Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@11.0.20
purl pkg:apache/tomcat@11.0.20
Next non-vulnerable version 11.0.27
Latest non-vulnerable version 11.0.27
Risk score
Vulnerabilities affecting this package (5)
Advisory Summary Fixed in package version
CVE-2026-29146

Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
11.0.21
Vulnerable
CVE-2026-34483

Low: Incomplete escaping of JSON access logs
11.0.21
Vulnerable
CVE-2026-34487

Low: Cloud membership for clustering component exposed the Kubernetes bearer token
11.0.21
Vulnerable
CVE-2026-34500

Moderate: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
11.0.21
Vulnerable
CVE-2026-65637

Moderate: HTTP/2 no-authority bypass of strict SNI validation
11.0.25
Vulnerable
Vulnerabilities fixed by this package (6)
Advisory Summary Aliases
CVE-2025-66614
Moderate: The fix for CVE-2025-66614 was incomplete
CVE-2026-24880
Low: Request smuggling via invalid chunk extension
CVE-2026-25854
Low: Occasionally open redirect
CVE-2026-29129
Low: Configured TLS cipher preference order not preserved
CVE-2026-29145
Moderate: OCSP checks sometimes soft-fail even when soft-fail is disabled
CVE-2026-29146
Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor