSSAPI authenticated bind. (CVE-2026-55957)

Record
MGASA-2026-0323
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.0-M1 up to 11.0.5
11.0.5
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.0-M1 up to 10.1.37
10.1.37
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.0.M1 up to 9.0.101
9.0.101
org.apache.tomcat.embed:tomcat-embed-core
Maven
 8.5.0 to 8.5.100 None known
org.apache.tomcat.embed:tomcat-embed-core
Maven
 through 7.0.109 None known
org.apache.tomcat:tomcat
Maven
 11.0.0-M1 up to 11.0.5
11.0.5
org.apache.tomcat:tomcat
Maven
 10.1.0-M1 up to 10.1.37
10.1.37
org.apache.tomcat:tomcat
Maven
 9.0.0.M1 up to 9.0.101
9.0.101
org.apache.tomcat:tomcat
Maven
 8.5.0 to 8.5.100 None known
org.apache.tomcat:tomcat
Maven
 through 7.0.109 None known
Show 265 moreShow less
Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat-catalina
Maven
 11.0.0-M1 up to 11.0.5
11.0.5
org.apache.tomcat:tomcat-catalina
Maven
 10.1.0-M1 up to 10.1.37
10.1.37
org.apache.tomcat:tomcat-catalina
Maven
 9.0.0.M1 up to 9.0.101
9.0.101
org.apache.tomcat:tomcat-catalina
Maven
 8.5.0 to 8.5.100 None known
org.apache.tomcat:tomcat-catalina
Maven
 through 7.0.109 None known
tomcat
AlmaLinux:8
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-admin-webapps
AlmaLinux:8
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-docs-webapp
AlmaLinux:8
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-el-3.0-api
AlmaLinux:8
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-jsp-2.3-api
AlmaLinux:8
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-lib
AlmaLinux:8
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-servlet-4.0-api
AlmaLinux:8
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-webapps
AlmaLinux:8
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat
Bitnami
 before 9.0.101, 10.0.0 up to 10.1.37, 11.0.0 up to 11.0.5
9.0.10110.1.3711.0.5
libservlet3.1-java
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 8.0.32-1ubuntu1.13+tuxcare.els3
8.0.32-1ubuntu1.13+tuxcare.els3
libservlet3.1-java-doc
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 8.0.32-1ubuntu1.13+tuxcare.els3
8.0.32-1ubuntu1.13+tuxcare.els3
libtomcat8-java
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 8.0.32-1ubuntu1.13+tuxcare.els3
8.0.32-1ubuntu1.13+tuxcare.els3
tomcat8
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 8.0.32-1ubuntu1.13+tuxcare.els3
8.0.32-1ubuntu1.13+tuxcare.els3
tomcat8-admin
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 8.0.32-1ubuntu1.13+tuxcare.els3
8.0.32-1ubuntu1.13+tuxcare.els3
tomcat8-common
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 8.0.32-1ubuntu1.13+tuxcare.els3
8.0.32-1ubuntu1.13+tuxcare.els3
tomcat8-docs
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 8.0.32-1ubuntu1.13+tuxcare.els3
8.0.32-1ubuntu1.13+tuxcare.els3
tomcat8-examples
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 8.0.32-1ubuntu1.13+tuxcare.els3
8.0.32-1ubuntu1.13+tuxcare.els3
tomcat8-user
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 8.0.32-1ubuntu1.13+tuxcare.els3
8.0.32-1ubuntu1.13+tuxcare.els3
libtomcat8-embed-java
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els4
8.5.100-1ubuntu1~18.04.1+tuxcare.els4
libtomcat8-java
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els4
8.5.100-1ubuntu1~18.04.1+tuxcare.els4
tomcat8
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els4
8.5.100-1ubuntu1~18.04.1+tuxcare.els4
tomcat8-admin
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els4
8.5.100-1ubuntu1~18.04.1+tuxcare.els4
tomcat8-common
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els4
8.5.100-1ubuntu1~18.04.1+tuxcare.els4
tomcat8-docs
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els4
8.5.100-1ubuntu1~18.04.1+tuxcare.els4
tomcat8-examples
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els4
8.5.100-1ubuntu1~18.04.1+tuxcare.els4
tomcat8-user
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els4
8.5.100-1ubuntu1~18.04.1+tuxcare.els4
tomcat
