Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@10.1.53
purl pkg:apache/tomcat@10.1.53
Next non-vulnerable version 10.1.61
Latest non-vulnerable version 11.0.27
Risk score
Vulnerabilities affecting this package (6)
Advisory Summary Fixed in package version
CVE-2026-29146

Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
10.1.54
Vulnerable
CVE-2026-34483

Low: Incomplete escaping of JSON access logs
10.1.54
Vulnerable
CVE-2026-34487

Low: Cloud membership for clustering component exposed the Kubernetes bearer token
10.1.54
Vulnerable
CVE-2026-34500

Moderate: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
10.1.54
Vulnerable
CVE-2026-65637

Moderate: HTTP/2 no-authority bypass of strict SNI validation
10.1.59
Vulnerable
CVE-2026-78437

Low: HTTP/2 DoS via malformed request
10.1.60
Vulnerable
Vulnerabilities fixed by this package (6)
Advisory Summary Aliases
CVE-2025-66614
Moderate: The fix for CVE-2025-66614 was incomplete
CVE-2026-24880
Low: Request smuggling via invalid chunk extension
CVE-2026-25854
Low: Occasionally open redirect
CVE-2026-29129
Low: Configured TLS cipher preference order not preserved
CVE-2026-29145
Moderate: OCSP checks sometimes soft-fail even when soft-fail is disabled
CVE-2026-29146
Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor