Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat@9.0.69
purl pkg:maven/org.apache.tomcat/tomcat@9.0.69
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 4.4
Vulnerabilities affecting this package (115)
Advisory Summary Fixed in package version
CVE-2018-8014

Low: CORS filter has insecure defaults
8.0.53
Vulnerable
8.5.32
Vulnerable
CVE-2016-6797

Low: Unrestricted Access to Global Resources
8.5.5
Vulnerable
CVE-2016-6796

Low: Security Manager Bypass
8.5.5
Vulnerable
CVE-2016-6794

Low: System Property Disclosure
8.5.5
Vulnerable
CVE-2016-5018

Low: Security Manager Bypass
8.5.5
Vulnerable
CVE-2016-0762

Low: Timing Attack
8.5.5
Vulnerable
CVE-2016-3092

Moderate: Denial of Service
8.5.3
Vulnerable
CVE-2013-4286

Important: Information disclosure There are no reported fixed by versions.
CVE-2018-8014

Low: CORS filter has insecure defaults There are no reported fixed by versions.
GHSA-hgrr-935x-pq79
Aliases:
CVE-2025-61795
Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …
9.0.110
Vulnerable
GHSA-vfww-5hm6-hx2j
Aliases:
CVE-2025-55754
Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences Tomcat did not escape ANSI escape sequences in …
9.0.109
Vulnerable
GHSA-wmwf-9ccg-fff5
Aliases:
CVE-2025-55752
Apache Tomcat Vulnerable to Relative Path Traversal The fix for bug 60013 introduced a regression where the rewritten URL was …
9.0.109
Vulnerable
GHSA-42wg-hm62-jcwg
Aliases:
CVE-2025-49124
Apache Tomcat installer for Windows has an untrusted search path vulnerability Untrusted Search Path vulnerability in Apache Tomcat installer for …
9.0.106
Vulnerable
GHSA-g8pj-r55q-5c2v
Aliases:
CVE-2023-42795
Apache Tomcat Incomplete Cleanup vulnerability Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from …
9.0.81
Vulnerable
GHSA-r6j3-px5g-cq3x
Aliases:
CVE-2023-45648
Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 …
9.0.81
Vulnerable
GHSA-q3mw-pvr8-9ggc
Aliases:
CVE-2023-41080
Apache Tomcat Open Redirect vulnerability URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue …
9.0.80
Vulnerable
GHSA-rv64-5gf8-9qq8
Aliases:
CVE-2026-34483
Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve Improper Encoding or Escaping of Output …
9.0.116
Vulnerable
GHSA-9m3c-qcxr-9x87
Aliases:
CVE-2026-25854
Apache Tomcat has an Open Redirect vulnerability Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via …
9.0.116
Vulnerable
GHSA-gx5v-xp9w-j4cg
Aliases:
CVE-2026-41284
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …
9.0.118
Vulnerable
GHSA-5mp6-jrq3-r938
Aliases:
CVE-2026-43513
Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …
9.0.118
Vulnerable
GHSA-5m62-pw8w-7w9f
Aliases:
CVE-2026-43515
Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …
9.0.118
Vulnerable
GHSA-fv25-8xcx-gqjc
Aliases:
CVE-2026-42498
Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …
9.0.118
Vulnerable
GHSA-h6fc-48rj-7qqh
Aliases:
CVE-2026-43512
Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …
9.0.118
Vulnerable
GHSA-9m89-8frq-c98c
Aliases:
CVE-2026-43514
Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …
9.0.118
Vulnerable
CVE-2023-46589

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from …
8.5.96
Vulnerable
9.0.83
Vulnerable
10.1.16
Vulnerable
GHSA-653p-vg55-5652
Aliases:
CVE-2024-54677
Apache Tomcat Uncontrolled Resource Consumption vulnerability Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads …
9.0.98
Vulnerable
9.0.98
Vulnerable
CVE-2026-24880
Aliases:
GHSA-563x-q5rq-57qp
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …
11.0.20
Vulnerable
10.1.52
Vulnerable
9.0.116
Vulnerable
11.0.20
Vulnerable
10.1.52
Vulnerable
9.0.116
Vulnerable
CVE-2025-61795
Aliases:
GHSA-hgrr-935x-pq79
Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …
11.0.12
Vulnerable
9.0.110
Vulnerable
10.1.47
Vulnerable
11.0.12
Vulnerable
9.0.110
Vulnerable
10.1.47
Vulnerable
CVE-2024-54677
Aliases:
GHSA-653p-vg55-5652
Apache Tomcat Uncontrolled Resource Consumption vulnerability Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads …
11.0.2
Vulnerable
10.1.34
Vulnerable
9.0.98
Vulnerable
11.0.2
Vulnerable
10.1.34
Vulnerable
9.0.98
Vulnerable
GHSA-x4m4-345f-5h5g
Aliases:
CVE-2026-34487
Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File Insertion of Sensitive Information into Log File vulnerability in …
9.0.117
Vulnerable
9.0.117
Vulnerable
9.0.117
Vulnerable
GHSA-r29c-68gh-xp6x
Aliases:
CVE-2026-41293
Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …
9.0.118
Vulnerable
9.0.118
Vulnerable
GHSA-fpj8-gq4v-p354
Aliases:
CVE-2025-66614
Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, …
9.0.113
Vulnerable
9.0.113
Vulnerable
GHSA-9xv2-5v5q-p794
Aliases:
CVE-2026-65905
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …
9.0.121
Vulnerable
GHSA-gcx9-497g-6cp6
Aliases:
CVE-2026-65182
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads …
9.0.121
Vulnerable
GHSA-h3x4-894j-xpx5
Aliases:
CVE-2026-68525
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows …
9.0.121
Vulnerable
CVE-2026-87022

