Apache Software Foundation Tomcat vulnerabilities

• apache software foundation tomcat Apache Tomcat: AJP response mix-up CVE-2026-103119 Fix available 9.1 CriticalOctober 20, 2026
• apache software foundation tomcat Apache Tomcat: HTTP/2 request/response mix-up after error during async processing CVE-2026-101356 Fix available 9.1 CriticalOctober 20, 2026
• apache software foundation tomcat Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms CVE-2026-101296 Fix available 9.1 CriticalOctober 20, 2026
• apache software foundation tomcat Apache Tomcat: Possible TLS 1.3 connection failures CVE-2026-93446 Fix available 7.5 HighOctober 20, 2026
• apache software foundation tomcat Apache Tomcat: HTTP/2 trailer header cross-contamination CVE-2026-88041 Fix available 7.5 HighOctober 20, 2026
• apache software foundation tomcat Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector CVE-2026-80353 Fix available 8.1 HighOctober 20, 2026
• apache software foundation tomcat Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) CVE-2026-74049 Fix available 6.1 MediumOctober 20, 2026
• apache software foundation tomcat Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up CVE-2026-74048 Fix available 6.5 MediumOctober 20, 2026
• apache tomcat native Apache Tomcat Native: Client certificate requirements can be down-graded CVE-2026-86247 Fix available 7.4 HighSeptember 23, 2026
• apache tomcat native Apache Tomcat Native: Insecure OpenSSL options enabled CVE-2026-86246 Fix available 9.1 CriticalSeptember 23, 2026
• apache tomcat native Apache Tomcat Native: DoS via TLS handshake CVE-2026-86243 Fix available 7.5 HighSeptember 23, 2026
• apache software foundation tomcat Apache Tomcat: WebSocket message smuggling with per-message-deflate CVE-2026-87022 Fix available 7.5 HighSeptember 22, 2026
• apache software foundation tomcat Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up CVE-2026-86350 Public exploitFix available 9.1 CriticalSeptember 22, 2026
• apache software foundation tomcat Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled CVE-2026-86248 Fix available 9.8 CriticalSeptember 22, 2026
• apache software foundation tomcat Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout CVE-2026-79677 Fix available 7.5 HighSeptember 22, 2026
• apache software foundation tomcat Apache Tomcat: HTTP/2 DoS via malformed request CVE-2026-78437 Fix available 7.3 HighSeptember 22, 2026
• apache software foundation tomcat Apache Tomcat: AJP DoS via missing request body CVE-2026-78383 Fix available 7.5 HighSeptember 22, 2026
• apache software foundation tomcat Apache Tomcat: DoS via busy wait during WebSocket close CVE-2026-77791 Fix available 7.5 HighSeptember 22, 2026
• apache software foundation tomcat Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request CVE-2026-77762 Fix available 8.1 HighSeptember 22, 2026
• apache software foundation tomcat Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests CVE-2026-77756 Fix available 3.7 LowSeptember 22, 2026
• apache software foundation tomcat Apache Tomcat: Bypass of security constraints for WebSocket endpoints CVE-2026-76183 Public exploitFix available 9.8 CriticalSeptember 22, 2026
• apache software foundation tomcat Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured CVE-2026-75973 Fix available 7.3 HighSeptember 22, 2026
• apache software foundation tomcat Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore CVE-2026-73581 Fix available 6.5 MediumSeptember 22, 2026
• apache tomcat Apache Tomcat: Principal lookup can fail open in some cases CVE-2026-68569 Fix available 8.1 HighAugust 25, 2026
• apache tomcat Apache Tomcat: Authenticated WebSocket session survives end of HTTP session CVE-2026-73180 Fix available 6.8 MediumAugust 19, 2026
• apache tomcat Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset CVE-2026-68763 Fix available 7.5 HighAugust 19, 2026
• apache tomcat Apache Tomcat: Redirect after FORM auth may bypass method specific constraints CVE-2026-68525 Fix available 9.1 CriticalAugust 19, 2026
• apache tomcat Apache Tomcat: Servlet role references can bypass declarative role constraints CVE-2026-66422 Fix available 8.1 HighAugust 19, 2026
• apache tomcat Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control CVE-2026-65927 Fix available 7.5 HighAugust 19, 2026
• apache tomcat Apache Tomcat: Limited replay attack possible with DIGEST authentication CVE-2026-65905 Fix available 9.8 CriticalAugust 19, 2026
• apache tomcat Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete CVE-2026-65637 Fix available 9.8 CriticalAugust 19, 2026
• apache tomcat Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets CVE-2026-65183 Fix available 8.1 HighAugust 19, 2026
• apache tomcat Apache Tomcat: Bypass longest prefix security constraint CVE-2026-65182 Fix available 9.1 CriticalAugust 19, 2026
• apache tomcat Apache Tomcat: DoS via WebSocket chat example CVE-2026-66299 Fix available 5.3 MediumJuly 28, 2026
• apache tomcat Apache Tomcat: EncryptInterceptor requirements not clearly documented CVE-2026-59084 Fix available 9.1 CriticalJuly 14, 2026
• apache tomcat Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass CVE-2026-59083 Fix available 9.1 CriticalJuly 14, 2026
• apache tomcat Apache Tomcat: Security constraints for default servlet ignored method CVE-2026-55956 Fix available 6.5 MediumJune 29, 2026
• apache tomcat Apache Tomcat: EncryptInterceptor not protected against replay attacks CVE-2026-55955 Fix available 6.5 MediumJune 29, 2026
• apache tomcat Apache Tomcat: Logged effective web.xml is incomplete CVE-2026-55276 Fix available 9.1 CriticalJune 29, 2026
• apache tomcat Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector CVE-2026-53434 Fix available 9.1 CriticalJune 29, 2026
• apache tomcat Apache Tomcat: Bad ornext processing in RewriteValve CVE-2026-53404 Fix available 7.3 HighJune 29, 2026
• apache tomcat Apache Tomcat: XSS in number guess example CVE-2026-50229 Public exploitFix available 6.1 MediumJune 29, 2026
• apache tomcat Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind CVE-2026-55957 Public exploitFix available 7.3 HighMay 19, 2026
• apache tomcat Apache Tomcat: Security constraints not correctly applied CVE-2026-43515 Public exploitFix available 9.1 CriticalMay 12, 2026
• apache tomcat Apache Tomcat: AJP secret compared in non-constant time CVE-2026-43514 Fix available 3.7 LowMay 12, 2026
• apache tomcat Apache Tomcat: LockOutRealm treats user names as case-sensitive CVE-2026-43513 Fix available 7.5 HighMay 12, 2026
• apache tomcat Apache Tomcat: Digest authenticator will authenticate any unknown user CVE-2026-43512 Public exploitFix available 9.8 CriticalMay 12, 2026
• apache tomcat Apache Tomcat: HTTP/2 request headers not validated CVE-2026-41293 Public exploitFix available 9.8 CriticalMay 12, 2026
• apache tomcat Apache Tomcat: WebSocket authentication header exposure CVE-2026-42498 Fix available 7.3 HighMay 12, 2026
• apache tomcat Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling CVE-2026-41284 Fix available 7.5 HighMay 12, 2026
• Show olderLoading…