CVE-2025-55668

Apache Tomcat: session fixation via rewrite valve

6.5 MediumPublic exploitFix available

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.93%Up 0.9 points since Aug 14, 2025

What each source reports

CVE List Score used 6.5

Apache Tomcat: session fixation via rewrite valve

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Record: CVE-2025-55668
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-384
Updated: 2026-11-02

EUVDEUVD-2025-24574 6.5

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Record: EUVD-2025-24574
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-23hv-mwm6-g8jf 6.5

Apache Tomcat Session Fixation vulnerability

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Record: GHSA-23hv-mwm6-g8jf
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-384
Updated: 2026-11-02

NVD 6.5

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Record: CVE-2025-55668
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-384
Updated: 2026-11-02

OSV 6.5

Apache Tomcat: session fixation via rewrite valve

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Record: CVE-2025-55668
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-384
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-55668 6.5

Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Record: DEBIAN-CVE-2025-55668
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Show 38 moreShow less

OSVGHSA-23hv-mwm6-g8jf 6.5

Apache Tomcat Session Fixation vulnerability

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Record: GHSA-23hv-mwm6-g8jf
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weakness: CWE-384
Updated: 2026-11-02

OSVOESA-2025-2216 7.5

tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.

Security Fix(es):

Apache Tomcat is vulnerable to the made you reset attack due to an Improper Resource Shutdown or Release vulnerability. This issue affects Apache Tomcat versions from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected.(CVE-2025-48989)

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-55668)

Record: OESA-2025-2216
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-2217 7.5

tomcat security update

Security Fix(es):

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-55668)

Record: OESA-2025-2217
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-2218 7.5

tomcat security update

Security Fix(es):

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-55668)

Record: OESA-2025-2218
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-2219 7.5

tomcat security update

Security Fix(es):

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-55668)

Record: OESA-2025-2219
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-2220 7.5

tomcat security update

Security Fix(es):

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-55668)

Record: OESA-2025-2220
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2025-2243 7.5

tomcat security update

Security Fix(es):

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-55668)

Record: OESA-2025-2243
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:18536 7.5

Red Hat Security Advisory: tomcat9 security update

Record: RHSA-2026:18536
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:18537 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:18537
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:18916 7.4

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:18916
CVSS 3.1: 7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated: 2026-11-02

OSVRHSA-2026:2740 6.5

Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.0 security release

Record: RHSA-2026:2740
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:6569 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:6569
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:67163 7.5

Red Hat Security Advisory: tomcat9 security update

Record: RHSA-2026:67163
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68659 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68659
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68677 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68677
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68678 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68678
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68679 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68679
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:68680 7.5

Red Hat Security Advisory: tomcat security update

Record: RHSA-2026:68680
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:8334 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record: RHSA-2026:8334
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:18537 6.5

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

tomcat: Apache Tomcat: Security constraint bypass for CGI scripts (CVE-2025-46701)
org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve (CVE-2025-55668)
org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation (CVE-2025-55754)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.

Record: RLSA-2026:18537
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2025-55668 6.5

CVE-2025-55668 in io.root.org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2025-55668 in the io.root.org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2025-55668
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-55668 6.5

Record: UBUNTU-CVE-2025-55668
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVALSA-2026:68677 No score

Important: tomcat security update

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)
tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)
tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:68677
Updated: 2026-11-02

OSVBIT-tomcat-2025-55668 No score

Apache Tomcat: session fixation via rewrite valve

Session Fixation vulnerability in Apache Tomcat via rewrite valve.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.0 through 9.0.105. Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

Record: BIT-tomcat-2025-55668
Updated: 2026-11-02

OSVCLSA-2025-1759795579 No score

TuxCare security update for 6 packages (18 CVEs)

TuxCare rebuilt 6 packages to address 18 CVEs. Fixed in 9.0.83-tuxcare.1.

Record: CLSA-2025-1759795579
Updated: 2026-11-02

OSVCLSA-2025-1763338014 No score

TuxCare security update for 4 packages (10 CVEs)

TuxCare rebuilt 4 packages to address 10 CVEs. Fixed in 9.0.90-tuxcare.1.

Record: CLSA-2025-1763338014
Updated: 2026-11-02

OSVCLSA-2025-1764720465 No score

TuxCare security update for 5 packages (18 CVEs)

TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.50-tuxcare.2.

Record: CLSA-2025-1764720465
Updated: 2026-11-02

OSVCLSA-2025-1765411679 No score

TuxCare security update for 3 packages (2 CVEs)

TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 8.5.100-tuxcare.4.

Record: CLSA-2025-1765411679
Updated: 2026-11-02

OSVCLSA-2025-1765411683 No score

TuxCare security update for 4 packages (15 CVEs)

TuxCare rebuilt 4 packages to address 15 CVEs. Fixed in 9.0.87-tuxcare.1.

Record: CLSA-2025-1765411683
Updated: 2026-11-02

OSVCLSA-2025-1765930090 No score

TuxCare security update for 6 packages (9 CVEs)

TuxCare rebuilt 6 packages to address 9 CVEs. Fixed in 9.0.75-tuxcare.2.

Record: CLSA-2025-1765930090
Updated: 2026-11-02

OSVCLSA-2025-1766362095 No score

TuxCare security update for 4 packages (12 CVEs)

TuxCare rebuilt 4 packages to address 12 CVEs. Fixed in 9.0.100-tuxcare.1.

