Every CVE Search/ Get API key

CVE-2025-66614

Apache Tomcat: Client certificate verification bypass due to virtual host mapping

9.1 CriticalFix available

Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.27%Up 0.3 points since Feb 18, 2026
90%50%10%1%

What each source reports

NVD Score used 9.1

Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.

Record
CVE-2025-66614
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-20, CWE-295
Updated
2026-11-02
CVE List 7.6

Apache Tomcat: Client certificate verification bypass due to virtual host mapping

Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.

Record
CVE-2025-66614
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2025-207697 7.6

Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.

Record
EUVD-2025-207697
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-fpj8-gq4v-p354 6.3

Apache Tomcat - Client certificate verification bypass

Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.

Record
GHSA-fpj8-gq4v-p354
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-20, CWE-295
Updated
2026-11-02
OSV 7.6

Apache Tomcat: Client certificate verification bypass due to virtual host mapping

Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.

Record
CVE-2025-66614
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Weakness
CWE-20
Updated
2026-11-02
OSVDEBIAN-CVE-2025-66614 9.1

Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field. The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.

Record
DEBIAN-CVE-2025-66614
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 46 moreShow less
OSVGHSA-fpj8-gq4v-p354 6.3

Apache Tomcat - Client certificate verification bypass

Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.

Record
GHSA-fpj8-gq4v-p354
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-20, CWE-295
Updated
2026-11-02
OSVOESA-2026-1651 9.1

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.(CVE-2025-66614)

Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.(CVE-2026-24733)

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.

The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.(CVE-2026-24734)

Record
OESA-2026-1651
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:12194 7.3

Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.2 release and security update

Record
RHSA-2026:12194
CVSS 3.1
7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:26323 7.4

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:26323
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:6569 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:6569
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:67163 7.5

Red Hat Security Advisory: tomcat9 security update

Record
RHSA-2026:67163
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:68659 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:68659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:68677 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:68677
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:68678 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:68678
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:68679 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:68679
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:68680 7.5

Red Hat Security Advisory: tomcat security update

Record
RHSA-2026:68680
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8334 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:8334
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:25341 7.4

Important: tomcat9 security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)

  • tomcat: Client certificate verification bypass due to virtual host mapping (CVE-2025-66614)

  • tomcat: security constraint bypass with HTTP/0.9 (CVE-2026-24733)

  • Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration (CVE-2026-29145)

  • Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files (CVE-2026-34487)

  • Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve (CVE-2026-25854)

  • Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension (CVE-2026-24880)

  • Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration (CVE-2026-34500)

  • Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve (CVE-2026-34483)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:25341
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-66614 9.1

CVE-2025-66614 in io.root.org.apache.tomcat:tomcat-catalina - Patched by Root

Root has patched CVE-2025-66614 in the io.root.org.apache.tomcat:tomcat-catalina package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2025-66614
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-66614 9.1

Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field. The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application. Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.

Record
UBUNTU-CVE-2025-66614
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Updated
2026-11-02
OSVALSA-2026:25341 No score

Important: tomcat9 update

Certificate revocation bypass due to improper OCSP response validation

Record
ALSA-2026:25341
Updated
2026-11-02
OSVALSA-2026:26323 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:26323
Updated
2026-11-02
OSVALSA-2026:36790 No score

Important: tomcat9 security, bug fix, and enhancement update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

  • Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)
  • Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

  • Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-185571)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:36790
Updated
2026-11-02
OSVALSA-2026:68677 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

  • tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
  • tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
  • tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
  • tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
  • tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
  • tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)
  • tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
  • tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:68677
Updated
2026-11-02
OSVBIT-tomcat-2025-66614 No score

Apache Tomcat: Client certificate verification bypass due to virtual host mapping

Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.14, from 10.1.0 through 10.1.49, from 9.0.0 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.

Record
BIT-tomcat-2025-66614
Updated
2026-11-02
OSVCLSA-2026-1773941493 No score

Fix CVE(s): CVE-2025-66614

  • SECURITY UPDATE: Improper Input Validation vulnerability
    • debian/patches/CVE-2025-66614.patch: Add protocol host name and SNI host name matching with strictSNI attribute on the Connector. Covers NIO, NIO2, and APR connectors.
    • CVE-2025-66614
Record
CLSA-2026-1773941493
Updated
2026-11-02
OSVCLSA-2026-1774261838 No score

tomcat: Fix of 2 CVEs

  • CVE-2025-66614: add protocol host name and SNI host name matching
Record
CLSA-2026-1774261838
Updated
2026-11-02
OSVCLSA-2026-1774426919 No score

Fix CVE(s): CVE-2025-66614

  • SECURITY UPDATE: SNI hostname not stored for NIO2 and APR connectors
    • debian/patches/CVE-2025-66614.patch: store SNI hostname for NIO2 and APR connections so that SNI checks are not bypassed
    • CVE-2025-66614
Record
CLSA-2026-1774426919
Updated
2026-11-02
OSVCLSA-2026-1774431936 No score

tomcat: Fix of CVE-2025-66614

  • CVE-2025-66614: enforce SNI and HTTP Host header matching to prevent bypass of client certificate authentication when multiple virtual hosts are configured
Record
CLSA-2026-1774431936
Updated
2026-11-02
OSVCLSA-2026-1774460133 No score

Fix CVE(s): CVE-2025-66614

  • SECURITY UPDATE: client certificate authentication bypass through mismatched SNI and HTTP Host header
    • debian/patches/CVE-2025-66614.patch: Add strictSNI connector attribute and implement SNI/protocol host name matching for NIO, NIO2, and APR connectors; prevent requests being served by mismatched SSLHostConfig when SNI host and HTTP Host header differ.
    • CVE-2025-66614
  • Fix ObjectStreamClass cache clearing for JDK 11.0.16+
    • debian/patches/fix-ObjectStreamClass-cache-clearing.patch: Use instanceof guard in WebappClassLoaderBase.clearCache() instead of direct cast to Map, fixing ClassCastException with newer JDK where ObjectStreamClass$Caches fields were changed from Map to ClassValue (JDK-8277072).
  • Regenerate expired test SSL certificates
    • debian/test_certs/: Regenerated ca.jks, localhost.jks, localhost-copy1.jks, user1.jks and PEM files. The user1 certificate expired on 2025-08-15, causing TestClientCert SSLHandshakeException failures.
  • Fix flaky test infrastructure on build farm
    • debian/patches/fix-test-hostname-resolution.patch: Skip TestStandardSessionIntegration, TestGroupChannelSenderConnections, TestGroupChannelStartStop, and TestGroupChannelOptionFlag when build node hostname cannot be resolved via DNS (UnknownHostException).
    • debian/patches/CVE-2025-66614.patch: Skip testSni on APR connector since it uses JSSE-style SSLHostConfig incompatible with OpenSSL backend.
Record
CLSA-2026-1774460133
Updated
2026-11-02
OSVCLSA-2026-1775003157 No score

TuxCare security update for 3 packages (2 CVEs)

TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.0.90-tuxcare.4.

Record
CLSA-2026-1775003157
Updated
2026-11-02
OSVCLSA-2026-1775003195 No score

TuxCare security update for 3 packages (2 CVEs)

TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.0.83-tuxcare.3.

Record
CLSA-2026-1775003195
Updated
2026-11-02
OSVCLSA-2026-1776386118 No score

TuxCare security update for 4 packages (4 CVEs)

TuxCare rebuilt 4 packages to address 4 CVEs. Fixed in 10.1.42-tuxcare.2.

Record
CLSA-2026-1776386118
Updated
2026-11-02
OSVCLSA-2026-1776818211 No score

TuxCare security update for 3 packages (1 CVE)

TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 8.5.100-tuxcare.8.

