Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat@10.1.55 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults |
Vulnerable Vulnerable |
|
CVE-2016-6797
|
Low: Unrestricted Access to Global Resources |
Vulnerable |
|
CVE-2016-6796
|
Low: Security Manager Bypass |
Vulnerable |
|
CVE-2016-6794
|
Low: System Property Disclosure |
Vulnerable |
|
CVE-2016-5018
|
Low: Security Manager Bypass |
Vulnerable |
|
CVE-2016-0762
|
Low: Timing Attack |
Vulnerable |
|
CVE-2016-3092
|
Moderate: Denial of Service |
Vulnerable |
|
CVE-2013-4286
|
Important: Information disclosure | There are no reported fixed by versions. |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
|
GHSA-9xv2-5v5q-p794
Aliases: CVE-2026-65905 |
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … | There are no reported fixed by versions. |
|
GHSA-gcx9-497g-6cp6
Aliases: CVE-2026-65182 |
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads … | There are no reported fixed by versions. |
|
GHSA-h3x4-894j-xpx5
Aliases: CVE-2026-68525 |
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows … | There are no reported fixed by versions. |
|
CVE-2026-87022
|
Low: WebSocket message smuggling with per-message-deflate |
Vulnerable |
|
CVE-2026-86350
|
Important: Regression in fix for CVE-2026-41293 can trigger request header mix-up |
Vulnerable |
|
CVE-2026-86248
|
Moderate: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled |
Vulnerable |
|
CVE-2026-79677
|
Moderate: WebSocket DoS due to lost asynchronous write timeout |
Vulnerable |
|
CVE-2026-78437
|
Low: HTTP/2 DoS via malformed request |
Vulnerable |
|
CVE-2026-78383
|
Important: AJP DoS via missing request body |
Vulnerable |
|
CVE-2026-77791
|
Important: DoS via busy wait during WebSocket close |
Vulnerable |
|
CVE-2026-77762
|
Low: Stale HPACK emitter injects trailers into recycled pooled Request |
Vulnerable |
|
CVE-2026-77756
|
Low: Transfer-Encoding honored for HTTP/1.0 requests |
Vulnerable |
|
CVE-2026-76183
|
Important: Bypass of security constraints for WebSocket endpoints |
Vulnerable |
|
CVE-2026-75973
|
Low: Cross-context authentication mix-up with Jakarta Authentication configured |
Vulnerable |
|
CVE-2026-73581
|
Moderate: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore |
Vulnerable |
|
CVE-2026-73180
|
Low: Authenticated WebSocket session survives end of HTTP session |
Vulnerable |
|
CVE-2026-68763
|
Important: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset |
Vulnerable |
|
CVE-2026-68569
|
Important: Principal lookup could fail open in some cases |
Vulnerable |
|
CVE-2026-68525
|
Low: Redirect after FORM authentication may bypass method specific constraints |
Vulnerable |
|
CVE-2026-66422
|
Low: Servlet role references can bypass declarative role constraints |
Vulnerable |
|
CVE-2026-66299
|
Low: DoS in WebSocket chat example |
Vulnerable |
|
CVE-2026-65927
|
Important: RewriteValve [N] restarts at the second rule and may bypass access control |
Vulnerable |
|
CVE-2026-65905
|
Low: Limited replay attack possible with DIGEST authentication |
Vulnerable |
|
CVE-2026-65637
|
Moderate: HTTP/2 no-authority bypass of strict SNI validation |
Vulnerable |
|
CVE-2026-65183
|
Low: TOCTOU when setting specific permissions for Unix Domain Sockets |
Vulnerable |
|
CVE-2026-65182
|
Important: Security constraint bypass |
Vulnerable |
|
CVE-2026-59084
|
Low: EncryptInterceptor requirements not clearly documented |
Vulnerable |
|
CVE-2026-59083
|
Low: Incorrect URL decoding in RewriteValve may allow security control bypass |
Vulnerable |
|
CVE-2026-55956
|
Moderate: Security constraints for default servlet ignored method |
Vulnerable |
|
CVE-2026-55955
|
Low: EncryptInterceptor not protected against replay attacks |
Vulnerable |
|
CVE-2026-55276
|
Low: Logged effective web.xml is incomplete |
Vulnerable |
|
CVE-2026-53434
|
Low: Invalid CRL configuration doesn't trigger failure for FFM Connector |
Vulnerable |
|
CVE-2026-53404
|
Low: Bad ornext processing in RewriteValve |
Vulnerable |
|
CVE-2026-50229
|
Low: XSS in number guess example |
Vulnerable |
|
CVE-2026-66299
|
Low: DoS in WebSocket chat example |
Vulnerable |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
|
CVE-2026-55956
|
Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-50229
|
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-59084
|
Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-55955
|
Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-65905
Aliases: GHSA-9xv2-5v5q-p794 |
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … |
Vulnerable Vulnerable |
|
CVE-2026-66299
|
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from … |
Vulnerable Vulnerable |
|
CVE-2026-53404
|
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-101356
|
Important: HTTP/2 request/response mix-up after error during async processing |
Vulnerable |
|
CVE-2026-101296
|
Important: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms |
Vulnerable |
|
CVE-2026-93446
|
Low: Possible TLS 1.3 connection failures |
Vulnerable |
|
CVE-2026-88041
|
Low: HTTP/2 trailer header cross-contamination |
Vulnerable |
|
CVE-2026-74049
|
Low: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) |
Vulnerable |
|
CVE-2026-74048
|
Low: OpenSSL-FFM FIPS failure does not prevent start-up |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-gx5v-xp9w-j4cg
|
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
CVE-2026-41284
|
|
GHSA-5mp6-jrq3-r938
|
Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This … |
CVE-2026-43513
|
|
GHSA-5m62-pw8w-7w9f
|
Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
CVE-2026-43515
|
|
GHSA-fv25-8xcx-gqjc
|
Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache … |
CVE-2026-42498
|
|
GHSA-h6fc-48rj-7qqh
|
Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
CVE-2026-43512
|
|
GHSA-9m89-8frq-c98c
|
Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to … |
CVE-2026-43514
|
|
GHSA-r29c-68gh-xp6x
|
Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
CVE-2026-41293
|
|
CVE-2026-43515
|
Moderate: Security constraints not correctly applied | |
|
CVE-2026-43514
|
Low: AJP secret compared in non-constant time | |
|
CVE-2026-43513
|
Low: LockOutRealm treats user names as case-sensitive | |
|
CVE-2026-43512
|
Moderate: Digest authenticator will authenticate any unknown user | |
|
CVE-2026-42498
|
Low: WebSocket authentication header exposure | |
|
CVE-2026-41293
|
Low: HTTP/2 request headers not validated | |
|
CVE-2026-41284
|
Low: Unbounded read in WebDAV LOCK and PROPFIND handling |