Record: CLSA-2025-1766362095
Updated: 2026-11-02

OSVCLSA-2026-1768262917 No score

TuxCare security update for 6 packages (22 CVEs)

TuxCare rebuilt 6 packages to address 22 CVEs. Fixed in 10.1.18-tuxcare.1.

Record: CLSA-2026-1768262917
Updated: 2026-11-02

OSVCLSA-2026-1773188120 No score

TuxCare security update for 5 packages (23 CVEs)

TuxCare rebuilt 5 packages to address 23 CVEs. Fixed in 9.0.46-tuxcare.1.

Record: CLSA-2026-1773188120
Updated: 2026-11-02

OSVCLSA-2026-1780997466 No score

tomcat: Fix of 2 CVEs

CVE-2025-55668: fix session fixation in RewriteValve by encoding session id into sendRedirect URL and recycling session info on rewrite reinvoke
CVE-2026-29146: fix padding oracle in EncryptInterceptor by changing default cipher to AES/GCM/NoPadding and rejecting insecure mode+padding combinations

Record: CLSA-2026-1780997466
Updated: 2026-11-02

OSVCLSA-2026-1792575257 No score

TuxCare security update for 8 packages (32 CVEs)

TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.

Record: CLSA-2026-1792575257
Updated: 2026-11-02

OSVCLSA-2026-1792666002 No score

TuxCare security update for 6 packages (17 CVEs)

TuxCare rebuilt 6 packages to address 17 CVEs. Fixed in 10.1.33-tuxcare.1.

Record: CLSA-2026-1792666002
Updated: 2026-11-02

OSVCLSA-2026-1793011037 No score

TuxCare security update for 5 packages (26 CVEs)

TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.

Record: CLSA-2026-1793011037
Updated: 2026-11-02

OSVCLSA-2026-1793011786 No score

TuxCare security update for 7 packages (22 CVEs)

TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.

Record: CLSA-2026-1793011786
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.tomcat:tomcat-catalina` Maven	11.0.0-M1 up to 11.0.8	11.0.8
`org.apache.tomcat:tomcat-catalina` Maven	10.1.0-M1 up to 10.1.42	10.1.42
`org.apache.tomcat:tomcat-catalina` Maven	9.0.0.M1 up to 9.0.106	9.0.106
`org.apache.tomcat.embed:tomcat-embed-core` Maven	11.0.0-M1 up to 11.0.8	11.0.8
`org.apache.tomcat.embed:tomcat-embed-core` Maven	10.1.0-M1 up to 10.1.42	10.1.42
`org.apache.tomcat.embed:tomcat-embed-core` Maven	9.0.0.M1 up to 9.0.106	9.0.106
`tomcat` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-admin-webapps` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-docs-webapp` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-el-3.0-api` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10