Record
CLSA-2026-1776818211
Updated
2026-11-02
OSVCLSA-2026-1777163890 No score

TuxCare security update for 3 packages (2 CVEs)

TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.0.100-tuxcare.6.

Record
CLSA-2026-1777163890
Updated
2026-11-02
OSVCLSA-2026-1777250294 No score

TuxCare security update for 5 packages (2 CVEs)

TuxCare rebuilt 5 packages to address 2 CVEs. Fixed in 9.0.46-tuxcare.6.

Record
CLSA-2026-1777250294
Updated
2026-11-02
OSVCLSA-2026-1777336750 No score

TuxCare security update for 3 packages (1 CVE)

TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 9.0.50-tuxcare.9.

Record
CLSA-2026-1777336750
Updated
2026-11-02
OSVCLSA-2026-1792575257 No score

TuxCare security update for 8 packages (32 CVEs)

TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.

Record
CLSA-2026-1792575257
Updated
2026-11-02
OSVCLSA-2026-1792667085 No score

TuxCare security update for 7 packages (24 CVEs)

TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.

Record
CLSA-2026-1792667085
Updated
2026-11-02
OSVCLSA-2026-1792687888 No score

TuxCare security update for 4 packages (7 CVEs)

TuxCare rebuilt 4 packages to address 7 CVEs. Fixed in 10.1.18-tuxcare.8.

Record
CLSA-2026-1792687888
Updated
2026-11-02
OSVCLSA-2026-1792692686 No score

TuxCare security update for 5 packages (15 CVEs)

TuxCare rebuilt 5 packages to address 15 CVEs. Fixed in 10.1.16-tuxcare.1.

Record
CLSA-2026-1792692686
Updated
2026-11-02
OSVCLSA-2026-1793011037 No score

TuxCare security update for 5 packages (26 CVEs)

TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.

Record
CLSA-2026-1793011037
Updated
2026-11-02
OSVCLSA-2026-1793011786 No score

TuxCare security update for 7 packages (22 CVEs)

TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.

Record
CLSA-2026-1793011786
Updated
2026-11-02
OSVCLSA-2026-1793727391 No score

TuxCare security update for 5 packages (8 CVEs)

TuxCare rebuilt 5 packages to address 8 CVEs. Fixed in 10.1.33-tuxcare.3.

Record
CLSA-2026-1793727391
Updated
2026-11-04
OSVMGASA-2026-0056 No score

Updated tomcat packages fix security vulnerabilities

Client certificate verification bypass due to virtual host mapping. (CVE-2025-66614) Security constraint bypass with HTTP/0.9. (CVE-2026-24733) OCSP revocation bypass. (CVE-2026-24734)

Record
MGASA-2026-0056
Updated
2026-11-02
OSVopenSUSE-SU-2026:10305-1 No score

tomcat-9.0.115-1.1 on GA media

These are all security issues fixed in the tomcat-9.0.115-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10305-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10306-1 No score

tomcat10-10.1.52-1.1 on GA media

These are all security issues fixed in the tomcat10-10.1.52-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10306-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10307-1 No score

tomcat11-11.0.18-1.1 on GA media

These are all security issues fixed in the tomcat11-11.0.18-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10307-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20350-1 No score

Security update for tomcat

This update for tomcat fixes the following issues:

Update to Tomcat 9.0.115:

  • CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
  • CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
  • CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).
  • Catalina
  • Fix: 69623: Additional fix for the long standing regression that meant that calls to ClassLoader.getResource().getContent() failed when made from within a web application with resource caching enabled if the target resource was packaged in a JAR file. (markt)
  • Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the CsrfPreventionFilter. (schultz)
  • Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2 requests when the content-length header is not set. (dsoumis)
  • Update: Update the minimum and recommended versions for Tomcat Native to 1.3.4. (markt)
  • Add: Add a new ssoReauthenticationMode to the Tomcat provided Authenticators that provides a per Authenticator override of the SSO Valve requireReauthentication attribute. (markt)
  • Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception rather than silently using a replacement character. (markt)
  • Fix: 69871: Increase log level to INFO for missing configuration for the rewrite valve. (remm)
  • Fix: Add log warnings for additional Host appBase suspicious values. (remm)
  • Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar. org.apache.catalina.Connector no longer requires org.apache.tomcat.jni.AprStatus to be present. (markt)
  • Add: Add the ability to use a custom function to generate the client identifier in the CrawlerSessionManagerValve. This is only available programmatically. Pull request #902 by Brian Matzon. (markt)
  • Fix: Change the SSO reauthentication behaviour for SPNEGO authentication so that a normal SPNEGO authentication is performed if the SSL Valve is configured with reauthentication enabled. This is so that the delegated credentials will be available to the web application. (markt)
  • Fix: When generating the class path in the Loader, re-order the check on individual class path components to avoid a potential NullPointerException. Identified by Coverity Scan. (markt)
  • Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull request #915 by Joshua Rogers. (remm)
  • Update: Add an attribute, digestInRfc3112Order, to MessageDigestCredentialHandler to control the order in which the credential and salt are digested. By default, the current, non-RFC 3112 compliant, order of salt then credential will be used. This default will change in Tomcat 12 to the RFC 3112 compliant order of credential then salt. (markt)
  • Cluster
  • Add: 62814: Document that human-readable names maybe used for mapSendOptions and align documentation with channelSendOptions. Based on pull request #929 by archan0621. (markt)
  • Clustering
  • Fix: Correct a regression introduced in 9.0.109 that broke some clustering configurations. (markt)
  • Coyote
  • Fix: Prevent concurrent release of OpenSSLEngine resources and the termination of the Tomcat Native library as it can cause crashes during Tomcat shutdown. (markt)
  • Fix: Avoid possible NPEs when using a TLS enabled custom connector. (remm)
  • Fix: Improve warnings when setting ciphers lists in the FFM code, mirroring the tomcat-native changes. (remm)
  • Fix: 69910: Dereference TLS objects right after closing a socket to improve memory efficiency. (remm)
  • Fix: Relax the JSSE vs OpenSSL configuration style checks on SSLHostConfig to reflect the existing implementation that allows one configuration style to be used for the trust attributes and a different style for all the other attributes. (markt)
  • Fix: Better warning message when OpenSSLConf configuration elements are used with a JSSE TLS implementation. (markt)
  • Fix: When using OpenSSL via…
Record
openSUSE-SU-2026:20350-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20414-1 No score

Security update for tomcat11

This update for tomcat11 fixes the following issues:

Update to Tomcat 11.0.18:

  • CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
  • CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
  • CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).

