Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@11.0.18
purl pkg:apache/tomcat@11.0.18
Next non-vulnerable version 11.0.27
Latest non-vulnerable version 11.0.27
Risk score
Vulnerabilities affecting this package (5)
Advisory Summary Fixed in package version
CVE-2026-24880

Low: Request smuggling via invalid chunk extension
11.0.20
Vulnerable
CVE-2026-25854

Low: Occasionally open redirect
11.0.20
Vulnerable
CVE-2026-29129

Low: Configured TLS cipher preference order not preserved
11.0.20
Vulnerable
CVE-2026-29145

Moderate: OCSP checks sometimes soft-fail even when soft-fail is disabled
11.0.20
Vulnerable
CVE-2026-29146

Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
11.0.20
Vulnerable
Vulnerabilities fixed by this package (1)
Advisory Summary Aliases
CVE-2026-24734
Moderate: Incomplete OCSP verification checks