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:9.0.87-3.el9_6.3.tuxcare.els9
1:9.0.87-3.el9_6.3.tuxcare.els9
tomcat-admin-webapps
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:9.0.87-3.el9_6.3.tuxcare.els9
1:9.0.87-3.el9_6.3.tuxcare.els9
tomcat-docs-webapp
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:9.0.87-3.el9_6.3.tuxcare.els9
1:9.0.87-3.el9_6.3.tuxcare.els9
tomcat-el-3.0-api
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:9.0.87-3.el9_6.3.tuxcare.els9
1:9.0.87-3.el9_6.3.tuxcare.els9
tomcat-jsp-2.3-api
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:9.0.87-3.el9_6.3.tuxcare.els9
1:9.0.87-3.el9_6.3.tuxcare.els9
tomcat-lib
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:9.0.87-3.el9_6.3.tuxcare.els9
1:9.0.87-3.el9_6.3.tuxcare.els9
tomcat-servlet-4.0-api
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:9.0.87-3.el9_6.3.tuxcare.els9
1:9.0.87-3.el9_6.3.tuxcare.els9
tomcat-webapps
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 1:9.0.87-3.el9_6.3.tuxcare.els9
1:9.0.87-3.el9_6.3.tuxcare.els9
tomcat
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els4
1:9.0.62-12.el9_2.1.tuxcare.els4
tomcat-admin-webapps
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els4
1:9.0.62-12.el9_2.1.tuxcare.els4
tomcat-docs-webapp
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els4
1:9.0.62-12.el9_2.1.tuxcare.els4
tomcat-el-3.0-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els4
1:9.0.62-12.el9_2.1.tuxcare.els4
tomcat-jsp-2.3-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els4
1:9.0.62-12.el9_2.1.tuxcare.els4
tomcat-lib
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els4
1:9.0.62-12.el9_2.1.tuxcare.els4
tomcat-servlet-4.0-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els4
1:9.0.62-12.el9_2.1.tuxcare.els4
tomcat-webapps
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-12.el9_2.1.tuxcare.els4
1:9.0.62-12.el9_2.1.tuxcare.els4
tomcat
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els6
7.0.76-16.el7_9.tuxcare.els6
tomcat-admin-webapps
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els6
7.0.76-16.el7_9.tuxcare.els6
tomcat-docs-webapp
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els6
7.0.76-16.el7_9.tuxcare.els6
tomcat-el-2.2-api
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els6
7.0.76-16.el7_9.tuxcare.els6
tomcat-javadoc
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els6
7.0.76-16.el7_9.tuxcare.els6
tomcat-jsp-2.2-api
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els6
7.0.76-16.el7_9.tuxcare.els6
tomcat-jsvc
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els6
7.0.76-16.el7_9.tuxcare.els6
tomcat-lib
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els6
7.0.76-16.el7_9.tuxcare.els6
tomcat-servlet-3.0-api
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els6
7.0.76-16.el7_9.tuxcare.els6
tomcat-webapps
TuxCare:CentOS:7
 before 7.0.76-16.el7_9.tuxcare.els6
7.0.76-16.el7_9.tuxcare.els6
libtomcat9-embed-java
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els17
9.0.16-3ubuntu0.18.04.2+tuxcare.els17
libtomcat9-java
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els17
9.0.16-3ubuntu0.18.04.2+tuxcare.els17
tomcat9
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els17
9.0.16-3ubuntu0.18.04.2+tuxcare.els17
tomcat9-admin
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els17
9.0.16-3ubuntu0.18.04.2+tuxcare.els17
tomcat9-common
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els17
9.0.16-3ubuntu0.18.04.2+tuxcare.els17
tomcat9-docs
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els17
9.0.16-3ubuntu0.18.04.2+tuxcare.els17
tomcat9-examples
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els17
9.0.16-3ubuntu0.18.04.2+tuxcare.els17
tomcat9-user
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els17
9.0.16-3ubuntu0.18.04.2+tuxcare.els17
libservlet3.0-java
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 7.0.68-1ubuntu0.4+tuxcare.els9
7.0.68-1ubuntu0.4+tuxcare.els9
libservlet3.0-java-doc
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 7.0.68-1ubuntu0.4+tuxcare.els9