Changelog:

  • Fix: 69932: Fix request end access log pattern regression, which would log the start time of the request instead. (remm)
  • Fix: 69623: Additional fix for the long standing regression that meant that calls to ClassLoader.getResource().getContent() failed when made from within a web application with resource caching enabled if the target resource was packaged in a JAR file. (markt)
  • Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the CsrfPreventionFilter. (schultz)
  • Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2 requests when the content-length header is not set. (dsoumis)
  • Update: Enable minimum and recommended Tomcat Native versions to be set separately for Tomcat Native 1.x and 2.x. Update the minimum and recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum and recommended versions for Tomcat Native 2.x to 2.0.12. (markt)
  • Add: Add a new ssoReauthenticationMode to the Tomcat provided Authenticators that provides a per Authenticator override of the SSO Valve requireReauthentication attribute. (markt)
  • Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception rather than silently using a replacement character. (markt)
  • Fix: 69871: Increase log level to INFO for missing configuration for the rewrite valve. (remm)
  • Fix: Add log warnings for additional Host appBase suspicious values. (remm)
  • Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar. org.apache.catalina.Connector no longer requires org.apache.tomcat.jni.AprStatus to be present. (markt)
  • Add: Add the ability to use a custom function to generate the client identifier in the CrawlerSessionManagerValve. This is only available programmatically. Pull request #902 by Brian Matzon. (markt)
  • Fix: Change the SSO reauthentication behaviour for SPNEGO authentication so that a normal SPNEGO authentication is performed if the SSL Valve is configured with reauthentication enabled. This is so that the delegated credentials will be available to the web application. (markt)
  • Fix: When generating the class path in the Loader, re-order the check on individual class path components to avoid a potential NullPointerException. Identified by Coverity Scan. (markt)
  • Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull request #915 by Joshua Rogers. (remm)
  • Update: Add an attribute, digestInRfc3112Order, to MessageDigestCredentialHandler to control the order in which the credential and salt are digested. By default, the current, non-RFC 3112 compliant, order of salt then credential will be used. This default will change in Tomcat 12 to the RFC 3112 compliant order of credential then salt. (markt)
  • Cluster
  • Add: 62814: Document that human-readable names may be used for mapSendOptions and align documentation with channelSendOptions. Based on pull request #929 by archan0621. (markt)
  • Clustering
  • Fix: Correct a regression introduced in 11.0.11 that broke some clustering configurations. (markt)
  • Coyote
  • Fix: 69936: Fix bug in previous fix for Tomcat Native crashes on shutdown that triggered a significant memory leak. Patch provided by Wes. (markt)
  • Fix: Prevent concurrent release of OpenSSLEngine resources and the termination of the Tomcat Native library as it can cause crashes during Tomcat shutdown. (markt)
  • Fix: Improve warnings when setting ciphers lists in the FFM code, mirroring the tomcat-native changes. (remm)
  • Fix: 69910: Dereference TLS objects right after closing a socket to improve memory efficiency. (remm)
  • Fix: Relax…
Record
openSUSE-SU-2026:20414-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20444-1 No score

Security update for tomcat10

This update for tomcat10 fixes the following issues:

Update to Tomcat 10.1.52:

  • CVE-2025-55752: directory traversal via rewrite with possible RCE if PUT is enabled (bsc#1252753).
  • CVE-2025-55754: Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat (bsc#1252905).
  • CVE-2025-61795: temporary copies during the processing of multipart upload can lead to a denial of service (bsc#1252756).
  • CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
  • CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
  • CVE-2026-24734: certificate revocation bypass due to incomplete OCSP verification checks (bsc#1258387).

Changelog:

