org.apache.tomcat:tomcat vulnerabilities (Maven)
168 vulnerabilities.
-
org.apache.tomcat:tomcatMaven Apache Tomcat: Redirect after FORM auth may bypass method specific constraints 9.1 Critical -
org.apache.tomcat:tomcatMaven Apache Tomcat: Limited replay attack possible with DIGEST authentication 9.8 Critical -
org.apache.tomcat:tomcatMaven Apache Tomcat: Bypass longest prefix security constraint 9.1 Critical -
org.apache.tomcat:tomcatMaven Apache Tomcat: Security constraints for default servlet ignored method 6.5 Medium -
org.apache.tomcat:tomcatMaven Apache Tomcat: EncryptInterceptor not protected against replay attacks 6.5 Medium -
org.apache.tomcat:tomcatMaven Apache Tomcat: Logged effective web.xml is incomplete 9.1 Critical -
org.apache.tomcat:tomcatMaven Apache Tomcat: Bad ornext processing in RewriteValve 7.3 High -
org.apache.tomcat:tomcatMaven Apache Tomcat: XSS in number guess example 6.1 Medium -
org.apache.tomcat:tomcatMaven Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind 7.3 High -
org.apache.tomcat:tomcatMaven Apache Tomcat: Security constraints not correctly applied 9.1 Critical -
org.apache.tomcat:tomcatMaven Apache Tomcat: AJP secret compared in non-constant time 3.7 Low -
org.apache.tomcat:tomcatMaven Apache Tomcat: LockOutRealm treats user names as case-sensitive 7.5 High -
org.apache.tomcat:tomcatMaven Apache Tomcat: Digest authenticator will authenticate any unknown user 9.8 Critical -
org.apache.tomcat:tomcatMaven Apache Tomcat: HTTP/2 request headers not validated 9.8 Critical -
org.apache.tomcat:tomcatMaven Apache Tomcat: WebSocket authentication header exposure 7.3 High -
org.apache.tomcat:tomcatMaven Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling 7.5 High -
org.apache.tomcat:tomcatMaven Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token 7.5 High -
org.apache.tomcat:tomcatMaven Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor 7.5 High -
org.apache.tomcat:tomcatMaven Apache Tomcat: Incomplete escaping of JSON access logs 7.5 High -
org.apache.tomcat:tomcatMaven Apache Tomcat: Fix for CVE-2025-66614 is incomplete 5.3 Medium -
org.apache.tomcat:tomcatMaven Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default 7.5 High -
org.apache.tomcat:tomcatMaven Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled 9.1 Critical -
org.apache.tomcat:tomcatMaven Apache Tomcat: TLS cipher order is not preserved 7.5 High -
org.apache.tomcat:tomcatMaven Apache Tomcat: Occasionally open redirect 6.1 Medium -
org.apache.tomcat:tomcatMaven Apache Tomcat: Client certificate verification bypass due to virtual host mapping 9.1 Critical -
org.apache.tomcat:tomcatMaven Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS 5.3 Medium -
org.apache.tomcat:tomcatMaven Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled 7.5 High -
org.apache.tomcat:tomcatMaven Apache Tomcat: console manipulation via escape sequences in log messages 9.6 Critical -
org.apache.tomcat:tomcatMaven Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows 8.4 High -
org.apache.tomcat:tomcatMaven Apache Tomcat: DoS in examples web application 5.3 Medium -
org.apache.tomcat:tomcatMaven Apache Tomcat: Incorrect JSP tag recycling leads to XSS 6.1 Medium -
org.apache.tomcat:tomcatMaven Apache Tomcat: Trailer header parsing too lenient 5.3 Medium -
org.apache.tomcat:tomcatMaven Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests 5.3 Medium -
org.apache.tomcat:tomcatMaven Apache Tomcat: Open redirect with FORM authentication 6.1 Medium -
org.apache.tomcat:tomcatMaven Apache Tomcat: Information disclosure 3.7 Low -
org.apache.tomcat:tomcatMaven XSS in examples web application 6.1 Medium -
org.apache.tomcat:tomcatMaven EncryptInterceptor does not provide complete protection on insecure networks 7.5 High -
org.apache.tomcat:tomcatMaven Local privilege escalation with FileStore 7.0 High -
org.apache.tomcat:tomcatMaven DoS via memory leak with WebSocket connections 7.5 High -
org.apache.tomcat:tomcatMaven Apache Tomcat DoS with unexpected TLS packet 7.5 High -
org.apache.tomcat:tomcatMaven Incorrect Transfer-Encoding handling with HTTP/1.0 5.3 Medium -
org.apache.tomcat:tomcatMaven Auth weakness in JNDIRealm 6.5 Medium -
org.apache.tomcat:tomcatMaven DoS after non-blocking IO error 7.5 High -
org.apache.tomcat:tomcatMaven Response mix-up with WebSocket concurrent send and close 8.6 High -
org.apache.tomcat:tomcatMaven Infinite Loop in Apache Tomcat 7.5 High -
org.apache.tomcat:tomcatMaven Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat 7.5 High -
org.apache.tomcat:tomcatMaven Uncontrolled Resource Consumption in Apache Tomcat 7.5 High -
org.apache.tomcat:tomcatMaven Potential HTTP request smuggling in Apache Tomcat 4.8 Medium -
org.apache.tomcat:tomcatMaven Potential HTTP request smuggling in Apache Tomcat 4.8 Medium -
org.apache.tomcat:tomcatMaven Cross-site scripting in Apache Tomcat 6.1 Medium - Show olderLoading…