7.0.68-1ubuntu0.4+tuxcare.els9
libtomcat7-java
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 7.0.68-1ubuntu0.4+tuxcare.els9
7.0.68-1ubuntu0.4+tuxcare.els9
tomcat7
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 7.0.68-1ubuntu0.4+tuxcare.els9
7.0.68-1ubuntu0.4+tuxcare.els9
tomcat7-admin
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 7.0.68-1ubuntu0.4+tuxcare.els9
7.0.68-1ubuntu0.4+tuxcare.els9
tomcat7-common
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 7.0.68-1ubuntu0.4+tuxcare.els9
7.0.68-1ubuntu0.4+tuxcare.els9
tomcat7-docs
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 7.0.68-1ubuntu0.4+tuxcare.els9
7.0.68-1ubuntu0.4+tuxcare.els9
tomcat7-examples
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 7.0.68-1ubuntu0.4+tuxcare.els9
7.0.68-1ubuntu0.4+tuxcare.els9
tomcat7-user
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 7.0.68-1ubuntu0.4+tuxcare.els9
7.0.68-1ubuntu0.4+tuxcare.els9
libtomcat9-embed-java
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els5
9.0.31-1ubuntu0.9+tuxcare.els5
libtomcat9-java
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els5
9.0.31-1ubuntu0.9+tuxcare.els5
tomcat9
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els5
9.0.31-1ubuntu0.9+tuxcare.els5
tomcat9-admin
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els5
9.0.31-1ubuntu0.9+tuxcare.els5
tomcat9-common
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els5
9.0.31-1ubuntu0.9+tuxcare.els5
tomcat9-docs
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els5
9.0.31-1ubuntu0.9+tuxcare.els5
tomcat9-examples
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els5
9.0.31-1ubuntu0.9+tuxcare.els5
tomcat9-user
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els5
9.0.31-1ubuntu0.9+tuxcare.els5
libtomcat9-embed-java
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els6
9.0.31-1~deb10u12+tuxcare.els6
libtomcat9-java
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els6
9.0.31-1~deb10u12+tuxcare.els6
tomcat9
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els6
9.0.31-1~deb10u12+tuxcare.els6
tomcat9-admin
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els6
9.0.31-1~deb10u12+tuxcare.els6
tomcat9-common
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els6
9.0.31-1~deb10u12+tuxcare.els6
tomcat9-docs
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els6
9.0.31-1~deb10u12+tuxcare.els6
tomcat9-examples
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els6
9.0.31-1~deb10u12+tuxcare.els6
tomcat9-user
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els6
9.0.31-1~deb10u12+tuxcare.els6
tomcat6
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-admin-webapps
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-docs-webapp
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-el-2.1-api
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-javadoc
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-jsp-2.1-api
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-lib
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-servlet-2.5-api
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-webapps
TuxCare:OracleLinux:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-admin-webapps
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-docs-webapp
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-el-2.1-api
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-javadoc
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-jsp-2.1-api
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-lib
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-servlet-2.5-api
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat6-webapps
TuxCare:CentOS:6
 before 6.0.24-115.el6_10.tuxcare.els3
6.0.24-115.el6_10.tuxcare.els3
tomcat10
Debian:12
 before 10.1.52-1~deb12u1, plus listed versions
10.1.10-110.1.13-110.1.14-110.1.15-110.1.16-1
Show 23 moreShow less