  • Fix: 69623: Additional fix for the long standing regression that meant that calls to ClassLoader.getResource().getContent() failed when made from within a web application with resource caching enabled if the target resource was packaged in a JAR file. (markt)
  • Fix: Pull request #923: Avoid adding multiple CSRF tokens to a URL in the CsrfPreventionFilter. (schultz)
  • Fix: 69918: Ensure request parameters are correctly parsed for HTTP/2 requests when the content-length header is not set. (dsoumis)
  • Update: Enable minimum and recommended Tomcat Native versions to be set separately for Tomcat Native 1.x and 2.x. Update the minimum and recommended versions for Tomcat Native 1.x to 1.3.4. Update the minimum and recommended versions for Tomcat Native 2.x to 2.0.12. (markt)
  • Add: Add a new ssoReauthenticationMode to the Tomcat provided Authenticators that provides a per Authenticator override of the SSO Valve requireReauthentication attribute. (markt)
  • Fix: Ensure URL encoding errors in the Rewrite Valve trigger an exception rather than silently using a replacement character. (markt)
  • Fix: 69932: Fix request end access log pattern regression, which would log the start time of the request instead. (remm)
  • Fix: 69871: Increase log level to INFO for missing configuration for the rewrite valve. (remm)
  • Fix: Add log warnings for additional Host appBase suspicious values. (remm)
  • Fix: Remove hard dependency on tomcat-jni.jar for catalina.jar. org.apache.catalina.Connector no longer requires org.apache.tomcat.jni.AprStatus to be present. (markt)
  • Add: Add the ability to use a custom function to generate the client identifier in the CrawlerSessionManagerValve. This is only available programmatically. Pull request #902 by Brian Matzon. (markt)
  • Fix: Change the SSO reauthentication behaviour for SPNEGO authentication so that a normal SPNEGO authentication is performed if the SSL Valve is configured with reauthentication enabled. This is so that the delegated credentials will be available to the web application. (markt)
  • Fix: When generating the class path in the Loader, re-order the check on individual class path components to avoid a potential NullPointerException. Identified by Coverity Scan. (markt)
  • Fix: Fix SSL socket factory configuration in the JNDI realm. Based on pull request #915 by Joshua Rogers. (remm)
  • Update: Add an attribute, digestInRfc3112Order, to MessageDigestCredentialHandler to control the order in which the credential and salt are digested. By default, the current, non-RFC 3112 compliant, order of salt then credential will be used. This default will change in Tomcat 12 to the RFC 3112 compliant order of credential then salt. (markt)
  • Fix: Log warnings when the SSO configuration does not comply with the documentation. (remm)
  • Update: Deprecate the RemoteAddrFilter and RemoteAddrValve in favour of the RemoteCIDRFilter and RemoteCIDRValve. (markt)
  • Fix: 69837: Fix corruption of the class path generated by the Loader when running on Windows. (markt)
  • Fix: Reject requests that map to invalid Windows file names earlier. (markt)
  • Fix: 69839: Ensure that changes to session IDs (typically after authentication) are promulgated to the SSO…
Record
openSUSE-SU-2026:20444-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.0-M1 up to 11.0.15
11.0.15
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.0-M1 up to 10.1.50
10.1.50
org.apache.tomcat:tomcat
Maven
 11.0.0-M1 up to 11.0.15
11.0.15
org.apache.tomcat:tomcat
Maven
 10.1.0-M1 up to 10.1.50
10.1.50
org.apache.tomcat:tomcat-coyote
Maven
 11.0.0-M1 up to 11.0.15
11.0.15
org.apache.tomcat:tomcat-coyote
Maven
 10.1.0-M1 up to 10.1.50
10.1.50
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.0-M1 up to 9.0.113
9.0.113
org.apache.tomcat:tomcat
Maven
 9.0.0-M1 up to 9.0.113
9.0.113
org.apache.tomcat:tomcat-coyote
Maven
 9.0.0-M1 up to 9.0.113
9.0.113
org.apache.tomcat.embed:tomcat-embed-core
Maven
 8.5.0 to 8.5.100 None known
Show 290 moreShow less
Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat
Maven
 8.5.0 to 8.5.100 None known
org.apache.tomcat:tomcat-coyote
Maven
 8.5.0 to 8.5.100 None known
tomcat9
AlmaLinux:10
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat9-admin-webapps
AlmaLinux:10
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat9-docs-webapp
AlmaLinux:10
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat9-el-3.0-api
AlmaLinux:10
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat9-jsp-2.3-api
AlmaLinux:10
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat9-lib
AlmaLinux:10
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat9-servlet-4.0-api
AlmaLinux:10
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat9-webapps
AlmaLinux:10
 before 1:9.0.117-1.el10_2.alma.1
1:9.0.117-1.el10_2.alma.1
tomcat
AlmaLinux:9
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-admin-webapps
AlmaLinux:9
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-docs-webapp
AlmaLinux:9
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-el-3.0-api
AlmaLinux:9
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-jsp-2.3-api
AlmaLinux:9
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-lib
AlmaLinux:9
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-servlet-4.0-api
AlmaLinux:9
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-webapps
AlmaLinux:9
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat9
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-admin-webapps
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-docs-webapp
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-el-3.0-api
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-jsp-2.3-api
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-lib
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-servlet-4.0-api
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat9-webapps
AlmaLinux:10
 before 1:9.0.117-2.el10_2.alma.1
1:9.0.117-2.el10_2.alma.1
tomcat
AlmaLinux:8
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-admin-webapps
AlmaLinux:8
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-docs-webapp
AlmaLinux:8
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-el-3.0-api
AlmaLinux:8
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-jsp-2.3-api
AlmaLinux:8
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-lib
AlmaLinux:8
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-servlet-4.0-api
AlmaLinux:8
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-webapps
AlmaLinux:8
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat
Bitnami
 8.5.0 up to 9.0.113, 10.0.0 up to 10.1.50, 11.0.0 up to 11.0.15
9.0.11310.1.5011.0.15
libtomcat9-embed-java
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els2
9.0.31-1ubuntu0.9+tuxcare.els2
libtomcat9-java
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els2
9.0.31-1ubuntu0.9+tuxcare.els2
tomcat9
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els2
9.0.31-1ubuntu0.9+tuxcare.els2
tomcat9-admin
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els2
9.0.31-1ubuntu0.9+tuxcare.els2
tomcat9-common
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els2
9.0.31-1ubuntu0.9+tuxcare.els2
tomcat9-docs
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els2
9.0.31-1ubuntu0.9+tuxcare.els2
tomcat9-examples
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els2
9.0.31-1ubuntu0.9+tuxcare.els2
tomcat9-user
TuxCare:Ubuntu:20.04
 before 9.0.31-1ubuntu0.9+tuxcare.els2
9.0.31-1ubuntu0.9+tuxcare.els2
tomcat
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els3
1:9.0.87-3.el9_6.3.tuxcare.els3
tomcat-admin-webapps
