Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat@10.1.0-M11
purl pkg:maven/org.apache.tomcat/tomcat@10.1.0-M11
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 10.0
Vulnerabilities affecting this package (124)
Advisory Summary Fixed in package version
CVE-2018-8014

Low: CORS filter has insecure defaults
8.0.53
Vulnerable
8.5.32
Vulnerable
CVE-2016-6797

Low: Unrestricted Access to Global Resources
8.5.5
Vulnerable
CVE-2016-6796

Low: Security Manager Bypass
8.5.5
Vulnerable
CVE-2016-6794

Low: System Property Disclosure
8.5.5
Vulnerable
CVE-2016-5018

Low: Security Manager Bypass
8.5.5
Vulnerable
CVE-2016-0762

Low: Timing Attack
8.5.5
Vulnerable
CVE-2016-3092

Moderate: Denial of Service
8.5.3
Vulnerable
CVE-2013-4286

Important: Information disclosure There are no reported fixed by versions.
CVE-2018-8014

Low: CORS filter has insecure defaults There are no reported fixed by versions.
GHSA-hgrr-935x-pq79
Aliases:
CVE-2025-61795
Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …
10.1.47
Vulnerable
GHSA-vfww-5hm6-hx2j
Aliases:
CVE-2025-55754
Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences Tomcat did not escape ANSI escape sequences in …
10.1.45
Vulnerable
GHSA-wmwf-9ccg-fff5
Aliases:
CVE-2025-55752
Apache Tomcat Vulnerable to Relative Path Traversal The fix for bug 60013 introduced a regression where the rewritten URL was …
10.1.45
Vulnerable
GHSA-r84p-88g2-2vx2
Aliases:
CVE-2022-29885
Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, …
10.1.0-M15
Vulnerable
GHSA-jx7c-7mj5-9438
Aliases:
CVE-2021-43980
Apache Tomcat Race Condition vulnerability The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to …
10.1.0-M14
Vulnerable
GHSA-g8pj-r55q-5c2v
Aliases:
CVE-2023-42795
Apache Tomcat Incomplete Cleanup vulnerability Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from …
10.1.14
Vulnerable
GHSA-r6j3-px5g-cq3x
Aliases:
CVE-2023-45648
Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 …
10.1.14
Vulnerable
GHSA-q3mw-pvr8-9ggc
Aliases:
CVE-2023-41080
Apache Tomcat Open Redirect vulnerability URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue …
10.1.13
Vulnerable
GHSA-95jq-rwvf-vjx4
Aliases:
CVE-2026-29145
Apache Tomcat: CLIENT_CERT authentication does not fail as expected CLIENT_CERT authentication does not fail as expected for some scenarios when …
10.1.53
Vulnerable
GHSA-rv64-5gf8-9qq8
Aliases:
CVE-2026-34483
Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve Improper Encoding or Escaping of Output …
10.1.54
Vulnerable
GHSA-9m3c-qcxr-9x87
Aliases:
CVE-2026-25854
Apache Tomcat has an Open Redirect vulnerability Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via …
10.1.53
Vulnerable
GHSA-gx5v-xp9w-j4cg
Aliases:
CVE-2026-41284
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …
10.1.55
Vulnerable
GHSA-5mp6-jrq3-r938
Aliases:
CVE-2026-43513
Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …
10.1.55
Vulnerable
GHSA-5m62-pw8w-7w9f
Aliases:
CVE-2026-43515
Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …
10.1.55
Vulnerable
GHSA-fv25-8xcx-gqjc
Aliases:
CVE-2026-42498
Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …
10.1.55
Vulnerable
GHSA-h6fc-48rj-7qqh
Aliases:
CVE-2026-43512
Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …
10.1.55
Vulnerable
GHSA-9m89-8frq-c98c
Aliases:
CVE-2026-43514
Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …
10.1.55
Vulnerable
CVE-2026-24734
Aliases:
GHSA-mgp5-rv84-w37q
Apache Tomcat OCSP verification bypass Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, …
11.0.18
Vulnerable
10.1.52
Vulnerable
9.0.115
Vulnerable
GHSA-653p-vg55-5652
Aliases:
CVE-2024-54677
Apache Tomcat Uncontrolled Resource Consumption vulnerability Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads …
10.1.34
Vulnerable
10.1.34
Vulnerable
CVE-2026-24880
Aliases:
GHSA-563x-q5rq-57qp
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …
11.0.20
Vulnerable
10.1.52
Vulnerable
9.0.116
Vulnerable
11.0.20
Vulnerable
10.1.52
Vulnerable
9.0.116
Vulnerable
CVE-2025-61795
Aliases:
GHSA-hgrr-935x-pq79
Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …
11.0.12
Vulnerable
9.0.110
Vulnerable
10.1.47
Vulnerable
11.0.12
Vulnerable
9.0.110
Vulnerable
10.1.47
Vulnerable
CVE-2021-42340

