Search for packages
| purl | pkg:apache/tomcat@9.0.121 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2026-73581
|
Moderate: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore |
Vulnerable |
|
CVE-2026-75973
|
Low: Cross-context authentication mix-up with Jakarta Authentication configured |
Vulnerable |
|
CVE-2026-76183
|
Important: Bypass of security constraints for WebSocket endpoints |
Vulnerable |
|
CVE-2026-77756
|
Low: Transfer-Encoding honored for HTTP/1.0 requests |
Vulnerable |
|
CVE-2026-77762
|
Low: Stale HPACK emitter injects trailers into recycled pooled Request |
Vulnerable |
|
CVE-2026-77791
|
Important: DoS via busy wait during WebSocket close |
Vulnerable |
|
CVE-2026-78383
|
Important: AJP DoS via missing request body |
Vulnerable |
|
CVE-2026-78437
|
Low: HTTP/2 DoS via malformed request |
Vulnerable |
|
CVE-2026-79677
|
Moderate: WebSocket DoS due to lost asynchronous write timeout |
Vulnerable |
|
CVE-2026-86248
|
Moderate: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled |
Vulnerable |
|
CVE-2026-86350
|
Important: Regression in fix for CVE-2026-41293 can trigger request header mix-up |
Vulnerable |
|
CVE-2026-87022
|
Low: WebSocket message smuggling with per-message-deflate |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2026-65182
|
Important: Security constraint bypass | |
|
CVE-2026-65183
|
Low: TOCTOU when setting specific permissions for Unix Domain Sockets | |
|
CVE-2026-65637
|
Moderate: HTTP/2 no-authority bypass of strict SNI validation | |
|
CVE-2026-65905
|
Low: Limited replay attack possible with DIGEST authentication | |
|
CVE-2026-65927
|
Important: RewriteValve [N] restarts at the second rule and may bypass access control | |
|
CVE-2026-66299
|
Low: DoS in WebSocket chat example | |
|
CVE-2026-66422
|
Low: Servlet role references can bypass declarative role constraints | |
|
CVE-2026-68525
|
Low: Redirect after FORM authentication may bypass method specific constraints | |
|
CVE-2026-68569
|
Important: Principal lookup could fail open in some cases | |
|
CVE-2026-68763
|
Important: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset | |
|
CVE-2026-73180
|
Low: Authenticated WebSocket session survives end of HTTP session |