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els3
1:9.0.87-3.el9_6.3.tuxcare.els3
tomcat-docs-webapp
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els3
1:9.0.87-3.el9_6.3.tuxcare.els3
tomcat-el-3.0-api
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els3
1:9.0.87-3.el9_6.3.tuxcare.els3
tomcat-jsp-2.3-api
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els3
1:9.0.87-3.el9_6.3.tuxcare.els3
tomcat-lib
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els3
1:9.0.87-3.el9_6.3.tuxcare.els3
tomcat-servlet-4.0-api
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els3
1:9.0.87-3.el9_6.3.tuxcare.els3
tomcat-webapps
TuxCare:AlmaLinux:9.6
 before 1:9.0.87-3.el9_6.3.tuxcare.els3
1:9.0.87-3.el9_6.3.tuxcare.els3
libtomcat9-embed-java
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els4
9.0.31-1~deb10u12+tuxcare.els4
libtomcat9-java
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els4
9.0.31-1~deb10u12+tuxcare.els4
tomcat9
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els4
9.0.31-1~deb10u12+tuxcare.els4
tomcat9-admin
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els4
9.0.31-1~deb10u12+tuxcare.els4
tomcat9-common
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els4
9.0.31-1~deb10u12+tuxcare.els4
tomcat9-docs
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els4
9.0.31-1~deb10u12+tuxcare.els4
tomcat9-examples
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els4
9.0.31-1~deb10u12+tuxcare.els4
tomcat9-user
TuxCare:Debian:10
 before 9.0.31-1~deb10u12+tuxcare.els4
9.0.31-1~deb10u12+tuxcare.els4
tomcat
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els16
1:9.0.62-11.el9_2.3.tuxcare.els16
tomcat-admin-webapps
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els16
1:9.0.62-11.el9_2.3.tuxcare.els16
tomcat-docs-webapp
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els16
1:9.0.62-11.el9_2.3.tuxcare.els16
tomcat-el-3.0-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els16
1:9.0.62-11.el9_2.3.tuxcare.els16
tomcat-jsp-2.3-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els16
1:9.0.62-11.el9_2.3.tuxcare.els16
tomcat-lib
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els16
1:9.0.62-11.el9_2.3.tuxcare.els16
tomcat-servlet-4.0-api
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els16
1:9.0.62-11.el9_2.3.tuxcare.els16
tomcat-webapps
TuxCare:AlmaLinux:9.2
 before 1:9.0.62-11.el9_2.3.tuxcare.els16
1:9.0.62-11.el9_2.3.tuxcare.els16
libtomcat9-embed-java
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els14
9.0.16-3ubuntu0.18.04.2+tuxcare.els14
libtomcat9-java
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els14
9.0.16-3ubuntu0.18.04.2+tuxcare.els14
tomcat9
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els14
9.0.16-3ubuntu0.18.04.2+tuxcare.els14
tomcat9-admin
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els14
9.0.16-3ubuntu0.18.04.2+tuxcare.els14
tomcat9-common
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els14
9.0.16-3ubuntu0.18.04.2+tuxcare.els14
tomcat9-docs
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els14
9.0.16-3ubuntu0.18.04.2+tuxcare.els14
tomcat9-examples
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els14
9.0.16-3ubuntu0.18.04.2+tuxcare.els14
tomcat9-user
TuxCare:Ubuntu:18.04
 before 9.0.16-3ubuntu0.18.04.2+tuxcare.els14
9.0.16-3ubuntu0.18.04.2+tuxcare.els14
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.90 up to 9.0.90-tuxcare.4, plus listed versions
9.0.90-tuxcare.19.0.90-tuxcare.29.0.90-tuxcare.3
9.0.90-tuxcare.4
org.apache.tomcat:tomcat
TuxCare:Maven
 9.0.90 up to 9.0.90-tuxcare.4, plus listed versions
9.0.90-tuxcare.19.0.90-tuxcare.29.0.90-tuxcare.3
9.0.90-tuxcare.4
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 9.0.90 up to 9.0.90-tuxcare.4, plus listed versions
9.0.90-tuxcare.19.0.90-tuxcare.29.0.90-tuxcare.3
9.0.90-tuxcare.4
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.83 up to 9.0.83-tuxcare.3, plus listed versions
9.0.83-tuxcare.19.0.83-tuxcare.2
9.0.83-tuxcare.3
org.apache.tomcat:tomcat
TuxCare:Maven
 9.0.83 up to 9.0.83-tuxcare.3, plus listed versions
9.0.83-tuxcare.19.0.83-tuxcare.2
9.0.83-tuxcare.3
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 9.0.83 up to 9.0.83-tuxcare.3, plus listed versions
9.0.83-tuxcare.19.0.83-tuxcare.2
9.0.83-tuxcare.3
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 10.1.42 up to 10.1.42-tuxcare.2, plus listed versions
10.1.42-tuxcare.1
10.1.42-tuxcare.2
org.apache.tomcat:tomcat
TuxCare:Maven
 10.1.42 up to 10.1.42-tuxcare.2, plus listed versions
10.1.42-tuxcare.1
10.1.42-tuxcare.2
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 10.1.42 up to 10.1.42-tuxcare.2, plus listed versions
10.1.42-tuxcare.1
10.1.42-tuxcare.2
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 10.1.42 up to 10.1.42-tuxcare.2, plus listed versions
10.1.42-tuxcare.1
10.1.42-tuxcare.2
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 8.5.100 up to 8.5.100-tuxcare.8, plus listed versions
8.5.100-tuxcare.38.5.100-tuxcare.48.5.100-tuxcare.58.5.100-tuxcare.68.5.100-tuxcare.78.5.100.tuxcare.18.5.100.tuxcare.2
8.5.100-tuxcare.8
org.apache.tomcat:tomcat
TuxCare:Maven
 8.5.100 up to 8.5.100-tuxcare.8, plus listed versions
8.5.100-tuxcare.38.5.100-tuxcare.48.5.100-tuxcare.58.5.100-tuxcare.68.5.100-tuxcare.78.5.100.tuxcare.18.5.100.tuxcare.2
8.5.100-tuxcare.8
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 8.5.100 up to 8.5.100-tuxcare.8, plus listed versions
8.5.100-tuxcare.38.5.100-tuxcare.48.5.100-tuxcare.58.5.100-tuxcare.68.5.100-tuxcare.78.5.100.tuxcare.18.5.100.tuxcare.2
8.5.100-tuxcare.8
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.100 up to 9.0.100-tuxcare.6, plus listed versions
9.0.100-tuxcare.19.0.100-tuxcare.29.0.100-tuxcare.39.0.100-tuxcare.49.0.100-tuxcare.5
9.0.100-tuxcare.6
org.apache.tomcat:tomcat
TuxCare:Maven
 9.0.100 up to 9.0.100-tuxcare.6, plus listed versions
9.0.100-tuxcare.19.0.100-tuxcare.29.0.100-tuxcare.39.0.100-tuxcare.49.0.100-tuxcare.5
9.0.100-tuxcare.6
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 9.0.100 up to 9.0.100-tuxcare.6, plus listed versions
9.0.100-tuxcare.19.0.100-tuxcare.29.0.100-tuxcare.39.0.100-tuxcare.49.0.100-tuxcare.5
9.0.100-tuxcare.6
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.46 up to 9.0.46-tuxcare.6, plus listed versions
9.0.46-tuxcare.19.0.46-tuxcare.29.0.46-tuxcare.39.0.46-tuxcare.49.0.46-tuxcare.5
9.0.46-tuxcare.6
org.apache.tomcat:tomcat
TuxCare:Maven
 9.0.46 up to 9.0.46-tuxcare.6, plus listed versions
9.0.46-tuxcare.19.0.46-tuxcare.29.0.46-tuxcare.39.0.46-tuxcare.49.0.46-tuxcare.5
9.0.46-tuxcare.6
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 9.0.46 up to 9.0.46-tuxcare.6, plus listed versions
9.0.46-tuxcare.19.0.46-tuxcare.29.0.46-tuxcare.39.0.46-tuxcare.49.0.46-tuxcare.5
9.0.46-tuxcare.6
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 9.0.46 up to 9.0.46-tuxcare.6, plus listed versions
9.0.46-tuxcare.19.0.46-tuxcare.29.0.46-tuxcare.39.0.46-tuxcare.49.0.46-tuxcare.5
9.0.46-tuxcare.6
org.apache.tomcat:tomcat-util
TuxCare:Maven
 9.0.46 up to 9.0.46-tuxcare.6, plus listed versions
9.0.46-tuxcare.19.0.46-tuxcare.29.0.46-tuxcare.39.0.46-tuxcare.49.0.46-tuxcare.5
9.0.46-tuxcare.6
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.50 up to 9.0.50-tuxcare.9, plus listed versions
9.0.50-tuxcare.19.0.50-tuxcare.29.0.50-tuxcare.39.0.50-tuxcare.49.0.50-tuxcare.59.0.50-tuxcare.69.0.50-tuxcare.79.0.50-tuxcare.8
9.0.50-tuxcare.9
org.apache.tomcat:tomcat
TuxCare:Maven
 9.0.50 up to 9.0.50-tuxcare.9, plus listed versions
9.0.50-tuxcare.19.0.50-tuxcare.29.0.50-tuxcare.39.0.50-tuxcare.49.0.50-tuxcare.59.0.50-tuxcare.69.0.50-tuxcare.79.0.50-tuxcare.8
9.0.50-tuxcare.9