Show 246 moreShow less

Affected packages
Package	Affected	Fixed
`tomcat-jsp-2.3-api` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-lib` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-servlet-4.0-api` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-webapps` AlmaLinux:8	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat` Bitnami	before 9.0.106, 10.0.0 up to 10.1.42, 11.0.0 up to 11.0.8	9.0.10610.1.4211.0.8
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	9.0.83 up to 9.0.83-tuxcare.1	9.0.83-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-websocket` TuxCare:Maven	9.0.83 up to 9.0.83-tuxcare.1	9.0.83-tuxcare.1
`org.apache.tomcat:tomcat` TuxCare:Maven	9.0.83 up to 9.0.83-tuxcare.1	9.0.83-tuxcare.1
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	9.0.83 up to 9.0.83-tuxcare.1	9.0.83-tuxcare.1
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	9.0.83 up to 9.0.83-tuxcare.1	9.0.83-tuxcare.1
`org.apache.tomcat:tomcat-websocket` TuxCare:Maven	9.0.83 up to 9.0.83-tuxcare.1	9.0.83-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	9.0.90 up to 9.0.90-tuxcare.1	9.0.90-tuxcare.1
`org.apache.tomcat:tomcat` TuxCare:Maven	9.0.90 up to 9.0.90-tuxcare.1	9.0.90-tuxcare.1
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	9.0.90 up to 9.0.90-tuxcare.1	9.0.90-tuxcare.1
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	9.0.90 up to 9.0.90-tuxcare.1	9.0.90-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	9.0.50 up to 9.0.50-tuxcare.2, plus listed versions 9.0.50-tuxcare.1	9.0.50-tuxcare.2
`org.apache.tomcat:tomcat` TuxCare:Maven	9.0.50 up to 9.0.50-tuxcare.2, plus listed versions 9.0.50-tuxcare.1	9.0.50-tuxcare.2
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	9.0.50 up to 9.0.50-tuxcare.2, plus listed versions 9.0.50-tuxcare.1	9.0.50-tuxcare.2
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	9.0.50 up to 9.0.50-tuxcare.2, plus listed versions 9.0.50-tuxcare.1	9.0.50-tuxcare.2
`org.apache.tomcat:tomcat-util` TuxCare:Maven	9.0.50 up to 9.0.50-tuxcare.2, plus listed versions 9.0.50-tuxcare.1	9.0.50-tuxcare.2
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	8.5.100 up to 8.5.100-tuxcare.4, plus listed versions 8.5.100-tuxcare.38.5.100.tuxcare.18.5.100.tuxcare.2	8.5.100-tuxcare.4
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	8.5.100 up to 8.5.100-tuxcare.4, plus listed versions 8.5.100-tuxcare.38.5.100.tuxcare.18.5.100.tuxcare.2	8.5.100-tuxcare.4
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	8.5.100 up to 8.5.100-tuxcare.4, plus listed versions 8.5.100-tuxcare.38.5.100.tuxcare.18.5.100.tuxcare.2	8.5.100-tuxcare.4
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	9.0.87 up to 9.0.87-tuxcare.1	9.0.87-tuxcare.1
`org.apache.tomcat:tomcat` TuxCare:Maven	9.0.87 up to 9.0.87-tuxcare.1	9.0.87-tuxcare.1
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	9.0.87 up to 9.0.87-tuxcare.1	9.0.87-tuxcare.1
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	9.0.87 up to 9.0.87-tuxcare.1	9.0.87-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	9.0.75 up to 9.0.75-tuxcare.2, plus listed versions 9.0.75-tuxcare.1	9.0.75-tuxcare.2
`org.apache.tomcat.embed:tomcat-embed-websocket` TuxCare:Maven	9.0.75 up to 9.0.75-tuxcare.2, plus listed versions 9.0.75-tuxcare.1	9.0.75-tuxcare.2
`org.apache.tomcat:tomcat` TuxCare:Maven	9.0.75 up to 9.0.75-tuxcare.2, plus listed versions 9.0.75-tuxcare.1	9.0.75-tuxcare.2
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	9.0.75 up to 9.0.75-tuxcare.2, plus listed versions 9.0.75-tuxcare.1	9.0.75-tuxcare.2
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	9.0.75 up to 9.0.75-tuxcare.2, plus listed versions 9.0.75-tuxcare.1	9.0.75-tuxcare.2
`org.apache.tomcat:tomcat-websocket` TuxCare:Maven	9.0.75 up to 9.0.75-tuxcare.2, plus listed versions 9.0.75-tuxcare.1	9.0.75-tuxcare.2
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	9.0.100 up to 9.0.100-tuxcare.1	9.0.100-tuxcare.1
`org.apache.tomcat:tomcat` TuxCare:Maven	9.0.100 up to 9.0.100-tuxcare.1	9.0.100-tuxcare.1
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	9.0.100 up to 9.0.100-tuxcare.1	9.0.100-tuxcare.1
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	9.0.100 up to 9.0.100-tuxcare.1	9.0.100-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	10.1.18 up to 10.1.18-tuxcare.1	10.1.18-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-websocket` TuxCare:Maven	10.1.18 up to 10.1.18-tuxcare.1	10.1.18-tuxcare.1
`org.apache.tomcat:tomcat` TuxCare:Maven	10.1.18 up to 10.1.18-tuxcare.1	10.1.18-tuxcare.1
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	10.1.18 up to 10.1.18-tuxcare.1	10.1.18-tuxcare.1