10.1.20-110.1.23-110.1.25-110.1.25-1~bpo12+110.1.25-210.1.30-110.1.30-1~bpo12+110.1.31-110.1.33-110.1.33-1~bpo12+110.1.34-0+deb12u110.1.34-0+deb12u210.1.34-110.1.35-110.1.40-110.1.40-1~bpo12+110.1.46-110.1.6-110.1.6-1+deb12u110.1.6-1+deb12u210.1.7-110.1.8-110.1.9-1
10.1.52-1~deb12u1
tomcat10
Debian:13
 before 10.1.52-1~deb13u1, plus listed versions
10.1.40-110.1.46-110.1.52-1~deb12u1
10.1.52-1~deb13u1
tomcat10
Debian:14
 before 10.1.40-1
10.1.40-1
tomcat11
Debian:13
 before 11.0.15-1~deb13u1, plus listed versions
11.0.11-111.0.6-1
11.0.15-1~deb13u1
tomcat11
Debian:14
 before 11.0.5-1
11.0.5-1
tomcat9
Debian:12
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:13
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:14
 before 9.0.70-2
9.0.70-2
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.0-M1 up to 11.0.5, plus listed versions
11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13
Show 22 moreShow less
11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.211.0.311.0.4
11.0.5
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.0-M1 up to 10.1.37, plus listed versions
10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14
Show 40 moreShow less
10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.410.1.510.1.610.1.710.1.810.1.9
10.1.37
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.0.M1 up to 9.0.101, plus listed versions
9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17
Show 45 moreShow less
9.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.1009.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.49.0.409.0.419.0.439.0.44
9.0.101
org.apache.tomcat.embed:tomcat-embed-core
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
org.apache.tomcat.embed:tomcat-embed-core
Maven
 through 7.0.109, plus listed versions
7.0.07.0.1007.0.1037.0.1047.0.105
Show 45 moreShow less
7.0.1067.0.1077.0.1087.0.117.0.127.0.147.0.167.0.197.0.27.0.207.0.217.0.227.0.237.0.257.0.267.0.277.0.287.0.297.0.307.0.327.0.337.0.347.0.357.0.377.0.397.0.47.0.407.0.417.0.427.0.477.0.57.0.507.0.527.0.537.0.547.0.557.0.567.0.577.0.597.0.67.0.617.0.627.0.637.0.647.0.65
 None known
org.apache.tomcat:tomcat
Maven
 11.0.0-M1 up to 11.0.5, plus listed versions
11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13
Show 22 moreShow less
11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.211.0.311.0.4
11.0.5
org.apache.tomcat:tomcat
Maven
 10.1.0-M1 up to 10.1.37, plus listed versions
10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14
Show 40 moreShow less
10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.410.1.510.1.610.1.710.1.810.1.9
10.1.37
org.apache.tomcat:tomcat
Maven
 9.0.0.M1 up to 9.0.101, plus listed versions
9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17
Show 45 moreShow less
9.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.1009.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.49.0.409.0.419.0.439.0.44
9.0.101
org.apache.tomcat:tomcat
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
org.apache.tomcat:tomcat
Maven
 through 7.0.109, plus listed versions
7.0.1007.0.1037.0.1047.0.1057.0.106
Show 45 moreShow less
7.0.1077.0.1087.0.357.0.377.0.397.0.407.0.417.0.427.0.477.0.507.0.527.0.537.0.547.0.557.0.567.0.577.0.597.0.617.0.627.0.637.0.647.0.657.0.677.0.687.0.697.0.707.0.727.0.737.0.757.0.767.0.777.0.787.0.797.0.817.0.827.0.847.0.857.0.867.0.887.0.907.0.917.0.927.0.937.0.947.0.96
 None known
org.apache.tomcat:tomcat-catalina
Maven
 11.0.0-M1 up to 11.0.5, plus listed versions
11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13
Show 22 moreShow less
11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.211.0.311.0.4
11.0.5
org.apache.tomcat:tomcat-catalina
Maven
 10.1.0-M1 up to 10.1.37, plus listed versions
10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14
Show 40 moreShow less
10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.410.1.510.1.610.1.710.1.810.1.9
10.1.37
org.apache.tomcat:tomcat-catalina
Maven
 9.0.0.M1 up to 9.0.101, plus listed versions
9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17
Show 45 moreShow less