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 9.0.50 up to 9.0.50-tuxcare.9, plus listed versions
9.0.50-tuxcare.19.0.50-tuxcare.29.0.50-tuxcare.39.0.50-tuxcare.49.0.50-tuxcare.59.0.50-tuxcare.69.0.50-tuxcare.79.0.50-tuxcare.8
9.0.50-tuxcare.9
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-coyote
TuxCare:Maven
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-tribes
TuxCare:Maven
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-util
TuxCare:Maven
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat:tomcat-websocket
TuxCare:Maven
 9.0.24 up to 9.0.24-tuxcare.1
9.0.24-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-core
TuxCare:Maven
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat.embed:tomcat-embed-websocket
TuxCare:Maven
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat:tomcat
TuxCare:Maven
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
org.apache.tomcat:tomcat-catalina
TuxCare:Maven
 8.5.46 up to 8.5.46-tuxcare.1
8.5.46-tuxcare.1
tomcat10
Debian:12
 before 10.1.52-1~deb12u1, plus listed versions
10.1.10-110.1.13-110.1.14-110.1.15-110.1.16-1
Show 23 moreShow less
10.1.20-110.1.23-110.1.25-110.1.25-1~bpo12+110.1.25-210.1.30-110.1.30-1~bpo12+110.1.31-110.1.33-110.1.33-1~bpo12+110.1.34-0+deb12u110.1.34-0+deb12u210.1.34-110.1.35-110.1.40-110.1.40-1~bpo12+110.1.46-110.1.6-110.1.6-1+deb12u110.1.6-1+deb12u210.1.7-110.1.8-110.1.9-1
10.1.52-1~deb12u1
tomcat10
Debian:13
 before 10.1.52-1~deb13u1, plus listed versions
10.1.40-110.1.46-110.1.52-1~deb12u1
10.1.52-1~deb13u1
tomcat10
Debian:14
 before 10.1.52-1, plus listed versions
10.1.40-110.1.46-110.1.52-1~deb12u110.1.52-1~deb13u1
10.1.52-1
tomcat11
Debian:13
 before 11.0.15-1~deb13u1, plus listed versions
11.0.11-111.0.6-1
11.0.15-1~deb13u1
tomcat11
Debian:14
 before 11.0.15-1, plus listed versions
11.0.11-111.0.15-1~deb13u111.0.6-1
11.0.15-1
tomcat9
Debian:12
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:13
 before 9.0.70-2
9.0.70-2
tomcat9
Debian:14
 before 9.0.70-2
9.0.70-2
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.0-M1 up to 11.0.15, plus listed versions
11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13
Show 32 moreShow less
11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.1011.0.1111.0.1211.0.1311.0.1411.0.211.0.311.0.411.0.511.0.611.0.711.0.811.0.9
11.0.15
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.0-M1 up to 10.1.50, plus listed versions
10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14
Show 45 moreShow less
10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.3910.1.410.1.4010.1.4110.1.4210.1.4310.1.4410.1.4510.1.4610.1.4710.1.48
10.1.50
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.0-M1 up to 9.0.113, plus listed versions
9.0.0.M19.0.0.M109.0.0.M119.0.0.M139.0.0.M15
Show 45 moreShow less
9.0.0.M179.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.1009.0.1029.0.1049.0.1059.0.1069.0.1079.0.1089.0.1099.0.119.0.1109.0.1119.0.1129.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.33
9.0.113
org.apache.tomcat:tomcat
Maven
 11.0.0-M1 up to 11.0.15, plus listed versions
11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13
Show 32 moreShow less
11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.1011.0.1111.0.1211.0.1311.0.1411.0.211.0.311.0.411.0.511.0.611.0.711.0.811.0.9
11.0.15
org.apache.tomcat:tomcat
Maven
 10.1.0-M1 up to 10.1.50, plus listed versions
10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14
Show 45 moreShow less
10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.3910.1.410.1.4010.1.4110.1.4210.1.4310.1.4410.1.4510.1.4610.1.4710.1.48
10.1.50
org.apache.tomcat:tomcat
Maven
 9.0.0-M1 up to 9.0.113, plus listed versions
9.0.0.M19.0.0.M109.0.0.M119.0.0.M139.0.0.M15
Show 45 moreShow less
9.0.0.M179.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.1009.0.1029.0.1049.0.1059.0.1069.0.1079.0.1089.0.1099.0.119.0.1109.0.1119.0.1129.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.33
9.0.113
org.apache.tomcat:tomcat-coyote
Maven
 11.0.0-M1 up to 11.0.15, plus listed versions
11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13
Show 32 moreShow less
11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.1011.0.1111.0.1211.0.1311.0.1411.0.211.0.311.0.411.0.511.0.611.0.711.0.811.0.9
11.0.15
org.apache.tomcat:tomcat-coyote
Maven
 10.1.0-M1 up to 10.1.50, plus listed versions
10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14
Show 45 moreShow less
10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.3910.1.410.1.4010.1.4110.1.4210.1.4310.1.4410.1.4510.1.4610.1.4710.1.48
10.1.50
org.apache.tomcat:tomcat-coyote
Maven
 9.0.0-M1 up to 9.0.113, plus listed versions
9.0.0.M19.0.0.M109.0.0.M119.0.0.M139.0.0.M15
Show 45 moreShow less
9.0.0.M179.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.1009.0.1029.0.1049.0.1059.0.1069.0.1079.0.1089.0.1099.0.119.0.1109.0.1119.0.1129.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.33
9.0.113
org.apache.tomcat.embed:tomcat-embed-core
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
org.apache.tomcat:tomcat
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
org.apache.tomcat:tomcat-coyote
Maven
 8.5.0 to 8.5.100, plus listed versions
8.5.118.5.128.5.138.5.148.5.15
Show 45 moreShow less
8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.608.5.618.5.638.5.648.5.65
 None known
tomcat
Mageia:9
 before 9.0.115-1.mga9
9.0.115-1.mga9
tomcat
openEuler:24.03-LTS
 before 9.0.115-1.oe2403sp3
9.0.115-1.oe2403sp3
tomcat
openEuler:24.03-LTS-SP1
 before 9.0.115-1.oe2403sp1
9.0.115-1.oe2403sp1
tomcat
openEuler:24.03-LTS-SP2
 before 9.0.115-1.oe2403sp2
9.0.115-1.oe2403sp2
tomcat
openEuler:24.03-LTS-SP3
 before 9.0.115-1.oe2403sp3
9.0.115-1.oe2403sp3
tomcat
openEuler:20.03-LTS-SP4
 before 9.0.115-1.oe2003sp4
9.0.115-1.oe2003sp4
tomcat
openEuler:22.03-LTS-SP4
 before 9.0.115-1.oe2203sp4
9.0.115-1.oe2203sp4
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.2::el10
 before 0:10.1.49-10.redhat_00008.1.el10jws
0:10.1.49-10.redhat_00008.1.el10jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.2::el10
 before 0:10.1.49-10.redhat_00008.1.el10jws
0:10.1.49-10.redhat_00008.1.el10jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.2::el10
 before 0:10.1.49-10.redhat_00008.1.el10jws
0:10.1.49-10.redhat_00008.1.el10jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.2::el10
 before 0:10.1.49-10.redhat_00008.1.el10jws
0:10.1.49-10.redhat_00008.1.el10jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.2::el10
 before 0:10.1.49-10.redhat_00008.1.el10jws
0:10.1.49-10.redhat_00008.1.el10jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.2::el10
 before 0:10.1.49-10.redhat_00008.1.el10jws
0:10.1.49-10.redhat_00008.1.el10jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.2::el10
 before 0:10.1.49-10.redhat_00008.1.el10jws
0:10.1.49-10.redhat_00008.1.el10jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.2::el10
 before 0:10.1.49-10.redhat_00008.1.el10jws
0:10.1.49-10.redhat_00008.1.el10jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.2::el10
 before 0:10.1.49-10.redhat_00008.1.el10jws
0:10.1.49-10.redhat_00008.1.el10jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.2::el10
 before 0:10.1.49-10.redhat_00008.1.el10jws
0:10.1.49-10.redhat_00008.1.el10jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.2::el8
 before 0:10.1.49-10.redhat_00008.1.el8jws
0:10.1.49-10.redhat_00008.1.el8jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.2::el8
 before 0:10.1.49-10.redhat_00008.1.el8jws
0:10.1.49-10.redhat_00008.1.el8jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.2::el8
 before 0:10.1.49-10.redhat_00008.1.el8jws