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	10.1.18 up to 10.1.18-tuxcare.1	10.1.18-tuxcare.1
`org.apache.tomcat:tomcat-websocket` TuxCare:Maven	10.1.18 up to 10.1.18-tuxcare.1	10.1.18-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	9.0.46 up to 9.0.46-tuxcare.1	9.0.46-tuxcare.1
`org.apache.tomcat:tomcat` TuxCare:Maven	9.0.46 up to 9.0.46-tuxcare.1	9.0.46-tuxcare.1
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	9.0.46 up to 9.0.46-tuxcare.1	9.0.46-tuxcare.1
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	9.0.46 up to 9.0.46-tuxcare.1	9.0.46-tuxcare.1
`org.apache.tomcat:tomcat-util` TuxCare:Maven	9.0.46 up to 9.0.46-tuxcare.1	9.0.46-tuxcare.1
`tomcat` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els3	1:9.0.62-12.el9_2.1.tuxcare.els3
`tomcat-admin-webapps` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els3	1:9.0.62-12.el9_2.1.tuxcare.els3
`tomcat-docs-webapp` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els3	1:9.0.62-12.el9_2.1.tuxcare.els3
`tomcat-el-3.0-api` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els3	1:9.0.62-12.el9_2.1.tuxcare.els3
`tomcat-jsp-2.3-api` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els3	1:9.0.62-12.el9_2.1.tuxcare.els3
`tomcat-lib` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els3	1:9.0.62-12.el9_2.1.tuxcare.els3
`tomcat-servlet-4.0-api` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els3	1:9.0.62-12.el9_2.1.tuxcare.els3
`tomcat-webapps` TuxCare:AlmaLinux:9.2	before 1:9.0.62-12.el9_2.1.tuxcare.els3	1:9.0.62-12.el9_2.1.tuxcare.els3
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	9.0.24 up to 9.0.24-tuxcare.1	9.0.24-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-websocket` TuxCare:Maven	9.0.24 up to 9.0.24-tuxcare.1	9.0.24-tuxcare.1
`org.apache.tomcat:tomcat` TuxCare:Maven	9.0.24 up to 9.0.24-tuxcare.1	9.0.24-tuxcare.1
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	9.0.24 up to 9.0.24-tuxcare.1	9.0.24-tuxcare.1
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	9.0.24 up to 9.0.24-tuxcare.1	9.0.24-tuxcare.1
`org.apache.tomcat:tomcat-tribes` TuxCare:Maven	9.0.24 up to 9.0.24-tuxcare.1	9.0.24-tuxcare.1
`org.apache.tomcat:tomcat-util` TuxCare:Maven	9.0.24 up to 9.0.24-tuxcare.1	9.0.24-tuxcare.1
`org.apache.tomcat:tomcat-websocket` TuxCare:Maven	9.0.24 up to 9.0.24-tuxcare.1	9.0.24-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	10.1.33 up to 10.1.33-tuxcare.1	10.1.33-tuxcare.1
`org.apache.tomcat:tomcat` TuxCare:Maven	10.1.33 up to 10.1.33-tuxcare.1	10.1.33-tuxcare.1
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	10.1.33 up to 10.1.33-tuxcare.1	10.1.33-tuxcare.1
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	10.1.33 up to 10.1.33-tuxcare.1	10.1.33-tuxcare.1
`org.apache.tomcat:tomcat-coyote-ffm` TuxCare:Maven	10.1.33 up to 10.1.33-tuxcare.1	10.1.33-tuxcare.1
`org.apache.tomcat:tomcat-tribes` TuxCare:Maven	10.1.33 up to 10.1.33-tuxcare.1	10.1.33-tuxcare.1
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1	9.0.39-tuxcare.2
`org.apache.tomcat:tomcat` TuxCare:Maven	9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1	9.0.39-tuxcare.2
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1	9.0.39-tuxcare.2
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1	9.0.39-tuxcare.2
`org.apache.tomcat:tomcat-util` TuxCare:Maven	9.0.39 up to 9.0.39-tuxcare.2, plus listed versions 9.0.39-tuxcare.1	9.0.39-tuxcare.2
`org.apache.tomcat.embed:tomcat-embed-core` TuxCare:Maven	9.0.13 up to 9.0.13-tuxcare.2, plus listed versions 9.0.13-tuxcare.1	9.0.13-tuxcare.2
`org.apache.tomcat.embed:tomcat-embed-websocket` TuxCare:Maven	9.0.13 up to 9.0.13-tuxcare.2, plus listed versions 9.0.13-tuxcare.1	9.0.13-tuxcare.2
`org.apache.tomcat:tomcat` TuxCare:Maven	9.0.13 up to 9.0.13-tuxcare.2, plus listed versions 9.0.13-tuxcare.1	9.0.13-tuxcare.2
`org.apache.tomcat:tomcat-catalina` TuxCare:Maven	9.0.13 up to 9.0.13-tuxcare.2, plus listed versions 9.0.13-tuxcare.1	9.0.13-tuxcare.2
`org.apache.tomcat:tomcat-coyote` TuxCare:Maven	9.0.13 up to 9.0.13-tuxcare.2, plus listed versions 9.0.13-tuxcare.1	9.0.13-tuxcare.2
`org.apache.tomcat:tomcat-util` TuxCare:Maven	9.0.13 up to 9.0.13-tuxcare.2, plus listed versions 9.0.13-tuxcare.1	9.0.13-tuxcare.2
`org.apache.tomcat:tomcat-websocket` TuxCare:Maven	9.0.13 up to 9.0.13-tuxcare.2, plus listed versions 9.0.13-tuxcare.1	9.0.13-tuxcare.2
`tomcat10` Debian:12	before 10.1.52-1~deb12u1, plus listed versions 10.1.10-110.1.13-110.1.14-110.1.15-110.1.16-1 Show 23 moreShow less 10.1.20-110.1.23-110.1.25-110.1.25-1~bpo12+110.1.25-210.1.30-110.1.30-1~bpo12+110.1.31-110.1.33-110.1.33-1~bpo12+110.1.34-0+deb12u110.1.34-0+deb12u210.1.34-110.1.35-110.1.40-110.1.40-1~bpo12+110.1.46-110.1.6-110.1.6-1+deb12u110.1.6-1+deb12u210.1.7-110.1.8-110.1.9-1	10.1.52-1~deb12u1