9.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.1009.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.49.0.409.0.419.0.439.0.44
9.0.101
org.apache.tomcat:tomcat-catalina
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
org.apache.tomcat:tomcat-catalina
Maven
 through 7.0.109, plus listed versions
7.0.07.0.1007.0.1037.0.1047.0.105
Show 45 moreShow less
7.0.1067.0.1077.0.1087.0.117.0.127.0.147.0.167.0.197.0.27.0.207.0.217.0.227.0.237.0.257.0.267.0.277.0.287.0.297.0.307.0.327.0.337.0.347.0.357.0.377.0.397.0.47.0.407.0.417.0.427.0.477.0.57.0.507.0.527.0.537.0.547.0.557.0.567.0.577.0.597.0.67.0.617.0.627.0.637.0.647.0.65
 None known
tomcat
Mageia:10
From an advisory covering 7 CVEs
 before 9.0.119-1.mga10
9.0.119-1.mga10
tomcat
Mageia:9
From an advisory covering 7 CVEs
 before 9.0.119-1.mga9
9.0.119-1.mga9
tomcat
openEuler:20.03-LTS-SP4
From an advisory covering 7 CVEs
 before 9.0.119-1.oe2003sp4
9.0.119-1.oe2003sp4
tomcat
openEuler:22.03-LTS-SP4
From an advisory covering 7 CVEs
 before 9.0.119-1.oe2203sp4
9.0.119-1.oe2203sp4
tomcat
openEuler:24.03-LTS-SP1
From an advisory covering 7 CVEs
 before 9.0.119-1.oe2403sp1
9.0.119-1.oe2403sp1
tomcat
openEuler:24.03-LTS-SP3
From an advisory covering 7 CVEs
 before 9.0.119-1.oe2403sp3
9.0.119-1.oe2403sp3
tomcat9
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el10_2
1:9.0.110-2.el10_2
tomcat9-admin-webapps
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el10_2
1:9.0.110-2.el10_2
tomcat9-docs-webapp
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el10_2
1:9.0.110-2.el10_2
tomcat9-el-3.0-api
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el10_2
1:9.0.110-2.el10_2
tomcat9-jsp-2.3-api
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el10_2
1:9.0.110-2.el10_2
tomcat9-lib
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el10_2
1:9.0.110-2.el10_2
tomcat9-servlet-4.0-api
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el10_2
1:9.0.110-2.el10_2
tomcat9-webapps
Red Hat:enterprise_linux:10.2
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el10_2
1:9.0.110-2.el10_2
tomcat
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 1:10.1.49-1.el10
1:10.1.49-1.el10
tomcat-admin-webapps
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 1:10.1.49-1.el10
1:10.1.49-1.el10
tomcat-docs-webapp
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 1:10.1.49-1.el10
1:10.1.49-1.el10
tomcat-el-5.0-api
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 1:10.1.49-1.el10
1:10.1.49-1.el10
tomcat-jsp-3.1-api
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 1:10.1.49-1.el10
1:10.1.49-1.el10
tomcat-lib
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 1:10.1.49-1.el10
1:10.1.49-1.el10
tomcat-servlet-6.0-api
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 1:10.1.49-1.el10
1:10.1.49-1.el10
tomcat-webapps
Red Hat:enterprise_linux:10.2
From an advisory covering 5 CVEs
 before 1:10.1.49-1.el10
1:10.1.49-1.el10
tomcat
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el9_8
1:9.0.110-2.el9_8
tomcat-admin-webapps
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el9_8
1:9.0.110-2.el9_8
tomcat-docs-webapp
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el9_8
1:9.0.110-2.el9_8
tomcat-el-3.0-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el9_8
1:9.0.110-2.el9_8
tomcat-jsp-2.3-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el9_8
1:9.0.110-2.el9_8
tomcat-lib
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el9_8
1:9.0.110-2.el9_8
tomcat-servlet-4.0-api
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el9_8
1:9.0.110-2.el9_8
tomcat-webapps
Red Hat:enterprise_linux:9::appstream
From an advisory covering 7 CVEs
 before 1:9.0.110-2.el9_8
1:9.0.110-2.el9_8
tomcat10
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:10.1.56-1.hum1
0:10.1.56-1.hum1
tomcat10-admin-webapps
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:10.1.56-1.hum1
0:10.1.56-1.hum1
tomcat10-common
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:10.1.56-1.hum1
0:10.1.56-1.hum1
