Skip to contentApache Software Foundation Tomcat vulnerabilities
- apache tomcatApache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabledCVE-2026-34500Fix available6.5 Medium
- apache tomcatApache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer tokenCVE-2026-34487Fix available7.5 High
- apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +21 more +23 moreApache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptorCVE-2026-34486In KEVPublic exploitFix availableEPSS 98.5%7.5 High
- apache tomcatApache Tomcat: Incomplete escaping of JSON access logsCVE-2026-34483Fix available7.5 High
- apache tomcatApache Tomcat: Fix for CVE-2025-66614 is incompleteCVE-2026-32990Fix available5.3 Medium
- apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 moreApache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by defaultCVE-2026-29146Fix available7.5 High
- apache tomcat, tomcat native +1 moreApache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabledCVE-2026-29145Public exploitFix available9.1 Critical
- apache tomcatApache Tomcat: TLS cipher order is not preservedCVE-2026-29129Fix available7.5 High
- apache tomcatApache Tomcat: Occasionally open redirectCVE-2026-25854Public exploitFix available6.1 Medium
- apache tomcatApache Tomcat: Request smuggling via invalid chunk extensionCVE-2026-24880Public exploitFix available7.5 High
- apache tomcat, tomcat native, red hat enterprise linux 10 +10 more +12 moreApache Tomcat Native, Apache Tomcat: OCSP revocation bypassCVE-2026-24734Fix available7.5 High
- apache tomcatApache Tomcat: Security constraint bypass with HTTP/0.9CVE-2026-24733Public exploitFix available3.7 Low
- apache tomcatApache Tomcat: Client certificate verification bypass due to virtual host mappingCVE-2025-66614Fix available9.1 Critical
- apache tomcat, siemens simatic cn 4100 +1 moreApache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoSCVE-2025-61795Fix available5.3 Medium
- apache tomcat, siemens simatic cn 4100 +1 moreApache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabledCVE-2025-55752Public exploitFix availableEPSS 64.4%7.5 High
- apache tomcat, siemens simatic cn 4100 +1 moreApache Tomcat: console manipulation via escape sequences in log messagesCVE-2025-55754Fix availableEPSS 10.3%9.6 Critical
- apache tomcatApache Tomcat: session fixation via rewrite valveCVE-2025-55668Public exploitFix available6.5 Medium
- apache tomcat, siemens simatic cn 4100 +1 moreApache Tomcat: h2 DoS - Made You ResetCVE-2025-48989Fix available7.5 High
- apache tomcatApache Tomcat: DoS via excessive h2 streams at connection startCVE-2025-53506Fix available7.5 High
- apache tomcatApache Tomcat: DoS via integer overflow in multipart file uploadCVE-2025-52520Fix available7.5 High
- apache tomcatApache Tomcat: APR/Native Connector crash leading to DoSCVE-2025-52434Fix available7.5 High
- apache tomcatApache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for WindowsCVE-2025-49124Fix available8.4 High
- apache tomcatApache Tomcat: Security constraint bypass for pre/post-resourcesCVE-2025-49125Public exploitFix available7.5 High
- apache tomcatApache Tomcat: FileUpload large number of parts with headers DoSCVE-2025-48988Public exploitFix availableEPSS 31.5%7.5 High
- apache tomcatApache Tomcat: Security constraint bypass for CGI scriptsCVE-2025-46701Public exploitFix available7.3 High
- apache tomcatApache Tomcat: Bypass of rules in Rewrite ValveCVE-2025-31651Public exploitFix available9.8 Critical
- apache tomcatApache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frameCVE-2025-31650Public exploitFix availableEPSS 61.3%7.5 High
- apache tomcat, debian linux, netapp bootstrap os +2 moreApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTCVE-2025-24813In KEVPublic exploitFix availableEPSS 99.9%9.8 Critical
- apache tomcat, netapp bootstrap os +1 moreApache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incompleteCVE-2024-56337Fix available9.8 Critical
- apache tomcat, netapp bootstrap os +1 moreApache Tomcat: DoS in examples web applicationCVE-2024-54677Fix available5.3 Medium
- apache tomcat, netapp bootstrap os +1 moreApache Tomcat: RCE due to TOCTOU issue in JSP compilationCVE-2024-50379Public exploitFix availableEPSS 31.8%9.8 Critical
- apache tomcatApache Tomcat: Incorrect JSP tag recycling leads to XSSCVE-2024-52318Public exploitFix available6.1 Medium
- apache tomcatApache Tomcat: Request/response mix-up with HTTP/2CVE-2024-52317Public exploitFix available6.5 Medium
- apache tomcat, debian linux +1 moreApache Tomcat: Authentication bypass when using Jakarta Authentication APICVE-2024-52316Public exploitFix available9.8 Critical
- apache tomcat connectors, debian linux +1 moreApache Tomcat Connectors: mod_jk: local users can view and modify configurationCVE-2024-46544Fix available5.9 Medium
- apache tomcat, netapp ontap tools +1 moreApache Tomcat: Denial of ServiceCVE-2024-38286Fix available8.6 High
- apache tomcat, netapp ontap tools +1 moreApache Tomcat: HTTP/2 excess header handling DoSCVE-2024-34750Fix available7.5 High
- apache tomcat, debian linux, fedoraproject fedora +2 moreApache Tomcat: WebSocket DoS with incomplete closing handshakeCVE-2024-23672Fix available6.3 Medium
- apache tomcat, debian linux, fedoraproject fedora +2 moreApache Tomcat: HTTP/2 header handling DoSCVE-2024-24549Public exploitFix availableEPSS 23.1%7.5 High
- apache tomcatApache Tomcat: Leaking of unrelated request bodies in default error pageCVE-2024-21733Public exploitFix availableEPSS 14.3%5.3 Medium
- apache tomcatApache Tomcat: HTTP request smuggling via malformed trailer headersCVE-2023-46589Fix available7.5 High
- apache tomcatApache Tomcat: FileUpload: DoS due to accumulation of temporary files on WindowsCVE-2023-42794Fix available5.9 Medium
- apache tomcat, debian linux +1 moreApache Tomcat: Trailer header parsing too lenientCVE-2023-45648Fix available5.3 Medium
- apache tomcat, accumulo, debian linux +2 moreApache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requestsCVE-2023-42795Fix available5.3 Medium
- apache tomcat connectorsApache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped requestCVE-2023-41081Fix available7.5 High
- apache tomcat, debian linux +1 moreApache Tomcat: Open redirect with FORM authenticationCVE-2023-41080Public exploitFix available6.1 Medium
- apache tomcatApache Tomcat: AJP response header mix-upCVE-2023-34981Fix available7.5 High
- apache tomcat, debian linux, netapp 7-mode transition tool +2 moreApache Tomcat: Fix for CVE-2023-24998 is incompleteCVE-2023-28709Fix availableEPSS 48.0%7.5 High
- apache tomcatApache Tomcat: JSESSIONID Cookie missing secure attribute in some configurationsCVE-2023-28708Fix available4.3 Medium
- apache commons fileupload, apache software foundation tomcat, debian linux +2 moreApache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive partsCVE-2023-24998Public exploitFix availableEPSS 48.8%7.5 High
- Show moreLoading…