Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@10.1.0-M1
purl pkg:apache/tomcat@10.1.0-M1
Next non-vulnerable version 10.1.2
Latest non-vulnerable version 11.0.27
Risk score
Vulnerabilities affecting this package (75)
Advisory Summary Fixed in package version
CVE-2021-42340

Important: Denial of Service
10.1.0
Vulnerable
CVE-2021-43980

High: Information Disclosure
10.1.0
Vulnerable
CVE-2022-23181

Low: Local Privilege Escalation
10.1.0
Vulnerable
CVE-2022-29885

Low: Apache Tomcat EncryptInterceptor DoS
10.1.0
Vulnerable
CVE-2022-34305

Low: Apache Tomcat XSS in examples web application
10.1.0
Vulnerable
CVE-2022-42252

Low: Apache Tomcat request smuggling
10.1.1
Vulnerable
CVE-2022-45143

Low: Apache Tomcat JsonErrorReportValve injection
10.1.2
Not vulnerable
CVE-2023-24998

Important: Apache Tomcat denial of service
10.1.5
Vulnerable
CVE-2023-28708

Important: Apache Tomcat information disclosure
10.1.6
Not vulnerable
CVE-2023-41080

Moderate: Open redirect
10.1.13
Vulnerable
CVE-2023-42795

Important: Information Disclosure
10.1.14
Not vulnerable
CVE-2023-44487

Important: Denial of Service
10.1.14
Not vulnerable
CVE-2023-45648

Important: Request smuggling
10.1.14
Not vulnerable
CVE-2023-46589

Important: Request smuggling
10.1.16
Not vulnerable
CVE-2024-23672

Important: Denial of Service
10.1.19
Not vulnerable
CVE-2024-24549

Important: Denial of Service
10.1.19
Not vulnerable
CVE-2024-34750

Important: Denial of Service
10.1.25
Vulnerable
CVE-2024-38286

Important: Denial of Service
10.1.25
Vulnerable
CVE-2024-50379

Important: Remote Code Execution via write enabled Default Servlet
10.1.34
Vulnerable
CVE-2024-52316

Low: Authentication Bypass
10.1.31
Vulnerable
CVE-2024-54677

Low: DoS in examples web application
10.1.34
Vulnerable
CVE-2024-56337

Important: Remote Code Execution via write enabled Default Servlet. Mitigation for CVE-2024-50379 was incomplete -
10.1.34
Vulnerable
CVE-2025-24813

Important: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet -
10.1.35
Not vulnerable
CVE-2025-31651

Low: Rewrite rule bypass
10.1.40
Vulnerable
CVE-2025-46701

Low: CGI security constraint bypass
10.1.41
Vulnerable
CVE-2025-48976

Important: DoS in Commons FileUpload
10.1.42
Vulnerable
CVE-2025-48988

Important: DoS in multipart upload
10.1.42
Vulnerable
CVE-2025-48989

Important: DoS in HTTP/2 due to client triggered stream reset
10.1.44
Vulnerable
CVE-2025-49125

Moderate: Security constraint bypass for PreResources and PostResources
10.1.42
Vulnerable
CVE-2025-52520

Low: DoS due to overflow in file upload limit
10.1.43
Vulnerable
CVE-2025-53506

Important: DoS via excessive HTTP/2 streams
10.1.43
Vulnerable
CVE-2025-55668

Moderate: Session fixation possible via rewrite valve
10.1.42
Vulnerable
CVE-2025-55752

Important: Directory traversal via Rewrite Valve with possible remote code execution if PUT is enabled
10.1.45
Not vulnerable
CVE-2025-55754

Low: Console manipulation via escape sequences in log messages
10.1.45
Not vulnerable
CVE-2025-61795

Low: Delayed cleaning of multipart upload temporary files may lead to DoS
10.1.47
Not vulnerable
CVE-2025-66614

Moderate: The fix for CVE-2025-66614 was incomplete
10.1.50
Vulnerable
CVE-2026-101296

Important: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
10.1.61
Not vulnerable
CVE-2026-24733