0:10.1.49-10.redhat_00008.1.el8jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.2::el8
 before 0:10.1.49-10.redhat_00008.1.el8jws
0:10.1.49-10.redhat_00008.1.el8jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.2::el8
 before 0:10.1.49-10.redhat_00008.1.el8jws
0:10.1.49-10.redhat_00008.1.el8jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.2::el8
 before 0:10.1.49-10.redhat_00008.1.el8jws
0:10.1.49-10.redhat_00008.1.el8jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.2::el8
 before 0:10.1.49-10.redhat_00008.1.el8jws
0:10.1.49-10.redhat_00008.1.el8jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.2::el8
 before 0:10.1.49-10.redhat_00008.1.el8jws
0:10.1.49-10.redhat_00008.1.el8jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.2::el8
 before 0:10.1.49-10.redhat_00008.1.el8jws
0:10.1.49-10.redhat_00008.1.el8jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.2::el8
 before 0:10.1.49-10.redhat_00008.1.el8jws
0:10.1.49-10.redhat_00008.1.el8jws
jws6-tomcat
Red Hat:jboss_enterprise_web_server:6.2::el9
 before 0:10.1.49-10.redhat_00008.1.el9jws
0:10.1.49-10.redhat_00008.1.el9jws
jws6-tomcat-admin-webapps
Red Hat:jboss_enterprise_web_server:6.2::el9
 before 0:10.1.49-10.redhat_00008.1.el9jws
0:10.1.49-10.redhat_00008.1.el9jws
jws6-tomcat-docs-webapp
Red Hat:jboss_enterprise_web_server:6.2::el9
 before 0:10.1.49-10.redhat_00008.1.el9jws
0:10.1.49-10.redhat_00008.1.el9jws
jws6-tomcat-el-5.0-api
Red Hat:jboss_enterprise_web_server:6.2::el9
 before 0:10.1.49-10.redhat_00008.1.el9jws
0:10.1.49-10.redhat_00008.1.el9jws
jws6-tomcat-javadoc
Red Hat:jboss_enterprise_web_server:6.2::el9
 before 0:10.1.49-10.redhat_00008.1.el9jws
0:10.1.49-10.redhat_00008.1.el9jws
jws6-tomcat-jsp-3.1-api
Red Hat:jboss_enterprise_web_server:6.2::el9
 before 0:10.1.49-10.redhat_00008.1.el9jws
0:10.1.49-10.redhat_00008.1.el9jws
jws6-tomcat-lib
Red Hat:jboss_enterprise_web_server:6.2::el9
 before 0:10.1.49-10.redhat_00008.1.el9jws
0:10.1.49-10.redhat_00008.1.el9jws
jws6-tomcat-selinux
Red Hat:jboss_enterprise_web_server:6.2::el9
 before 0:10.1.49-10.redhat_00008.1.el9jws
0:10.1.49-10.redhat_00008.1.el9jws
jws6-tomcat-servlet-6.0-api
Red Hat:jboss_enterprise_web_server:6.2::el9
 before 0:10.1.49-10.redhat_00008.1.el9jws
0:10.1.49-10.redhat_00008.1.el9jws
jws6-tomcat-webapps
Red Hat:jboss_enterprise_web_server:6.2::el9
 before 0:10.1.49-10.redhat_00008.1.el9jws
0:10.1.49-10.redhat_00008.1.el9jws
tomcat
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-admin-webapps
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-docs-webapp
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-el-3.0-api
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-jsp-2.3-api
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-lib
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-servlet-4.0-api
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat-webapps
Red Hat:enterprise_linux:9::appstream
 before 1:9.0.117-1.el9_8
1:9.0.117-1.el9_8
tomcat11
Red Hat:hummingbird:1
 before 0:11.0.21-0.1.hum1
0:11.0.21-0.1.hum1
tomcat11-admin-webapps
Red Hat:hummingbird:1
 before 0:11.0.21-0.1.hum1
0:11.0.21-0.1.hum1
tomcat11-docs-webapp
Red Hat:hummingbird:1
 before 0:11.0.21-0.1.hum1
0:11.0.21-0.1.hum1
tomcat11-el-6.0-api
Red Hat:hummingbird:1
 before 0:11.0.21-0.1.hum1
0:11.0.21-0.1.hum1
tomcat11-jsp-4.0-api
Red Hat:hummingbird:1
 before 0:11.0.21-0.1.hum1
0:11.0.21-0.1.hum1
tomcat11-lib
Red Hat:hummingbird:1
 before 0:11.0.21-0.1.hum1
0:11.0.21-0.1.hum1
tomcat11-servlet-6.1-api
Red Hat:hummingbird:1
 before 0:11.0.21-0.1.hum1
0:11.0.21-0.1.hum1
tomcat11-webapps
Red Hat:hummingbird:1
 before 0:11.0.21-0.1.hum1
0:11.0.21-0.1.hum1
tomcat9
Red Hat:enterprise_linux_eus:10.0
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-admin-webapps
Red Hat:enterprise_linux_eus:10.0
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-docs-webapp
Red Hat:enterprise_linux_eus:10.0
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-el-3.0-api
Red Hat:enterprise_linux_eus:10.0
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-jsp-2.3-api
Red Hat:enterprise_linux_eus:10.0
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-lib
Red Hat:enterprise_linux_eus:10.0
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-servlet-4.0-api
Red Hat:enterprise_linux_eus:10.0
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat9-webapps
Red Hat:enterprise_linux_eus:10.0
 before 1:9.0.120-1.el10_0
1:9.0.120-1.el10_0
tomcat
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-admin-webapps
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-docs-webapp
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-el-3.0-api
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-jsp-2.3-api
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-lib
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-servlet-4.0-api
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat-webapps
Red Hat:rhel_eus:9.6::appstream
 before 1:9.0.120-1.el9_6
1:9.0.120-1.el9_6
tomcat
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-admin-webapps
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-docs-webapp
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-el-3.0-api
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-jsp-2.3-api
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-lib
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-servlet-4.0-api
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat-webapps
Red Hat:enterprise_linux:8::appstream
 before 1:9.0.120-1.el8_10
1:9.0.120-1.el8_10
tomcat
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.120-1.el9_2
1:9.0.120-1.el9_2
tomcat-admin-webapps
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.120-1.el9_2
1:9.0.120-1.el9_2
tomcat-docs-webapp
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.120-1.el9_2
1:9.0.120-1.el9_2
tomcat-el-3.0-api
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.120-1.el9_2
1:9.0.120-1.el9_2
tomcat-jsp-2.3-api
Red Hat:rhel_e4s:9.2::appstream
 before 1:9.0.120-1.el9_2
1:9.0.120-1.el9_2
tomcat9
Rocky Linux:10
 before 1:9.0.117-1.el10_2
1:9.0.117-1.el10_2
io.root.org.apache.tomcat:tomcat-catalina
Root:Maven
 before 11.0.6-root.io.2
11.0.6-root.io.211.0.11-root.io.211.0.7-root.io.211.0.6-root.io.311.0.10-root.io.211.0.8-root.io.211.0.6-root.io.411.0.11-root.io.311.0.10-root.io.311.0.11-root.io.411.0.6-root.io.511.0.8-root.io.311.0.7-root.io.3
io.root.org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 10.1.39-root.io.2
10.1.39-root.io.210.1.39-root.io.310.1.39-root.io.410.1.39-root.io.510.1.39-root.io.610.1.39-root.io.710.1.39-root.io.810.1.39-root.io.910.1.39-root.io.1010.1.39-root.io.1110.1.39-root.io.1210.1.34-root.io.110.1.16-root.io.110.1.34-root.io.210.1.39-root.io.1310.1.16-root.io.210.1.16-root.io.310.1.16-root.io.410.1.39-root.io.1410.1.16-root.io.510.1.16-root.io.610.1.16-root.io.710.1.39-root.io.1510.1.34-root.io.310.1.48-root.io.19.0.99-root.io.29.0.100-root.io.19.0.63-root.io.110.1.16-root.io.810.1.39-root.io.1810.1.16-root.io.910.1.20-root.io.110.1.39-root.io.1610.1.48-root.io.29.0.99-root.io.39.0.100-root.io.210.1.16-root.io.1010.1.39-root.io.1710.1.34-root.io.510.1.34-root.io.69.0.100-root.io.310.1.16-root.io.119.0.63-root.io.29.0.99-root.io.410.1.20-root.io.210.1.48-root.io.310.1.39-root.io.1910.1.30-root.io.1210.1.16-root.io.1210.1.39-root.io.2010.1.30-root.io.1310.1.34-root.io.7
org.apache.tomcat:tomcat-catalina
Root:Maven
 before 11.0.10-aikido.3
11.0.10-aikido.311.0.11-aikido.411.0.6-aikido.511.0.8-aikido.311.0.7-aikido.3
org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 10.1.16-aikido.9