`tomcat10` Debian:13	before 10.1.52-1~deb13u1, plus listed versions 10.1.40-110.1.46-110.1.52-1~deb12u1	10.1.52-1~deb13u1
`tomcat10` Debian:14	before 10.1.46-1, plus listed versions 10.1.40-1	10.1.46-1
`tomcat11` Debian:13	before 11.0.15-1~deb13u1, plus listed versions 11.0.11-111.0.6-1	11.0.15-1~deb13u1
`tomcat11` Debian:14	before 11.0.11-1, plus listed versions 11.0.6-1	11.0.11-1
`tomcat9` Debian:12	before 9.0.70-2	9.0.70-2
`tomcat9` Debian:13	before 9.0.70-2	9.0.70-2
`tomcat9` Debian:14	before 9.0.70-2	9.0.70-2
`org.apache.tomcat:tomcat-catalina` Maven	11.0.0-M1 up to 11.0.8, plus listed versions 11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13 Show 25 moreShow less 11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.211.0.311.0.411.0.511.0.611.0.7	11.0.8
`org.apache.tomcat:tomcat-catalina` Maven	10.1.0-M1 up to 10.1.42, plus listed versions 10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14 Show 43 moreShow less 10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.3910.1.410.1.4010.1.4110.1.510.1.610.1.710.1.810.1.9	10.1.42
`org.apache.tomcat:tomcat-catalina` Maven	9.0.0.M1 up to 9.0.106, plus listed versions 9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17 Show 45 moreShow less 9.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.1009.0.1029.0.1049.0.1059.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.49.0.40	9.0.106
`org.apache.tomcat.embed:tomcat-embed-core` Maven	11.0.0-M1 up to 11.0.8, plus listed versions 11.0.011.0.0-M1011.0.0-M1111.0.0-M1211.0.0-M13 Show 25 moreShow less 11.0.0-M1411.0.0-M1511.0.0-M1611.0.0-M1711.0.0-M1811.0.0-M1911.0.0-M2011.0.0-M2111.0.0-M2211.0.0-M2411.0.0-M2511.0.0-M2611.0.0-M311.0.0-M411.0.0-M511.0.0-M611.0.0-M711.0.0-M911.0.111.0.211.0.311.0.411.0.511.0.611.0.7	11.0.8
`org.apache.tomcat.embed:tomcat-embed-core` Maven	10.1.0-M1 up to 10.1.42, plus listed versions 10.1.010.1.0-M1010.1.0-M1110.1.0-M1210.1.0-M14 Show 43 moreShow less 10.1.0-M1510.1.0-M1610.1.0-M1710.1.0-M210.1.0-M410.1.0-M510.1.0-M610.1.0-M710.1.0-M810.1.110.1.1010.1.1110.1.1210.1.1310.1.1410.1.1510.1.1610.1.1710.1.1810.1.1910.1.210.1.2010.1.2310.1.2410.1.2510.1.2610.1.2810.1.2910.1.3010.1.3110.1.3310.1.3410.1.3510.1.3610.1.3910.1.410.1.4010.1.4110.1.510.1.610.1.710.1.810.1.9	10.1.42
`org.apache.tomcat.embed:tomcat-embed-core` Maven	9.0.0.M1 up to 9.0.106, plus listed versions 9.0.0.M109.0.0.M119.0.0.M139.0.0.M159.0.0.M17 Show 45 moreShow less 9.0.0.M189.0.0.M199.0.0.M209.0.0.M219.0.0.M229.0.0.M259.0.0.M269.0.0.M279.0.0.M39.0.0.M49.0.0.M69.0.0.M89.0.0.M99.0.19.0.109.0.1009.0.1029.0.1049.0.1059.0.119.0.129.0.139.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.49.0.40	9.0.106
`tomcat` openEuler:20.03-LTS-SP4	before 9.0.100-8.oe2003sp4	9.0.100-8.oe2003sp4
`tomcat` openEuler:22.03-LTS-SP3	before 9.0.100-8.oe2203sp3	9.0.100-8.oe2203sp3
`tomcat` openEuler:22.03-LTS-SP4	before 9.0.100-8.oe2203sp4	9.0.100-8.oe2203sp4
`tomcat` openEuler:24.03-LTS-SP1	before 9.0.100-8.oe2403sp1	9.0.100-8.oe2403sp1
`tomcat` openEuler:24.03-LTS-SP2	before 9.0.100-8.oe2403sp2	9.0.100-8.oe2403sp2
`tomcat` openEuler:24.03-LTS	before 9.0.100-8.oe2403	9.0.100-8.oe2403
`tomcat9` Red Hat:enterprise_linux:10.2	before 1:9.0.110-2.el10_2	1:9.0.110-2.el10_2
`tomcat9-admin-webapps` Red Hat:enterprise_linux:10.2	before 1:9.0.110-2.el10_2	1:9.0.110-2.el10_2
`tomcat9-docs-webapp` Red Hat:enterprise_linux:10.2	before 1:9.0.110-2.el10_2	1:9.0.110-2.el10_2
`tomcat9-el-3.0-api` Red Hat:enterprise_linux:10.2	before 1:9.0.110-2.el10_2	1:9.0.110-2.el10_2
`tomcat9-jsp-2.3-api` Red Hat:enterprise_linux:10.2	before 1:9.0.110-2.el10_2	1:9.0.110-2.el10_2
`tomcat9-lib` Red Hat:enterprise_linux:10.2	before 1:9.0.110-2.el10_2	1:9.0.110-2.el10_2
`tomcat9-servlet-4.0-api` Red Hat:enterprise_linux:10.2	before 1:9.0.110-2.el10_2	1:9.0.110-2.el10_2
`tomcat9-webapps` Red Hat:enterprise_linux:10.2	before 1:9.0.110-2.el10_2	1:9.0.110-2.el10_2
`tomcat` Red Hat:enterprise_linux:10.2	before 1:10.1.49-1.el10	1:10.1.49-1.el10
`tomcat-admin-webapps` Red Hat:enterprise_linux:10.2	before 1:10.1.49-1.el10	1:10.1.49-1.el10
`tomcat-docs-webapp` Red Hat:enterprise_linux:10.2	before 1:10.1.49-1.el10	1:10.1.49-1.el10
`tomcat-el-5.0-api` Red Hat:enterprise_linux:10.2	before 1:10.1.49-1.el10	1:10.1.49-1.el10
`tomcat-jsp-3.1-api` Red Hat:enterprise_linux:10.2	before 1:10.1.49-1.el10	1:10.1.49-1.el10
`tomcat-lib` Red Hat:enterprise_linux:10.2	before 1:10.1.49-1.el10	1:10.1.49-1.el10
`tomcat-servlet-6.0-api` Red Hat:enterprise_linux:10.2	before 1:10.1.49-1.el10	1:10.1.49-1.el10
`tomcat-webapps` Red Hat:enterprise_linux:10.2	before 1:10.1.49-1.el10	1:10.1.49-1.el10
