Apache Tomcat vulnerabilities

• apache tomcat native Apache Tomcat Native: Client certificate requirements can be down-graded CVE-2026-86247 Fix available 7.4 HighSeptember 23, 2026
• apache tomcat native Apache Tomcat Native: Insecure OpenSSL options enabled CVE-2026-86246 Fix available 9.1 CriticalSeptember 23, 2026
• apache tomcat native Apache Tomcat Native: DoS via TLS handshake CVE-2026-86243 Fix available 7.5 HighSeptember 23, 2026
• apache tomcat Apache Tomcat: Principal lookup can fail open in some cases CVE-2026-68569 Fix available 8.1 HighAugust 25, 2026
• apache tomcat Apache Tomcat: Authenticated WebSocket session survives end of HTTP session CVE-2026-73180 Fix available 6.8 MediumAugust 19, 2026
• apache tomcat Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset CVE-2026-68763 Fix available 7.5 HighAugust 19, 2026
• apache tomcat Apache Tomcat: Redirect after FORM auth may bypass method specific constraints CVE-2026-68525 Fix available 9.1 CriticalAugust 19, 2026
• apache tomcat Apache Tomcat: Servlet role references can bypass declarative role constraints CVE-2026-66422 Fix available 8.1 HighAugust 19, 2026
• apache tomcat Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control CVE-2026-65927 Fix available 7.5 HighAugust 19, 2026
• apache tomcat Apache Tomcat: Limited replay attack possible with DIGEST authentication CVE-2026-65905 Fix available 9.8 CriticalAugust 19, 2026
• apache tomcat Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete CVE-2026-65637 Fix available 9.8 CriticalAugust 19, 2026
• apache tomcat Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets CVE-2026-65183 Fix available 8.1 HighAugust 19, 2026
• apache tomcat Apache Tomcat: Bypass longest prefix security constraint CVE-2026-65182 Fix available 9.1 CriticalAugust 19, 2026
• apache tomcat Apache Tomcat: DoS via WebSocket chat example CVE-2026-66299 Fix available 5.3 MediumJuly 28, 2026
• apache tomcat Apache Tomcat: EncryptInterceptor requirements not clearly documented CVE-2026-59084 Fix available 9.1 CriticalJuly 14, 2026
• apache tomcat Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass CVE-2026-59083 Fix available 9.1 CriticalJuly 14, 2026
• apache tomcat Apache Tomcat: Security constraints for default servlet ignored method CVE-2026-55956 Fix available 6.5 MediumJune 29, 2026
• apache tomcat Apache Tomcat: EncryptInterceptor not protected against replay attacks CVE-2026-55955 Fix available 6.5 MediumJune 29, 2026
• apache tomcat Apache Tomcat: Logged effective web.xml is incomplete CVE-2026-55276 Fix available 9.1 CriticalJune 29, 2026
• apache tomcat Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector CVE-2026-53434 Fix available 9.1 CriticalJune 29, 2026
• apache tomcat Apache Tomcat: Bad ornext processing in RewriteValve CVE-2026-53404 Fix available 7.3 HighJune 29, 2026
• apache tomcat Apache Tomcat: XSS in number guess example CVE-2026-50229 Public exploitFix available 6.1 MediumJune 29, 2026
• apache tomcat Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind CVE-2026-55957 Public exploitFix available 7.3 HighMay 19, 2026
• apache tomcat Apache Tomcat: Security constraints not correctly applied CVE-2026-43515 Public exploitFix available 9.1 CriticalMay 12, 2026
• apache tomcat Apache Tomcat: AJP secret compared in non-constant time CVE-2026-43514 Fix available 3.7 LowMay 12, 2026
• apache tomcat Apache Tomcat: LockOutRealm treats user names as case-sensitive CVE-2026-43513 Fix available 7.5 HighMay 12, 2026
• apache tomcat Apache Tomcat: Digest authenticator will authenticate any unknown user CVE-2026-43512 Public exploitFix available 9.8 CriticalMay 12, 2026
• apache tomcat Apache Tomcat: HTTP/2 request headers not validated CVE-2026-41293 Public exploitFix available 9.8 CriticalMay 12, 2026
• apache tomcat Apache Tomcat: WebSocket authentication header exposure CVE-2026-42498 Fix available 7.3 HighMay 12, 2026
• apache tomcat Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling CVE-2026-41284 Fix available 7.5 HighMay 12, 2026
• apache tomcat Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled CVE-2026-34500 Fix available 6.5 MediumApril 9, 2026
• apache tomcat Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token CVE-2026-34487 Fix available 7.5 HighApril 9, 2026
• apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +21 more +23 more Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor CVE-2026-34486 In KEVPublic exploitFix available EPSS 98.5% 7.5 HighApril 9, 2026
• apache tomcat Apache Tomcat: Incomplete escaping of JSON access logs CVE-2026-34483 Fix available 7.5 HighApril 9, 2026
• apache tomcat Apache Tomcat: Fix for CVE-2025-66614 is incomplete CVE-2026-32990 Fix available 5.3 MediumApril 9, 2026
• apache tomcat, red hat enterprise linux 10, enterprise linux 10.0 extended update support +18 more +20 more Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default CVE-2026-29146 Fix available 7.5 HighApril 9, 2026
• apache tomcat, tomcat native +1 more Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled CVE-2026-29145 Public exploitFix available 9.1 CriticalApril 9, 2026
• apache tomcat Apache Tomcat: TLS cipher order is not preserved CVE-2026-29129 Fix available 7.5 HighApril 9, 2026
• apache tomcat Apache Tomcat: Occasionally open redirect CVE-2026-25854 Public exploitFix available 6.1 MediumApril 9, 2026
• apache tomcat Apache Tomcat: Request smuggling via invalid chunk extension CVE-2026-24880 Public exploitFix available 7.5 HighApril 9, 2026
• apache tomcat, tomcat native, red hat enterprise linux 10 +10 more +12 more Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass CVE-2026-24734 Fix available 7.5 HighFebruary 5, 2026
• apache tomcat Apache Tomcat: Security constraint bypass with HTTP/0.9 CVE-2026-24733 Public exploitFix available 3.7 LowFebruary 5, 2026
• apache tomcat Apache Tomcat: Client certificate verification bypass due to virtual host mapping CVE-2025-66614 Fix available 9.1 CriticalFebruary 5, 2026
• apache tomcat, siemens simatic cn 4100 +1 more Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS CVE-2025-61795 Fix available 5.3 MediumOctober 27, 2025
• apache tomcat, siemens simatic cn 4100 +1 more Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled CVE-2025-55752 Public exploitFix available EPSS 64.4% 7.5 HighOctober 27, 2025
• apache tomcat, siemens simatic cn 4100 +1 more Apache Tomcat: console manipulation via escape sequences in log messages CVE-2025-55754 Fix available EPSS 10.2% 9.6 CriticalOctober 27, 2025
• apache tomcat Apache Tomcat: session fixation via rewrite valve CVE-2025-55668 Public exploitFix available 6.5 MediumAugust 13, 2025
• apache tomcat, siemens simatic cn 4100 +1 more Apache Tomcat: h2 DoS - Made You Reset CVE-2025-48989 Fix available 7.5 HighAugust 13, 2025
• apache tomcat Apache Tomcat: DoS via excessive h2 streams at connection start CVE-2025-53506 Fix available 7.5 HighJuly 10, 2025
• apache tomcat Apache Tomcat: DoS via integer overflow in multipart file upload CVE-2025-52520 Fix available 7.5 HighJuly 10, 2025
• Show olderLoading…