tomcat10-docs-webapp
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:10.1.56-1.hum1
0:10.1.56-1.hum1
tomcat10-el-5.0-api
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:10.1.56-1.hum1
0:10.1.56-1.hum1
tomcat10-jsp-3.1-api
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:10.1.56-1.hum1
0:10.1.56-1.hum1
tomcat10-lib
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:10.1.56-1.hum1
0:10.1.56-1.hum1
tomcat10-servlet-6.0-api
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:10.1.56-1.hum1
0:10.1.56-1.hum1
tomcat10-user-instance
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:10.1.56-1.hum1
0:10.1.56-1.hum1
tomcat10-webapps
Red Hat:hummingbird:1
From an advisory covering 6 CVEs
 before 0:10.1.56-1.hum1
0:10.1.56-1.hum1
tomcat11
Red Hat:hummingbird:1
From an advisory covering 7 CVEs
 before 0:11.0.23-0.1.hum1
0:11.0.23-0.1.hum1
tomcat11-admin-webapps
Red Hat:hummingbird:1
From an advisory covering 7 CVEs
 before 0:11.0.23-0.1.hum1
0:11.0.23-0.1.hum1
tomcat11-common
Red Hat:hummingbird:1
From an advisory covering 7 CVEs
 before 0:11.0.23-0.1.hum1
0:11.0.23-0.1.hum1
tomcat11-docs-webapp
Red Hat:hummingbird:1
From an advisory covering 7 CVEs
 before 0:11.0.23-0.1.hum1
0:11.0.23-0.1.hum1
tomcat11-el-6.0-api
Red Hat:hummingbird:1
From an advisory covering 7 CVEs
 before 0:11.0.23-0.1.hum1
0:11.0.23-0.1.hum1
tomcat11-jsp-4.0-api
Red Hat:hummingbird:1
From an advisory covering 7 CVEs
 before 0:11.0.23-0.1.hum1
0:11.0.23-0.1.hum1
tomcat11-lib
Red Hat:hummingbird:1
From an advisory covering 7 CVEs
 before 0:11.0.23-0.1.hum1
0:11.0.23-0.1.hum1
tomcat11-servlet-6.1-api
Red Hat:hummingbird:1
From an advisory covering 7 CVEs
 before 0:11.0.23-0.1.hum1
0:11.0.23-0.1.hum1
tomcat11-user-instance
Red Hat:hummingbird:1
From an advisory covering 7 CVEs
 before 0:11.0.23-0.1.hum1
0:11.0.23-0.1.hum1
tomcat11-webapps
Red Hat:hummingbird:1
From an advisory covering 7 CVEs
 before 0:11.0.23-0.1.hum1
0:11.0.23-0.1.hum1
tomcat9
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-admin-webapps
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-docs-webapp
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-el-3.0-api
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-jsp-2.3-api
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-lib
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-servlet-4.0-api
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-webapps
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:10.1.49-1.el10_0
1:10.1.49-1.el10_0
tomcat-admin-webapps
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:10.1.49-1.el10_0
1:10.1.49-1.el10_0
tomcat-docs-webapp
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:10.1.49-1.el10_0
1:10.1.49-1.el10_0
tomcat-el-5.0-api
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:10.1.49-1.el10_0
1:10.1.49-1.el10_0
tomcat-jsp-3.1-api
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:10.1.49-1.el10_0
1:10.1.49-1.el10_0
tomcat-lib
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:10.1.49-1.el10_0
1:10.1.49-1.el10_0
tomcat-servlet-6.0-api
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:10.1.49-1.el10_0
1:10.1.49-1.el10_0
tomcat-webapps
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 7 CVEs
 before 1:10.1.49-1.el10_0
1:10.1.49-1.el10_0
tomcat
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-admin-webapps
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-docs-webapp
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-el-3.0-api
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-jsp-2.3-api
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-lib
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-servlet-4.0-api
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-webapps
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat
Red Hat:enterprise_linux:8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-admin-webapps
Red Hat:enterprise_linux:8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-docs-webapp