Low: Security constraint bypass
10.1.50
Vulnerable
CVE-2026-24880

Low: Request smuggling via invalid chunk extension
10.1.53
Vulnerable
CVE-2026-25854

Low: Occasionally open redirect
10.1.53
Vulnerable
CVE-2026-34483

Low: Incomplete escaping of JSON access logs
10.1.54
Vulnerable
CVE-2026-34487

Low: Cloud membership for clustering component exposed the Kubernetes bearer token
10.1.54
Vulnerable
CVE-2026-41284

Low: Unbounded read in WebDAV LOCK and PROPFIND handling
10.1.55
Vulnerable
CVE-2026-41293

Low: HTTP/2 request headers not validated
10.1.55
Vulnerable
CVE-2026-42498

Low: WebSocket authentication header exposure
10.1.55
Vulnerable
CVE-2026-43512

Moderate: Digest authenticator will authenticate any unknown user
10.1.55
Vulnerable
CVE-2026-43513

Low: LockOutRealm treats user names as case-sensitive
10.1.55
Vulnerable
CVE-2026-43514

Low: AJP secret compared in non-constant time
10.1.55
Vulnerable
CVE-2026-43515

Moderate: Security constraints not correctly applied
10.1.55
Vulnerable
CVE-2026-50229

Low: XSS in number guess example
10.1.56
Vulnerable
CVE-2026-53404

Low: Bad ornext processing in RewriteValve
10.1.56
Vulnerable
CVE-2026-55276

Low: Logged effective web.xml is incomplete
10.1.56
Vulnerable
CVE-2026-55955

Low: EncryptInterceptor not protected against replay attacks
10.1.56
Vulnerable
CVE-2026-55956

Moderate: Security constraints for default servlet ignored method
10.1.56
Vulnerable
CVE-2026-55957

Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
10.1.39
Vulnerable
CVE-2026-59083

Low: Incorrect URL decoding in RewriteValve may allow security control bypass
10.1.57
Vulnerable
CVE-2026-59084

Low: EncryptInterceptor requirements not clearly documented
10.1.57
Vulnerable
CVE-2026-65182

Important: Security constraint bypass
10.1.59
Vulnerable
CVE-2026-65183

Low: TOCTOU when setting specific permissions for Unix Domain Sockets
10.1.59
Vulnerable
CVE-2026-65905

Low: Limited replay attack possible with DIGEST authentication
10.1.59
Vulnerable
CVE-2026-65927

Important: RewriteValve [N] restarts at the second rule and may bypass access control
10.1.59
Vulnerable
CVE-2026-66422

Low: Servlet role references can bypass declarative role constraints
10.1.59
Vulnerable
CVE-2026-68525

Low: Redirect after FORM authentication may bypass method specific constraints
10.1.59
Vulnerable
CVE-2026-68569

Important: Principal lookup could fail open in some cases
10.1.59
Vulnerable
CVE-2026-68763

Important: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
10.1.59
Vulnerable
CVE-2026-73180

Low: Authenticated WebSocket session survives end of HTTP session
10.1.59
Vulnerable
CVE-2026-73581

Moderate: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
10.1.60
Vulnerable
CVE-2026-74049

Low: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
10.1.61
Not vulnerable
CVE-2026-75973

Low: Cross-context authentication mix-up with Jakarta Authentication configured
10.1.60
Vulnerable
CVE-2026-76183

Important: Bypass of security constraints for WebSocket endpoints
10.1.60
Vulnerable
CVE-2026-77756

Low: Transfer-Encoding honored for HTTP/1.0 requests
10.1.60
Vulnerable
CVE-2026-77762

Low: Stale HPACK emitter injects trailers into recycled pooled Request
10.1.60
Vulnerable
CVE-2026-78383

Important: AJP DoS via missing request body
10.1.60
Vulnerable
CVE-2026-79677

Moderate: WebSocket DoS due to lost asynchronous write timeout
10.1.60
Vulnerable
CVE-2026-87022

Low: WebSocket message smuggling with per-message-deflate
10.1.60
Vulnerable
This package is not known to fix any advisories.