Low: WebSocket message smuggling with per-message-deflate
9.0.122
Vulnerable
CVE-2026-79677

Moderate: WebSocket DoS due to lost asynchronous write timeout
9.0.122
Vulnerable
CVE-2026-78383

Important: AJP DoS via missing request body
9.0.122
Vulnerable
CVE-2026-77762

Low: Stale HPACK emitter injects trailers into recycled pooled Request
9.0.122
Vulnerable
CVE-2026-77756

Low: Transfer-Encoding honored for HTTP/1.0 requests
9.0.122
Vulnerable
CVE-2026-76183

Important: Bypass of security constraints for WebSocket endpoints
9.0.122
Vulnerable
CVE-2026-75973

Low: Cross-context authentication mix-up with Jakarta Authentication configured
9.0.122
Vulnerable
CVE-2026-73581

Moderate: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
9.0.122
Vulnerable
CVE-2026-73180

Low: Authenticated WebSocket session survives end of HTTP session
9.0.121
Vulnerable
CVE-2026-68763

Important: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
9.0.121
Vulnerable
CVE-2026-68569

Important: Principal lookup could fail open in some cases
9.0.121
Vulnerable
CVE-2026-68525

Low: Redirect after FORM authentication may bypass method specific constraints
9.0.121
Vulnerable
CVE-2026-66422

Low: Servlet role references can bypass declarative role constraints
9.0.121
Vulnerable
CVE-2026-65927

Important: RewriteValve [N] restarts at the second rule and may bypass access control
9.0.121
Vulnerable
CVE-2026-65905

Low: Limited replay attack possible with DIGEST authentication
9.0.121
Vulnerable
CVE-2026-65183

Low: TOCTOU when setting specific permissions for Unix Domain Sockets
9.0.121
Vulnerable
CVE-2026-65182

Important: Security constraint bypass
9.0.121
Vulnerable
CVE-2026-59084

Low: EncryptInterceptor requirements not clearly documented
9.0.120
Vulnerable
CVE-2026-59083

Low: Incorrect URL decoding in RewriteValve may allow security control bypass
9.0.120
Vulnerable
CVE-2026-55956

Moderate: Security constraints for default servlet ignored method
9.0.119
Vulnerable
CVE-2026-55955

Low: EncryptInterceptor not protected against replay attacks
9.0.119
Vulnerable
CVE-2026-55276

Low: Logged effective web.xml is incomplete
9.0.119
Vulnerable
CVE-2026-53404

Low: Bad ornext processing in RewriteValve
9.0.119
Vulnerable
CVE-2026-50229

Low: XSS in number guess example
9.0.119
Vulnerable
CVE-2026-43515

Moderate: Security constraints not correctly applied
9.0.118
Vulnerable
CVE-2026-43514

Low: AJP secret compared in non-constant time
9.0.118
Vulnerable
CVE-2026-43513

Low: LockOutRealm treats user names as case-sensitive
9.0.118
Vulnerable
CVE-2026-43512

Moderate: Digest authenticator will authenticate any unknown user
9.0.118
Vulnerable
CVE-2026-42498

Low: WebSocket authentication header exposure
9.0.118
Vulnerable
CVE-2026-41293

Low: HTTP/2 request headers not validated
9.0.118
Vulnerable
CVE-2026-41284

Low: Unbounded read in WebDAV LOCK and PROPFIND handling
9.0.118
Vulnerable
CVE-2026-34487

Low: Cloud membership for clustering component exposed the Kubernetes bearer token
9.0.117
Vulnerable
CVE-2026-29146

Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
9.0.116
Vulnerable
CVE-2026-34483

Low: Incomplete escaping of JSON access logs
9.0.117
Vulnerable
CVE-2025-66614

Moderate: The fix for CVE-2025-66614 was incomplete
9.0.113
Vulnerable
CVE-2026-25854