Red Hat:enterprise_linux:8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-el-3.0-api
Red Hat:enterprise_linux:8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-jsp-2.3-api
Red Hat:enterprise_linux:8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-lib
Red Hat:enterprise_linux:8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-servlet-4.0-api
Red Hat:enterprise_linux:8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-webapps
Red Hat:enterprise_linux:8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_2
1:9.0.120-1.el9_2
tomcat-admin-webapps
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_2
1:9.0.120-1.el9_2
tomcat-docs-webapp
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_2
1:9.0.120-1.el9_2
tomcat-el-3.0-api
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_2
1:9.0.120-1.el9_2
tomcat-jsp-2.3-api
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_2
1:9.0.120-1.el9_2
tomcat-lib
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_2
1:9.0.120-1.el9_2
tomcat-servlet-4.0-api
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_2
1:9.0.120-1.el9_2
tomcat-webapps
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_2
1:9.0.120-1.el9_2
tomcat
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_4
1:9.0.120-1.el9_4
tomcat-admin-webapps
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_4
1:9.0.120-1.el9_4
tomcat-docs-webapp
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_4
1:9.0.120-1.el9_4
tomcat-el-3.0-api
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_4
1:9.0.120-1.el9_4
tomcat-jsp-2.3-api
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_4
1:9.0.120-1.el9_4
tomcat-lib
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_4
1:9.0.120-1.el9_4
tomcat-servlet-4.0-api
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_4
1:9.0.120-1.el9_4
tomcat-webapps
Red Hat:rhel_e4s:9.4::appstream
From an advisory covering 30 CVEs
 before 1:9.0.120-1.el9_4
1:9.0.120-1.el9_4
tomcat
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-admin-webapps
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-docs-webapp
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-el-3.0-api
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-jsp-2.3-api
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-lib
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-servlet-4.0-api
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-webapps
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-admin-webapps
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-docs-webapp
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-el-3.0-api
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-jsp-2.3-api
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-lib
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-servlet-4.0-api
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat-webapps
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 29 CVEs
 before 1:9.0.120-1.el8_8
1:9.0.120-1.el8_8
tomcat
Rocky Linux:8
From an advisory covering 8 CVEs
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat6
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
6.0.37-16.0.39-16.0.39-1ubuntu0.16.0.39-1ubuntu0.1+esm16.0.39-1ubuntu0.1+esm26.0.39-1ubuntu0.1+esm3
 None known
tomcat7
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
7.0.42-17.0.47-17.0.50-17.0.52-17.0.52-1ubuntu0.1
Show 13 moreShow less
7.0.52-1ubuntu0.37.0.52-1ubuntu0.67.0.52-1ubuntu0.77.0.52-1ubuntu0.87.0.52-1ubuntu0.97.0.52-1ubuntu0.107.0.52-1ubuntu0.117.0.52-1ubuntu0.137.0.52-1ubuntu0.147.0.52-1ubuntu0.157.0.52-1ubuntu0.167.0.52-1ubuntu0.16+esm17.0.52-1ubuntu0.16+esm2
 None known
tomcat8
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
8.0.26-18.0.28-18.0.30-18.0.32-18.0.32-1ubuntu1
Show 14 moreShow less
8.0.32-1ubuntu1.18.0.32-1ubuntu1.28.0.32-1ubuntu1.38.0.32-1ubuntu1.48.0.32-1ubuntu1.58.0.32-1ubuntu1.68.0.32-1ubuntu1.78.0.32-1ubuntu1.88.0.32-1ubuntu1.98.0.32-1ubuntu1.108.0.32-1ubuntu1.118.0.32-1ubuntu1.138.0.32-1ubuntu1.13+esm18.0.32-1ubuntu1.13+esm2
 None known