10.1.16-aikido.910.1.20-aikido.110.1.39-aikido.1610.1.48-aikido.29.0.99-aikido.39.0.100-aikido.210.1.16-aikido.1010.1.39-aikido.1710.1.34-aikido.510.1.39-aikido.1810.1.34-aikido.69.0.100-aikido.310.1.16-aikido.119.0.63-aikido.29.0.99-aikido.410.1.20-aikido.210.1.48-aikido.310.1.39-aikido.1910.1.30-aikido.1210.1.16-aikido.1210.1.39-aikido.2010.1.30-aikido.1310.1.34-aikido.7
tomcat11
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 11.0.18-150600.13.15.1
11.0.18-150600.13.15.1
tomcat11
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 11.0.18-150600.13.15.1
11.0.18-150600.13.15.1
tomcat11
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 11.0.18-150600.13.15.1
11.0.18-150600.13.15.1
tomcat11
openSUSE:Leap 15.6
 before 11.0.18-150600.13.15.1
11.0.18-150600.13.15.1
tomcat10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 10.1.52-150200.5.61.1
10.1.52-150200.5.61.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 10.1.52-150200.5.61.1
10.1.52-150200.5.61.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 10.1.52-150200.5.61.1
10.1.52-150200.5.61.1
tomcat10
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 10.1.52-150200.5.61.1
10.1.52-150200.5.61.1
tomcat10
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 10.1.52-150200.5.61.1
10.1.52-150200.5.61.1
tomcat10
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 10.1.52-150200.5.61.1
10.1.52-150200.5.61.1
tomcat10
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 10.1.52-150200.5.61.1
10.1.52-150200.5.61.1
tomcat10
openSUSE:Leap 15.6
 before 10.1.52-150200.5.61.1
10.1.52-150200.5.61.1
tomcat
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 9.0.115-150200.102.1
9.0.115-150200.102.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 9.0.115-150200.102.1
9.0.115-150200.102.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 9.0.115-150200.102.1
9.0.115-150200.102.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 9.0.115-150200.102.1
9.0.115-150200.102.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 9.0.115-150200.102.1
9.0.115-150200.102.1
tomcat
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 9.0.115-150200.102.1
9.0.115-150200.102.1
tomcat
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 9.0.115-150200.102.1
9.0.115-150200.102.1
tomcat
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 9.0.115-150200.102.1
9.0.115-150200.102.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 9.0.115-150200.102.1
9.0.115-150200.102.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 9.0.115-150200.102.1
9.0.115-150200.102.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 9.0.115-150200.102.1
9.0.115-150200.102.1
tomcat
openSUSE:Leap 15.6
 before 9.0.115-150200.102.1
9.0.115-150200.102.1
tomcat
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 9.0.115-3.160.1
9.0.115-3.160.1
tomcat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 9.0.115-3.160.1
9.0.115-3.160.1
tomcat11
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 11.0.21-150600.13.18.1
11.0.21-150600.13.18.1
tomcat11
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 11.0.21-150600.13.18.1
11.0.21-150600.13.18.1
tomcat11
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 11.0.21-150600.13.18.1
11.0.21-150600.13.18.1
tomcat
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 9.0.117-3.163.2
9.0.117-3.163.2
tomcat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 9.0.117-3.163.2
9.0.117-3.163.2
tomcat10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat10
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 10.1.54-150200.5.64.1
10.1.54-150200.5.64.1
tomcat
SUSE:Linux Enterprise Module for Web and Scripting 15 SP7
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 9.0.117-150200.105.1
9.0.117-150200.105.1
tomcat11
SUSE:Linux Enterprise Server 16.0
 before 11.0.18-160000.1.1
11.0.18-160000.1.1
tomcat11
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 11.0.18-160000.1.1
11.0.18-160000.1.1
tomcat10
SUSE:Linux Enterprise Server 16.0
 before 10.1.52-160000.1.1
10.1.52-160000.1.1
tomcat10
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 10.1.52-160000.1.1
10.1.52-160000.1.1
tomcat8
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
8.5.21-1ubuntu18.5.29-18.5.30-18.5.30-1ubuntu18.5.30-1ubuntu1.2
Show 11 moreShow less
8.5.30-1ubuntu1.38.5.30-1ubuntu1.48.5.39-1ubuntu1~18.04.18.5.39-1ubuntu1~18.04.28.5.39-1ubuntu1~18.04.38.5.39-1ubuntu1~18.04.3+esm18.5.39-1ubuntu1~18.04.3+esm28.5.39-1ubuntu1~18.04.3+esm38.5.39-1ubuntu1~18.04.3+esm48.5.39-1ubuntu1~18.04.3+esm58.5.39-1ubuntu1~18.04.3+esm6
 None known
tomcat9
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
9.0.16-3~18.04.19.0.16-3ubuntu0.18.04.19.0.16-3ubuntu0.18.04.29.0.16-3ubuntu0.18.04.2+esm19.0.16-3ubuntu0.18.04.2+esm2
Show 6 moreShow less
9.0.16-3ubuntu0.18.04.2+esm39.0.16-3ubuntu0.18.04.2+esm49.0.16-3ubuntu0.18.04.2+esm59.0.16-3ubuntu0.18.04.2+esm69.0.16-3ubuntu0.18.04.2+esm79.0.16-3ubuntu0.18.04.2+esm8
 None known
tomcat9
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
9.0.24-19.0.27-19.0.31-19.0.31-1ubuntu0.19.0.31-1ubuntu0.2
Show 10 moreShow less
9.0.31-1ubuntu0.39.0.31-1ubuntu0.49.0.31-1ubuntu0.59.0.31-1ubuntu0.69.0.31-1ubuntu0.79.0.31-1ubuntu0.89.0.31-1ubuntu0.99.0.31-1ubuntu0.9+esm19.0.31-1ubuntu0.9+esm29.0.31-1ubuntu0.9+esm3
 None known
tomcat9
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
9.0.43-39.0.54-19.0.55-19.0.58-19.0.58-1ubuntu0.1
Show 9 moreShow less
9.0.58-1ubuntu0.1+esm19.0.58-1ubuntu0.1+esm29.0.58-1ubuntu0.1+esm39.0.58-1ubuntu0.1+esm49.0.58-1ubuntu0.29.0.58-1ubuntu0.2+esm19.0.58-1ubuntu0.2+esm29.0.58-1ubuntu0.2+esm39.0.58-1ubuntu0.2+esm4
 None known
tomcat10
Ubuntu:24.04:LTS
 All versions, plus listed versions
10.1.10-110.1.14-110.1.15-110.1.16-110.1.16-1ubuntu0.1~esm1
Show 4 moreShow less
10.1.16-1ubuntu0.1~esm210.1.16-1ubuntu0.1~esm310.1.16-1ubuntu0.1~esm410.1.55-1ubuntu2~24.04.1
 None known
tomcat9
Ubuntu:24.04:LTS
 All versions, plus listed versions
9.0.70-1ubuntu19.0.70-29.0.70-2ubuntu0.19.0.70-2ubuntu0.1+esm19.0.70-2ubuntu0.1+esm29.0.70-2ubuntu0.1+esm39.0.118-1~24.04.1
 None known
tomcat10
Ubuntu:25.10
 All versions, plus listed versions
10.1.35-110.1.40-110.1.40-1ubuntu110.1.40-1ubuntu1.25.10.1
 None known
tomcat11
Ubuntu:25.10
 All versions, plus listed versions
11.0.6-1
 None known
tomcat9
Ubuntu:25.10
 All versions, plus listed versions
9.0.70-2ubuntu1.19.0.70-2ubuntu29.0.70-2ubuntu39.0.95-1ubuntu19.0.95-1ubuntu1.1
 None known
tomcat10
Ubuntu:26.04:LTS
 All versions, plus listed versions
10.1.40-1ubuntu110.1.40-1ubuntu1.26.04.110.1.55-1ubuntu2~26.04.1
 None known
tomcat
openSUSE:Tumbleweed
 before 9.0.115-1.1
9.0.115-1.1
tomcat10
openSUSE:Tumbleweed
 before 10.1.52-1.1
10.1.52-1.1
tomcat11
openSUSE:Tumbleweed
 before 11.0.18-1.1
11.0.18-1.1
tomcat
openSUSE:Leap 16.0
 before 9.0.115-160000.1.1
9.0.115-160000.1.1
tomcat11
openSUSE:Leap 16.0
 before 11.0.18-160000.1.1
11.0.18-160000.1.1
tomcat10
openSUSE:Leap 16.0
 before 10.1.52-160000.1.1
10.1.52-160000.1.1
tomcat11
openSUSE:Leap 16.0
 before 11.0.21-160000.1.1
11.0.21-160000.1.1
tomcat
openSUSE:Leap 16.0
 before 9.0.117-160000.1.1
9.0.117-160000.1.1
tomcat10
openSUSE:Leap 16.0
 before 10.1.54-160000.1.1
10.1.54-160000.1.1

History

History
RecordedChangedSources
affected, aliases, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-66614 is a critical vulnerability (CVSS 9.1) in Apache Tomcat, published February 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in org.apache.tomcat.embed:tomcat-embed-core 11.0.15.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 66 package rows, 303 versions, 167 references and the rest of 3 source descriptions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 16 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open