`tomcat` Red Hat:enterprise_linux:9::appstream	before 1:9.0.110-2.el9_8	1:9.0.110-2.el9_8
`tomcat-admin-webapps` Red Hat:enterprise_linux:9::appstream	before 1:9.0.110-2.el9_8	1:9.0.110-2.el9_8
`tomcat-docs-webapp` Red Hat:enterprise_linux:9::appstream	before 1:9.0.110-2.el9_8	1:9.0.110-2.el9_8
`tomcat-el-3.0-api` Red Hat:enterprise_linux:9::appstream	before 1:9.0.110-2.el9_8	1:9.0.110-2.el9_8
`tomcat-jsp-2.3-api` Red Hat:enterprise_linux:9::appstream	before 1:9.0.110-2.el9_8	1:9.0.110-2.el9_8
`tomcat-lib` Red Hat:enterprise_linux:9::appstream	before 1:9.0.110-2.el9_8	1:9.0.110-2.el9_8
`tomcat-servlet-4.0-api` Red Hat:enterprise_linux:9::appstream	before 1:9.0.110-2.el9_8	1:9.0.110-2.el9_8
`tomcat-webapps` Red Hat:enterprise_linux:9::appstream	before 1:9.0.110-2.el9_8	1:9.0.110-2.el9_8
`jws6-tomcat` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-7.redhat_00006.1.el10jws	0:10.1.49-7.redhat_00006.1.el10jws
`jws6-tomcat-admin-webapps` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-7.redhat_00006.1.el10jws	0:10.1.49-7.redhat_00006.1.el10jws
`jws6-tomcat-docs-webapp` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-7.redhat_00006.1.el10jws	0:10.1.49-7.redhat_00006.1.el10jws
`jws6-tomcat-el-5.0-api` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-7.redhat_00006.1.el10jws	0:10.1.49-7.redhat_00006.1.el10jws
`jws6-tomcat-javadoc` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-7.redhat_00006.1.el10jws	0:10.1.49-7.redhat_00006.1.el10jws
`jws6-tomcat-jsp-3.1-api` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-7.redhat_00006.1.el10jws	0:10.1.49-7.redhat_00006.1.el10jws
`jws6-tomcat-lib` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-7.redhat_00006.1.el10jws	0:10.1.49-7.redhat_00006.1.el10jws
`jws6-tomcat-selinux` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-7.redhat_00006.1.el10jws	0:10.1.49-7.redhat_00006.1.el10jws
`jws6-tomcat-servlet-6.0-api` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-7.redhat_00006.1.el10jws	0:10.1.49-7.redhat_00006.1.el10jws
`jws6-tomcat-webapps` Red Hat:jboss_enterprise_web_server:6.2::el10	before 0:10.1.49-7.redhat_00006.1.el10jws	0:10.1.49-7.redhat_00006.1.el10jws
`jws6-tomcat` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-7.redhat_00006.1.el8jws	0:10.1.49-7.redhat_00006.1.el8jws
`jws6-tomcat-admin-webapps` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-7.redhat_00006.1.el8jws	0:10.1.49-7.redhat_00006.1.el8jws
`jws6-tomcat-docs-webapp` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-7.redhat_00006.1.el8jws	0:10.1.49-7.redhat_00006.1.el8jws
`jws6-tomcat-el-5.0-api` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-7.redhat_00006.1.el8jws	0:10.1.49-7.redhat_00006.1.el8jws
`jws6-tomcat-javadoc` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-7.redhat_00006.1.el8jws	0:10.1.49-7.redhat_00006.1.el8jws
`jws6-tomcat-jsp-3.1-api` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-7.redhat_00006.1.el8jws	0:10.1.49-7.redhat_00006.1.el8jws
`jws6-tomcat-lib` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-7.redhat_00006.1.el8jws	0:10.1.49-7.redhat_00006.1.el8jws
`jws6-tomcat-selinux` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-7.redhat_00006.1.el8jws	0:10.1.49-7.redhat_00006.1.el8jws
`jws6-tomcat-servlet-6.0-api` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-7.redhat_00006.1.el8jws	0:10.1.49-7.redhat_00006.1.el8jws
`jws6-tomcat-webapps` Red Hat:jboss_enterprise_web_server:6.2::el8	before 0:10.1.49-7.redhat_00006.1.el8jws	0:10.1.49-7.redhat_00006.1.el8jws
`jws6-tomcat` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-7.redhat_00006.1.el9jws	0:10.1.49-7.redhat_00006.1.el9jws
`jws6-tomcat-admin-webapps` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-7.redhat_00006.1.el9jws	0:10.1.49-7.redhat_00006.1.el9jws
`jws6-tomcat-docs-webapp` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-7.redhat_00006.1.el9jws	0:10.1.49-7.redhat_00006.1.el9jws
`jws6-tomcat-el-5.0-api` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-7.redhat_00006.1.el9jws	0:10.1.49-7.redhat_00006.1.el9jws
`jws6-tomcat-javadoc` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-7.redhat_00006.1.el9jws	0:10.1.49-7.redhat_00006.1.el9jws
`jws6-tomcat-jsp-3.1-api` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-7.redhat_00006.1.el9jws	0:10.1.49-7.redhat_00006.1.el9jws
`jws6-tomcat-lib` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-7.redhat_00006.1.el9jws	0:10.1.49-7.redhat_00006.1.el9jws
`jws6-tomcat-selinux` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-7.redhat_00006.1.el9jws	0:10.1.49-7.redhat_00006.1.el9jws
