Skip to contentApache Tomcat vulnerabilities
- apache tomcatApache Tomcat: APR/Native Connector crash leading to DoSCVE-2025-52434Fix available7.5 High
- apache tomcatApache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for WindowsCVE-2025-49124Fix available8.4 High
- apache tomcatApache Tomcat: Security constraint bypass for pre/post-resourcesCVE-2025-49125Public exploitFix available7.5 High
- apache tomcatApache Tomcat: FileUpload large number of parts with headers DoSCVE-2025-48988Public exploitFix availableEPSS 31.5%7.5 High
- apache tomcatApache Tomcat: Security constraint bypass for CGI scriptsCVE-2025-46701Public exploitFix available7.3 High
- apache tomcatApache Tomcat: Bypass of rules in Rewrite ValveCVE-2025-31651Public exploitFix available9.8 Critical
- apache tomcatApache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frameCVE-2025-31650Public exploitFix availableEPSS 61.3%7.5 High
- apache tomcat, debian linux, netapp bootstrap os +2 moreApache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTCVE-2025-24813In KEVPublic exploitFix availableEPSS 99.9%9.8 Critical
- apache tomcat, netapp bootstrap os +1 moreApache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incompleteCVE-2024-56337Fix available9.8 Critical
- apache tomcat, netapp bootstrap os +1 moreApache Tomcat: DoS in examples web applicationCVE-2024-54677Fix available5.3 Medium
- apache tomcat, netapp bootstrap os +1 moreApache Tomcat: RCE due to TOCTOU issue in JSP compilationCVE-2024-50379Public exploitFix availableEPSS 31.8%9.8 Critical
- apache tomcatApache Tomcat: Incorrect JSP tag recycling leads to XSSCVE-2024-52318Public exploitFix available6.1 Medium
- apache tomcatApache Tomcat: Request/response mix-up with HTTP/2CVE-2024-52317Public exploitFix available6.5 Medium
- apache tomcat, debian linux +1 moreApache Tomcat: Authentication bypass when using Jakarta Authentication APICVE-2024-52316Public exploitFix available9.8 Critical
- apache tomcat connectors, debian linux +1 moreApache Tomcat Connectors: mod_jk: local users can view and modify configurationCVE-2024-46544Fix available5.9 Medium
- apache tomcat, netapp ontap tools +1 moreApache Tomcat: Denial of ServiceCVE-2024-38286Fix available8.6 High
- apache tomcat, netapp ontap tools +1 moreApache Tomcat: HTTP/2 excess header handling DoSCVE-2024-34750Fix available7.5 High
- apache tomcat, debian linux, fedoraproject fedora +2 moreApache Tomcat: WebSocket DoS with incomplete closing handshakeCVE-2024-23672Fix available6.3 Medium
- apache tomcat, debian linux, fedoraproject fedora +2 moreApache Tomcat: HTTP/2 header handling DoSCVE-2024-24549Public exploitFix availableEPSS 23.1%7.5 High
- apache tomcatApache Tomcat: Leaking of unrelated request bodies in default error pageCVE-2024-21733Public exploitFix availableEPSS 14.3%5.3 Medium
- apache tomcatApache Tomcat: HTTP request smuggling via malformed trailer headersCVE-2023-46589Fix available7.5 High
- apache tomcatApache Tomcat: FileUpload: DoS due to accumulation of temporary files on WindowsCVE-2023-42794Fix available5.9 Medium
- apache tomcat, debian linux +1 moreApache Tomcat: Trailer header parsing too lenientCVE-2023-45648Fix available5.3 Medium
- apache tomcat, accumulo, debian linux +2 moreApache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requestsCVE-2023-42795Fix available5.3 Medium
- apache tomcat connectorsApache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped requestCVE-2023-41081Fix available7.5 High
- apache tomcat, debian linux +1 moreApache Tomcat: Open redirect with FORM authenticationCVE-2023-41080Public exploitFix available6.1 Medium
