Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@11.0.0-M1
purl pkg:apache/tomcat@11.0.0-M1
Next non-vulnerable version 11.0.3
Latest non-vulnerable version 11.0.27
Risk score
Vulnerabilities affecting this package (72)
Advisory Summary Fixed in package version
CVE-2023-28708

Important: Apache Tomcat information disclosure
11.0.0
Vulnerable
CVE-2023-41080

Moderate: Open redirect
11.0.0
Vulnerable
CVE-2023-42795

Important: Information Disclosure
11.0.0
Vulnerable
CVE-2023-44487

Important: Denial of Service
11.0.0
Vulnerable
CVE-2023-45648

Important: Request smuggling
11.0.0
Vulnerable
CVE-2023-46589

Important: Request smuggling
11.0.0
Vulnerable
CVE-2024-23672

Important: Denial of Service
11.0.0
Vulnerable
CVE-2024-24549

Important: Denial of Service
11.0.0
Vulnerable
CVE-2024-34750

Important: Denial of Service
11.0.0
Vulnerable
CVE-2024-38286

Important: Denial of Service
11.0.0
Vulnerable
CVE-2024-50379

Important: Remote Code Execution via write enabled Default Servlet
11.0.2
Vulnerable
CVE-2024-52316

Low: Authentication Bypass
11.0.0
Vulnerable
CVE-2024-54677

Low: DoS in examples web application
11.0.2
Vulnerable
CVE-2024-56337

Important: Remote Code Execution via write enabled Default Servlet. Mitigation for CVE-2024-50379 was incomplete -
11.0.2
Vulnerable
CVE-2025-24813

Important: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet -
11.0.3
Not vulnerable
CVE-2025-31651

Low: Rewrite rule bypass
11.0.6
Vulnerable
CVE-2025-46701

Low: CGI security constraint bypass
11.0.7
Vulnerable
CVE-2025-48976

Important: DoS in Commons FileUpload
11.0.8
Vulnerable
CVE-2025-48988

Important: DoS in multipart upload
11.0.8
Vulnerable
CVE-2025-48989

Important: DoS in HTTP/2 due to client triggered stream reset
11.0.10
Vulnerable
CVE-2025-49124

Low: Side-loading via Tomcat installer for Windows
11.0.8
Vulnerable
CVE-2025-49125

Moderate: Security constraint bypass for PreResources and PostResources
11.0.8
Vulnerable
CVE-2025-52520

Low: DoS due to overflow in file upload limit
11.0.9
Vulnerable
CVE-2025-53506

Important: DoS via excessive HTTP/2 streams
11.0.9
Vulnerable
CVE-2025-55668

Moderate: Session fixation possible via rewrite valve
11.0.8
Vulnerable
CVE-2025-55752

Important: Directory traversal via Rewrite Valve with possible remote code execution if PUT is enabled
11.0.11
Vulnerable
CVE-2025-55754

Low: Console manipulation via escape sequences in log messages
11.0.11
Vulnerable
CVE-2025-61795

Low: Delayed cleaning of multipart upload temporary files may lead to DoS
11.0.12
Not vulnerable
CVE-2025-66614

Moderate: The fix for CVE-2025-66614 was incomplete
11.0.15
Vulnerable
CVE-2026-101296

Important: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
11.0.27
Not vulnerable
CVE-2026-24733

Low: Security constraint bypass
11.0.15
Vulnerable
CVE-2026-24734

Moderate: Incomplete OCSP verification checks
11.0.18
Vulnerable
CVE-2026-24880

Low: Request smuggling via invalid chunk extension
11.0.20
Vulnerable
CVE-2026-25854

Low: Occasionally open redirect
11.0.20
Vulnerable
CVE-2026-29145

Moderate: OCSP checks sometimes soft-fail even when soft-fail is disabled
11.0.20
Vulnerable
CVE-2026-29146

Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
11.0.20
Vulnerable
CVE-2026-34483

