org.apache.tomcat:tomcat-catalina vulnerabilities (TuxCare)
94 vulnerabilities.
org.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Redirect after FORM auth may bypass method specific constraints9.1 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Limited replay attack possible with DIGEST authentication9.8 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Bypass longest prefix security constraint9.1 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector9.1 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Security constraints not correctly applied9.1 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: LockOutRealm treats user names as case-sensitive7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Digest authenticator will authenticate any unknown user9.8 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: HTTP/2 request headers not validated9.8 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: WebSocket authentication header exposure7.3 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Incomplete escaping of JSON access logs7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Fix for CVE-2025-66614 is incomplete5.3 Mediumorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled9.1 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Occasionally open redirect6.1 Mediumorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Request smuggling via invalid chunk extension7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat Native, Apache Tomcat: OCSP revocation bypass7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Security constraint bypass with HTTP/0.93.7 Loworg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Client certificate verification bypass due to virtual host mapping9.1 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS5.3 Mediumorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: console manipulation via escape sequences in log messages9.6 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: session fixation via rewrite valve6.5 Mediumorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: h2 DoS - Made You Reset7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: DoS via excessive h2 streams at connection start7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: DoS via integer overflow in multipart file upload7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: APR/Native Connector crash leading to DoS7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows8.4 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Security constraint bypass for pre/post-resources7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: FileUpload large number of parts with headers DoS7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Security constraint bypass for CGI scripts7.3 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Bypass of rules in Rewrite Valve9.8 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT9.8 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete9.8 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: DoS in examples web application5.3 Mediumorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: RCE due to TOCTOU issue in JSP compilation9.8 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Request/response mix-up with HTTP/26.5 Mediumorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Authentication bypass when using Jakarta Authentication API9.8 Criticalorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Denial of Service8.6 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: HTTP/2 excess header handling DoS7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: WebSocket DoS with incomplete closing handshake6.3 Mediumorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: HTTP/2 header handling DoS7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: HTTP request smuggling via malformed trailer headers7.5 Highorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows5.9 Mediumorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Trailer header parsing too lenient5.3 Mediumorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests5.3 Mediumorg.apache.tomcat:tomcat-catalinaTuxCareApache Tomcat: Open redirect with FORM authentication6.1 Medium- Show olderLoading…