tomcat7
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
7.0.64-17.0.68-17.0.68-1ubuntu0.17.0.68-1ubuntu0.37.0.68-1ubuntu0.4
Show 4 moreShow less
7.0.68-1ubuntu0.4+esm17.0.68-1ubuntu0.4+esm27.0.68-1ubuntu0.4+esm37.0.68-1ubuntu0.4+esm4
 None known
tomcat8
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
8.5.21-1ubuntu18.5.29-18.5.30-18.5.30-1ubuntu18.5.30-1ubuntu1.2
Show 11 moreShow less
8.5.30-1ubuntu1.38.5.30-1ubuntu1.48.5.39-1ubuntu1~18.04.18.5.39-1ubuntu1~18.04.28.5.39-1ubuntu1~18.04.38.5.39-1ubuntu1~18.04.3+esm18.5.39-1ubuntu1~18.04.3+esm28.5.39-1ubuntu1~18.04.3+esm38.5.39-1ubuntu1~18.04.3+esm48.5.39-1ubuntu1~18.04.3+esm58.5.39-1ubuntu1~18.04.3+esm6
 None known
tomcat9
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
9.0.16-3~18.04.19.0.16-3ubuntu0.18.04.19.0.16-3ubuntu0.18.04.29.0.16-3ubuntu0.18.04.2+esm19.0.16-3ubuntu0.18.04.2+esm2
Show 6 moreShow less
9.0.16-3ubuntu0.18.04.2+esm39.0.16-3ubuntu0.18.04.2+esm49.0.16-3ubuntu0.18.04.2+esm59.0.16-3ubuntu0.18.04.2+esm69.0.16-3ubuntu0.18.04.2+esm79.0.16-3ubuntu0.18.04.2+esm8
 None known
tomcat9
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
9.0.24-19.0.27-19.0.31-19.0.31-1ubuntu0.19.0.31-1ubuntu0.2
Show 10 moreShow less
9.0.31-1ubuntu0.39.0.31-1ubuntu0.49.0.31-1ubuntu0.59.0.31-1ubuntu0.69.0.31-1ubuntu0.79.0.31-1ubuntu0.89.0.31-1ubuntu0.99.0.31-1ubuntu0.9+esm19.0.31-1ubuntu0.9+esm29.0.31-1ubuntu0.9+esm3
 None known
tomcat9
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
9.0.43-39.0.54-19.0.55-19.0.58-19.0.58-1ubuntu0.1
Show 9 moreShow less
9.0.58-1ubuntu0.1+esm19.0.58-1ubuntu0.1+esm29.0.58-1ubuntu0.1+esm39.0.58-1ubuntu0.1+esm49.0.58-1ubuntu0.29.0.58-1ubuntu0.2+esm19.0.58-1ubuntu0.2+esm29.0.58-1ubuntu0.2+esm39.0.58-1ubuntu0.2+esm4
 None known
tomcat10
Ubuntu:24.04:LTS
 All versions, plus listed versions
10.1.10-110.1.14-110.1.15-110.1.16-110.1.16-1ubuntu0.1~esm1
Show 4 moreShow less
10.1.16-1ubuntu0.1~esm210.1.16-1ubuntu0.1~esm310.1.16-1ubuntu0.1~esm410.1.55-1ubuntu2~24.04.1
 None known
tomcat9
Ubuntu:24.04:LTS
 All versions, plus listed versions
9.0.70-1ubuntu19.0.70-29.0.70-2ubuntu0.19.0.70-2ubuntu0.1+esm19.0.70-2ubuntu0.1+esm29.0.70-2ubuntu0.1+esm39.0.118-1~24.04.1
 None known
tomcat10
Ubuntu:25.10
 All versions, plus listed versions
10.1.35-110.1.40-110.1.40-1ubuntu110.1.40-1ubuntu1.25.10.1
 None known
tomcat11
Ubuntu:25.10
 All versions, plus listed versions
11.0.6-1
 None known
tomcat9
Ubuntu:25.10
 All versions, plus listed versions
9.0.70-2ubuntu1.19.0.70-2ubuntu29.0.70-2ubuntu39.0.95-1ubuntu19.0.95-1ubuntu1.1
 None known
tomcat10
Ubuntu:26.10
 All versions, plus listed versions
10.1.40-1ubuntu110.1.54-110.1.54-1ubuntu110.1.54-1ubuntu210.1.55-1ubuntu110.1.55-1ubuntu210.1.57~us1-0ubuntu1
 None known
tomcat11
Ubuntu:26.10
 All versions, plus listed versions
11.0.18-111.0.22-211.0.22-2ubuntu111.0.22-2ubuntu211.0.24-1ubuntu1
 None known
tomcat9
Ubuntu:26.10
 All versions, plus listed versions
9.0.115-19.0.115-1ubuntu19.0.118-1
 None known
tomcat10
Ubuntu:26.04:LTS
 All versions, plus listed versions
10.1.40-1ubuntu110.1.40-1ubuntu1.26.04.110.1.55-1ubuntu2~26.04.1
 None known
tomcat9
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.0.95-1ubuntu19.0.111-19.0.115-19.0.115-1ubuntu0.19.0.118-1~26.04.1
 None known
tomcat11
Ubuntu:26.04:LTS
 All versions, plus listed versions
11.0.6-111.0.11-111.0.15-111.0.18-111.0.18-1ubuntu0.1~esm111.0.22-2ubuntu2~26.04.1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubmdvpat/CVE-2026-55957-PoC2026-08-07

History

History
RecordedChangedSources
affectedOSV
affected, referencesOSV
affected, facts, referencesGitHub Advisories
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-55957 is a high vulnerability (CVSS 7.3) in Apache Tomcat, published May 19, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.85%, the 86th percentile. Fixed in org.apache.tomcat.embed:tomcat-embed-core 11.0.5.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 303 versions and 68 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open