- eclipse jetty, ietf http, http/2 +166 more +168 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarationsCVE-2023-44487In KEVPublic exploitFix availableEPSS 100.0%7.5 High
- apache tomcatApache Tomcat: AJP response header mix-upCVE-2023-34981Fix available7.5 High
- apache tomcat, debian linux, netapp 7-mode transition tool +2 moreApache Tomcat: Fix for CVE-2023-24998 is incompleteCVE-2023-28709Fix availableEPSS 48.0%7.5 High
- apache tomcatApache Tomcat: JSESSIONID Cookie missing secure attribute in some configurationsCVE-2023-28708Fix available4.3 Medium
- apache tomcatApache Tomcat: JsonErrorReportValve escapingCVE-2022-45143Fix available7.5 High
- apache tomcatApache Tomcat request smuggling via malformed content-lengthCVE-2022-42252Fix available7.5 High
- apache tomcat, debian linux +1 moreApache Tomcat: Information disclosureCVE-2021-43980Fix available3.7 Low
- apache tomcatXSS in examples web applicationCVE-2022-34305Fix available6.1 Medium
- apache tomcat, debian linux, oracle hospitality cruise shipboard property management system +2 moreEncryptInterceptor does not provide complete protection on insecure networksCVE-2022-29885Public exploitFix availableEPSS 73.5%7.5 High
- apache tomcat, debian linux, oracle agile engineering data management +4 more +6 moreLocal privilege escalation with FileStoreCVE-2022-23181Fix available7.0 High
- apache tomcat, debian linux, netapp hci +15 more +17 moreDoS via memory leak with WebSocket connectionsCVE-2021-42340Fix availableEPSS 11.8%7.5 High
- apache tomcat, debian linux, netapp management services for element software and netapp hci +2 moreApache Tomcat DoS with unexpected TLS packetCVE-2021-41079Fix available7.5 High
- apache tomcat, tomee, debian linux +19 more +21 moreIncorrect Transfer-Encoding handling with HTTP/1.0CVE-2021-33037Fix availableEPSS 74.7%5.3 Medium
- apache tomcat, debian linux, oracle communications cloud native core policy +4 more +6 moreAuth weakness in JNDIRealmCVE-2021-30640Fix available6.5 Medium
- apache tomcat, mcafee epolicy orchestrator, oracle big data spatial and graph +2 moreDoS after non-blocking IO errorCVE-2021-30639Fix available7.5 High
- apache tomcat, debian linux, oracle agile product lifecycle management +9 more +11 moreIncomplete fix for CVE-2020-9484CVE-2021-25329Fix available7.0 High
- apache tomcat, debian linux, oracle agile product lifecycle management +9 more +11 moreApache Tomcat h2c request mix-upCVE-2021-25122Fix availableEPSS 18.1%7.5 High
- apache tomcat, debian linux, oracle agile product lifecycle management +2 moreApache Tomcat information disclosureCVE-2021-24122Fix availableEPSS 22.9%5.9 Medium
- apache tomcat, debian linux, netapp element plug-in +9 more +11 moreApache Tomcat: Request header mix-up between HTTP/2 streamsCVE-2020-17527Public exploitFix availableEPSS 24.6%7.5 High
- apache tomcat, oracle agile product lifecycle management +1 moreResponse mix-up with WebSocket concurrent send and closeCVE-2022-25762Fix available8.6 High
- apache tomcat, debian linux, oracle instantis enterprisetrack +1 more +3 moreExposure of Sensitive Information to an Unauthorized Actor in Apache TomcatCVE-2020-13943Fix availableEPSS 52.6%4.3 Medium
- apache tomcat, canonical ubuntu linux, debian linux +15 more +17 moreInfinite Loop in Apache TomcatCVE-2020-13935Public exploitFix availableEPSS 86.6%7.5 High
- apache tomcat, canonical ubuntu linux, debian linux +11 more +13 moreImproper Restriction of Operations within the Bounds of a Memory Buffer in Apache TomcatCVE-2020-13934Fix availableEPSS 64.1%7.5 High
- apache tomcat, canonical ubuntu linux, debian linux +5 more +7 moreUncontrolled Resource Consumption in Apache TomcatCVE-2020-11996Public exploitFix availableEPSS 26.7%7.5 High
- Show moreLoading…