Low: Incomplete escaping of JSON access logs
11.0.21
Vulnerable
CVE-2026-34487

Low: Cloud membership for clustering component exposed the Kubernetes bearer token
11.0.21
Vulnerable
CVE-2026-41284

Low: Unbounded read in WebDAV LOCK and PROPFIND handling
11.0.22
Vulnerable
CVE-2026-41293

Low: HTTP/2 request headers not validated
11.0.22
Vulnerable
CVE-2026-42498

Low: WebSocket authentication header exposure
11.0.22
Vulnerable
CVE-2026-43512

Moderate: Digest authenticator will authenticate any unknown user
11.0.22
Vulnerable
CVE-2026-43513

Low: LockOutRealm treats user names as case-sensitive
11.0.22
Vulnerable
CVE-2026-43514

Low: AJP secret compared in non-constant time
11.0.22
Vulnerable
CVE-2026-43515

Moderate: Security constraints not correctly applied
11.0.22
Vulnerable
CVE-2026-50229

Low: XSS in number guess example
11.0.23
Vulnerable
CVE-2026-53404

Low: Bad ornext processing in RewriteValve
11.0.23
Vulnerable
CVE-2026-53434

Low: Invalid CRL configuration doesn't trigger failure for FFM Connector
11.0.23
Vulnerable
CVE-2026-55276

Low: Logged effective web.xml is incomplete
11.0.23
Vulnerable
CVE-2026-55955

Low: EncryptInterceptor not protected against replay attacks
11.0.23
Vulnerable
CVE-2026-55956

Moderate: Security constraints for default servlet ignored method
11.0.23
Vulnerable
CVE-2026-55957

Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
11.0.5
Vulnerable
CVE-2026-59083

Low: Incorrect URL decoding in RewriteValve may allow security control bypass
11.0.24
Vulnerable
CVE-2026-59084

Low: EncryptInterceptor requirements not clearly documented
11.0.24
Vulnerable
CVE-2026-65182

Important: Security constraint bypass
11.0.25
Vulnerable
CVE-2026-65183

Low: TOCTOU when setting specific permissions for Unix Domain Sockets
11.0.25
Vulnerable
CVE-2026-65905

Low: Limited replay attack possible with DIGEST authentication
11.0.25
Vulnerable
CVE-2026-65927

Important: RewriteValve [N] restarts at the second rule and may bypass access control
11.0.25
Vulnerable
CVE-2026-66422

Low: Servlet role references can bypass declarative role constraints
11.0.25
Vulnerable
CVE-2026-68525

Low: Redirect after FORM authentication may bypass method specific constraints
11.0.25
Vulnerable
CVE-2026-68569

Important: Principal lookup could fail open in some cases
11.0.25
Vulnerable
CVE-2026-68763

Important: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
11.0.25
Vulnerable
CVE-2026-73180

Low: Authenticated WebSocket session survives end of HTTP session
11.0.25
Vulnerable
CVE-2026-73581

Moderate: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
11.0.26
Vulnerable
CVE-2026-74049

Low: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
11.0.27
Not vulnerable
CVE-2026-75973

Low: Cross-context authentication mix-up with Jakarta Authentication configured
11.0.26
Vulnerable
CVE-2026-76183

Important: Bypass of security constraints for WebSocket endpoints
11.0.26
Vulnerable
CVE-2026-77756

Low: Transfer-Encoding honored for HTTP/1.0 requests
11.0.26
Vulnerable
CVE-2026-77762

Low: Stale HPACK emitter injects trailers into recycled pooled Request
11.0.26
Vulnerable
CVE-2026-78383

Important: AJP DoS via missing request body
11.0.26
Vulnerable
CVE-2026-79677

Moderate: WebSocket DoS due to lost asynchronous write timeout
11.0.26
Vulnerable
CVE-2026-87022

Low: WebSocket message smuggling with per-message-deflate
11.0.26
Vulnerable
This package is not known to fix any advisories.