`jws6-tomcat-servlet-6.0-api` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-7.redhat_00006.1.el9jws	0:10.1.49-7.redhat_00006.1.el9jws
`jws6-tomcat-webapps` Red Hat:jboss_enterprise_web_server:6.2::el9	before 0:10.1.49-7.redhat_00006.1.el9jws	0:10.1.49-7.redhat_00006.1.el9jws
`tomcat11` Red Hat:hummingbird:1	before 0:11.0.21-0.1.hum1	0:11.0.21-0.1.hum1
`tomcat11-admin-webapps` Red Hat:hummingbird:1	before 0:11.0.21-0.1.hum1	0:11.0.21-0.1.hum1
`tomcat11-docs-webapp` Red Hat:hummingbird:1	before 0:11.0.21-0.1.hum1	0:11.0.21-0.1.hum1
`tomcat11-el-6.0-api` Red Hat:hummingbird:1	before 0:11.0.21-0.1.hum1	0:11.0.21-0.1.hum1
`tomcat11-jsp-4.0-api` Red Hat:hummingbird:1	before 0:11.0.21-0.1.hum1	0:11.0.21-0.1.hum1
`tomcat11-lib` Red Hat:hummingbird:1	before 0:11.0.21-0.1.hum1	0:11.0.21-0.1.hum1
`tomcat11-servlet-6.1-api` Red Hat:hummingbird:1	before 0:11.0.21-0.1.hum1	0:11.0.21-0.1.hum1
`tomcat11-webapps` Red Hat:hummingbird:1	before 0:11.0.21-0.1.hum1	0:11.0.21-0.1.hum1
`tomcat9` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-admin-webapps` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-docs-webapp` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-el-3.0-api` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-jsp-2.3-api` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-lib` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-servlet-4.0-api` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat9-webapps` Red Hat:enterprise_linux_eus:10.0	before 1:9.0.120-1.el10_0	1:9.0.120-1.el10_0
`tomcat` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-admin-webapps` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-docs-webapp` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-el-3.0-api` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-jsp-2.3-api` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-lib` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-servlet-4.0-api` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat-webapps` Red Hat:rhel_eus:9.6::appstream	before 1:9.0.120-1.el9_6	1:9.0.120-1.el9_6
`tomcat` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-admin-webapps` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-docs-webapp` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-el-3.0-api` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-jsp-2.3-api` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-lib` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-servlet-4.0-api` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat-webapps` Red Hat:enterprise_linux:8::appstream	before 1:9.0.120-1.el8_10	1:9.0.120-1.el8_10
`tomcat` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-admin-webapps` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-docs-webapp` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-el-3.0-api` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-jsp-2.3-api` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-lib` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-servlet-4.0-api` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat-webapps` Red Hat:rhel_e4s:9.2::appstream	before 1:9.0.120-1.el9_2	1:9.0.120-1.el9_2
`tomcat` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-admin-webapps` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-docs-webapp` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-el-3.0-api` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-jsp-2.3-api` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-lib` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-servlet-4.0-api` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat-webapps` Red Hat:rhel_e4s:9.4::appstream	before 1:9.0.120-1.el9_4	1:9.0.120-1.el9_4
`tomcat` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-admin-webapps` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-docs-webapp` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-el-3.0-api` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-jsp-2.3-api` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-lib` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-servlet-4.0-api` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-webapps` Red Hat:rhel_e4s:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-admin-webapps` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-docs-webapp` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-el-3.0-api` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-jsp-2.3-api` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-lib` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-servlet-4.0-api` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat-webapps` Red Hat:rhel_tus:8.8::appstream	before 1:9.0.120-1.el8_8	1:9.0.120-1.el8_8
`tomcat10` Red Hat:hummingbird:1	before 0:10.1.54-1.hum1	0:10.1.54-1.hum1
`tomcat10-admin-webapps` Red Hat:hummingbird:1	before 0:10.1.54-1.hum1	0:10.1.54-1.hum1
`tomcat10-common` Red Hat:hummingbird:1	before 0:10.1.54-1.hum1	0:10.1.54-1.hum1
`tomcat10-docs-webapp` Red Hat:hummingbird:1	before 0:10.1.54-1.hum1	0:10.1.54-1.hum1
`tomcat10-el-5.0-api` Red Hat:hummingbird:1	before 0:10.1.54-1.hum1	0:10.1.54-1.hum1
`tomcat10-jsp-3.1-api` Red Hat:hummingbird:1	before 0:10.1.54-1.hum1	0:10.1.54-1.hum1
`tomcat10-lib` Red Hat:hummingbird:1	before 0:10.1.54-1.hum1	0:10.1.54-1.hum1
`tomcat10-servlet-6.0-api` Red Hat:hummingbird:1	before 0:10.1.54-1.hum1	0:10.1.54-1.hum1
`tomcat10-user-instance` Red Hat:hummingbird:1	before 0:10.1.54-1.hum1	0:10.1.54-1.hum1
`tomcat10-webapps` Red Hat:hummingbird:1	before 0:10.1.54-1.hum1	0:10.1.54-1.hum1
`tomcat` Rocky Linux:10	before 1:10.1.49-1.el10_2.1	1:10.1.49-1.el10_2.1
`io.root.org.apache.tomcat.embed:tomcat-embed-core` Root:Maven	before 10.1.16-root.io.12	10.1.16-root.io.1210.1.39-root.io.2010.1.30-root.io.1310.1.34-root.io.7
`org.apache.tomcat.embed:tomcat-embed-core` Root:Maven	before 10.1.16-aikido.12	10.1.16-aikido.1210.1.39-aikido.2010.1.30-aikido.1310.1.34-aikido.7
`io.root.org.apache.tomcat:tomcat-catalina` Root:Maven	before 11.0.8-root.io.1	11.0.8-root.io.111.0.8-root.io.211.0.8-root.io.3
`org.apache.tomcat:tomcat-catalina` Root:Maven	before 11.0.8-aikido.3	11.0.8-aikido.3
`tomcat8` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 8.0.26-18.0.28-18.0.30-18.0.32-18.0.32-1ubuntu1 Show 14 moreShow less 8.0.32-1ubuntu1.18.0.32-1ubuntu1.28.0.32-1ubuntu1.38.0.32-1ubuntu1.48.0.32-1ubuntu1.58.0.32-1ubuntu1.68.0.32-1ubuntu1.78.0.32-1ubuntu1.88.0.32-1ubuntu1.98.0.32-1ubuntu1.108.0.32-1ubuntu1.118.0.32-1ubuntu1.138.0.32-1ubuntu1.13+esm18.0.32-1ubuntu1.13+esm2	None known
`tomcat8` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 8.5.21-1ubuntu18.5.29-18.5.30-18.5.30-1ubuntu18.5.30-1ubuntu1.2 Show 11 moreShow less 8.5.30-1ubuntu1.38.5.30-1ubuntu1.48.5.39-1ubuntu1~18.04.18.5.39-1ubuntu1~18.04.28.5.39-1ubuntu1~18.04.38.5.39-1ubuntu1~18.04.3+esm18.5.39-1ubuntu1~18.04.3+esm28.5.39-1ubuntu1~18.04.3+esm38.5.39-1ubuntu1~18.04.3+esm48.5.39-1ubuntu1~18.04.3+esm58.5.39-1ubuntu1~18.04.3+esm6	None known
`tomcat9` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 9.0.16-3~18.04.19.0.16-3ubuntu0.18.04.19.0.16-3ubuntu0.18.04.29.0.16-3ubuntu0.18.04.2+esm19.0.16-3ubuntu0.18.04.2+esm2 Show 6 moreShow less 9.0.16-3ubuntu0.18.04.2+esm39.0.16-3ubuntu0.18.04.2+esm49.0.16-3ubuntu0.18.04.2+esm59.0.16-3ubuntu0.18.04.2+esm69.0.16-3ubuntu0.18.04.2+esm79.0.16-3ubuntu0.18.04.2+esm8	None known
`tomcat9` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 9.0.24-19.0.27-19.0.31-19.0.31-1ubuntu0.19.0.31-1ubuntu0.2 Show 10 moreShow less 9.0.31-1ubuntu0.39.0.31-1ubuntu0.49.0.31-1ubuntu0.59.0.31-1ubuntu0.69.0.31-1ubuntu0.79.0.31-1ubuntu0.89.0.31-1ubuntu0.99.0.31-1ubuntu0.9+esm19.0.31-1ubuntu0.9+esm29.0.31-1ubuntu0.9+esm3	None known
`tomcat9` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 9.0.43-39.0.54-19.0.55-19.0.58-19.0.58-1ubuntu0.1 Show 9 moreShow less 9.0.58-1ubuntu0.1+esm19.0.58-1ubuntu0.1+esm29.0.58-1ubuntu0.1+esm39.0.58-1ubuntu0.1+esm49.0.58-1ubuntu0.29.0.58-1ubuntu0.2+esm19.0.58-1ubuntu0.2+esm29.0.58-1ubuntu0.2+esm39.0.58-1ubuntu0.2+esm4	None known
`tomcat10` Ubuntu:24.04:LTS	All versions, plus listed versions 10.1.10-110.1.14-110.1.15-110.1.16-110.1.16-1ubuntu0.1~esm1 Show 4 moreShow less 10.1.16-1ubuntu0.1~esm210.1.16-1ubuntu0.1~esm310.1.16-1ubuntu0.1~esm410.1.55-1ubuntu2~24.04.1	None known
`tomcat10` Ubuntu:25.10	All versions, plus listed versions 10.1.35-110.1.40-110.1.40-1ubuntu110.1.40-1ubuntu1.25.10.1	None known
`tomcat11` Ubuntu:25.10	All versions, plus listed versions 11.0.6-1	None known
`tomcat10` Ubuntu:26.10	All versions, plus listed versions 10.1.40-1ubuntu110.1.54-110.1.54-1ubuntu110.1.54-1ubuntu210.1.55-1ubuntu110.1.55-1ubuntu210.1.57~us1-0ubuntu1	None known
`tomcat10` Ubuntu:26.04:LTS	All versions, plus listed versions 10.1.40-1ubuntu110.1.40-1ubuntu1.26.04.110.1.55-1ubuntu2~26.04.1	None known
`tomcat11` Ubuntu:26.04:LTS	All versions, plus listed versions 11.0.6-111.0.11-111.0.15-111.0.18-111.0.18-1ubuntu0.1~esm111.0.22-2ubuntu2~26.04.1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	gregk4sec/CVE-2025-55668	2025-08-13

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-55668 is a medium vulnerability (CVSS 6.5) in Apache Tomcat, published August 13, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in org.apache.tomcat:tomcat-catalina 11.0.8.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 108 versions and 63 references. The JSON record has them.