Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat-catalina@11.0.22 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-9xv2-5v5q-p794
Aliases: CVE-2026-65905 |
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … |
Vulnerable |
|
GHSA-gcx9-497g-6cp6
Aliases: CVE-2026-65182 |
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads … |
Vulnerable |
|
GHSA-h3x4-894j-xpx5
Aliases: CVE-2026-68525 |
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows … |
Vulnerable |
|
GHSA-xjgh-84hx-56c5
Aliases: CVE-2017-12617 |
Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, … |
Vulnerable |
|
CVE-2026-55956
|
Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-65927
|
Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at … |
Vulnerable Vulnerable |
|
CVE-2026-66422
|
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in … |
Vulnerable Vulnerable |
|
CVE-2026-55955
|
Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-73180
|
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-65637
|
Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-65905
Aliases: GHSA-9xv2-5v5q-p794 |
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … |
Vulnerable Vulnerable |
|
CVE-2026-59083
Aliases: GHSA-hcjr-322h-429r |
Apache Tomcat - Incorrect URL decoding in RewriteValve may allow security control bypass Improper Handling of URL Encoding (Hex Encoding) … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-53404
|
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-68569
|
Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated … |
Vulnerable Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-gx5v-xp9w-j4cg
|
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
CVE-2026-41284
|
|
GHSA-5mp6-jrq3-r938
|
Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This … |
CVE-2026-43513
|
|
GHSA-5m62-pw8w-7w9f
|
Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
CVE-2026-43515
|
|
GHSA-fv25-8xcx-gqjc
|
Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache … |
CVE-2026-42498
|
|
GHSA-h6fc-48rj-7qqh
|
Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
CVE-2026-43512
|
|
GHSA-9m89-8frq-c98c
|
Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to … |
CVE-2026-43514
|
|
CVE-2026-41293
|
Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
GHSA-r29c-68gh-xp6x
|