Low: Occasionally open redirect
9.0.116
Vulnerable
CVE-2026-24880

Low: Request smuggling via invalid chunk extension
9.0.116
Vulnerable
CVE-2026-24733

Low: Security constraint bypass
9.0.113
Vulnerable
CVE-2025-61795

Low: Delayed cleaning of multipart upload temporary files may lead to DoS
9.0.110
Vulnerable
CVE-2025-55754

Low: Console manipulation via escape sequences in log messages
9.0.109
Vulnerable
CVE-2025-55752

Important: Directory traversal via Rewrite Valve with possible remote code execution if PUT is enabled
9.0.109
Vulnerable
CVE-2025-48989

Important: DoS in HTTP/2 due to client triggered stream reset
9.0.108
Vulnerable
CVE-2025-52434

Important: APR/Native Connector crash leading to DoS
9.0.107
Vulnerable
CVE-2025-52520

Low: DoS due to overflow in file upload limit
9.0.107
Vulnerable
CVE-2025-53506

Important: DoS via excessive HTTP/2 streams
9.0.107
Vulnerable
CVE-2025-55668

Moderate: Session fixation possible via rewrite valve
9.0.106
Vulnerable
CVE-2025-49125

Moderate: Security constraint bypass for PreResources and PostResources
9.0.106
Vulnerable
CVE-2025-49124

Low: Side-loading via Tomcat installer for Windows
9.0.106
Vulnerable
CVE-2025-48988

Important: DoS in multipart upload
9.0.106
Vulnerable
CVE-2025-48976

Important: DoS in Commons FileUpload
9.0.106
Vulnerable
CVE-2025-46701

Low: CGI security constraint bypass
9.0.105
Vulnerable
CVE-2025-31651

Low: Rewrite rule bypass
9.0.104
Vulnerable
CVE-2026-55957

Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
9.0.102
Vulnerable
CVE-2025-24813

Important: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet -
9.0.99
Vulnerable
CVE-2024-56337

Important: Remote Code Execution via write enabled Default Servlet. Mitigation for CVE-2024-50379 was incomplete -
9.0.98
Vulnerable
CVE-2024-54677

Low: DoS in examples web application
9.0.98
Vulnerable
CVE-2024-50379

Important: Remote Code Execution via write enabled Default Servlet
9.0.98
Vulnerable
CVE-2024-52316

Low: Authentication Bypass
9.0.96
Vulnerable
CVE-2024-34750

Important: Denial of Service
9.0.90
Vulnerable
CVE-2024-38286

Important: Denial of Service
9.0.90
Vulnerable
CVE-2024-23672

Important: Denial of Service
9.0.86
Vulnerable
CVE-2024-24549

Important: Denial of Service
9.0.86
Vulnerable
CVE-2023-46589

Important: Request smuggling
9.0.83
Vulnerable
CVE-2023-45648

Important: Request smuggling
9.0.81
Vulnerable
CVE-2023-44487

Important: Denial of Service
9.0.81
Vulnerable
CVE-2023-42795

Important: Information Disclosure
9.0.81
Vulnerable
CVE-2023-41080

Moderate: Open redirect
9.0.80
Vulnerable
CVE-2023-28708

Important: Apache Tomcat information disclosure
9.0.72
Vulnerable
CVE-2023-24998

Important: Apache Tomcat denial of service
9.0.71
Vulnerable
CVE-2018-8014

Low: CORS filter has insecure defaults There are no reported fixed by versions.
GHSA-h468-7pvh-8vr8
Aliases:
CVE-2026-29146
Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects …
9.0.116
Vulnerable
11.0.20
Vulnerable
9.0.116
Vulnerable
CVE-2026-55956

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method …
11.0.23
Vulnerable
10.1.56
Vulnerable
9.0.119
Vulnerable
CVE-2026-50229

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache …
11.0.23
Vulnerable
10.1.56
Vulnerable
9.0.119
Vulnerable
CVE-2026-59084

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This …
9.0.120
Vulnerable
11.0.25
Vulnerable
10.1.59
Vulnerable
CVE-2026-55955

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects …
11.0.23
Vulnerable
10.1.56
Vulnerable
9.0.119
Vulnerable
CVE-2026-65905
Aliases:
GHSA-9xv2-5v5q-p794
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …
11.0.25
Vulnerable
9.0.121
Vulnerable
CVE-2026-53404

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain …
11.0.23
Vulnerable
10.1.56
Vulnerable
9.0.119
Vulnerable
CVE-2026-101296

Important: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
9.0.123
Vulnerable
CVE-2026-80353

Low: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
9.0.123
Vulnerable
CVE-2026-74049

Low: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
9.0.123
Vulnerable
Vulnerabilities fixed by this package (2)

Advisory Summary Aliases
CVE-2022-45143
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 … GHSA-rq2w-37h9-vg94
CVE-2022-45143
Low: Apache Tomcat JsonErrorReportValve injection