Missing Release of Resource after Effective Lifetime tomcat is vulnerable to a memory leak that, over time, could lead to …
8.5.72
Vulnerable
9.0.54
Vulnerable
8.5.72
Vulnerable
9.0.54
Vulnerable
CVE-2024-54677
Aliases:
GHSA-653p-vg55-5652
Apache Tomcat Uncontrolled Resource Consumption vulnerability Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads …
11.0.2
Vulnerable
10.1.34
Vulnerable
9.0.98
Vulnerable
11.0.2
Vulnerable
10.1.34
Vulnerable
9.0.98
Vulnerable
GHSA-x4m4-345f-5h5g
Aliases:
CVE-2026-34487
Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File Insertion of Sensitive Information into Log File vulnerability in …
10.1.54
Vulnerable
10.1.54
Vulnerable
10.1.54
Vulnerable
GHSA-r29c-68gh-xp6x
Aliases:
CVE-2026-41293
Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …
10.1.55
Vulnerable
10.1.55
Vulnerable
GHSA-fpj8-gq4v-p354
Aliases:
CVE-2025-66614
Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, …
10.1.50
Vulnerable
10.1.50
Vulnerable
GHSA-9xv2-5v5q-p794
Aliases:
CVE-2026-65905
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … There are no reported fixed by versions.
GHSA-gcx9-497g-6cp6
Aliases:
CVE-2026-65182
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads … There are no reported fixed by versions.
GHSA-h3x4-894j-xpx5
Aliases:
CVE-2026-68525
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows … There are no reported fixed by versions.
CVE-2026-87022

Low: WebSocket message smuggling with per-message-deflate
10.1.60
Vulnerable
CVE-2026-79677

Moderate: WebSocket DoS due to lost asynchronous write timeout
10.1.60
Vulnerable
CVE-2026-78383

Important: AJP DoS via missing request body
10.1.60
Vulnerable
CVE-2026-77762

Low: Stale HPACK emitter injects trailers into recycled pooled Request
10.1.60
Vulnerable
CVE-2026-77756

Low: Transfer-Encoding honored for HTTP/1.0 requests
10.1.60
Vulnerable
CVE-2026-76183

Important: Bypass of security constraints for WebSocket endpoints
10.1.60
Vulnerable
CVE-2026-75973

Low: Cross-context authentication mix-up with Jakarta Authentication configured
10.1.60
Vulnerable
CVE-2026-73581

Moderate: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
10.1.60
Vulnerable
CVE-2026-73180

Low: Authenticated WebSocket session survives end of HTTP session
10.1.59
Vulnerable
CVE-2026-68763

Important: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
10.1.59
Vulnerable
CVE-2026-68569

Important: Principal lookup could fail open in some cases
10.1.59
Vulnerable
CVE-2026-68525

Low: Redirect after FORM authentication may bypass method specific constraints
10.1.59
Vulnerable
CVE-2026-66422

Low: Servlet role references can bypass declarative role constraints
10.1.59
Vulnerable
CVE-2026-65927

Important: RewriteValve [N] restarts at the second rule and may bypass access control
10.1.59
Vulnerable
CVE-2026-65905

Low: Limited replay attack possible with DIGEST authentication
10.1.59
Vulnerable
CVE-2026-65183

Low: TOCTOU when setting specific permissions for Unix Domain Sockets
10.1.59
Vulnerable
CVE-2026-65182

Important: Security constraint bypass
10.1.59
Vulnerable
CVE-2026-59084

Low: EncryptInterceptor requirements not clearly documented
10.1.57
Vulnerable
CVE-2026-59083

Low: Incorrect URL decoding in RewriteValve may allow security control bypass
10.1.57
Vulnerable
CVE-2026-55956

Moderate: Security constraints for default servlet ignored method
10.1.56
Vulnerable
CVE-2026-55955

Low: EncryptInterceptor not protected against replay attacks
10.1.56
Vulnerable
CVE-2026-55276

Low: Logged effective web.xml is incomplete
10.1.56
Vulnerable
CVE-2026-53434

Low: Invalid CRL configuration doesn't trigger failure for FFM Connector
10.1.56
Vulnerable
CVE-2026-53404

Low: Bad ornext processing in RewriteValve
10.1.56
Vulnerable
CVE-2026-50229

Low: XSS in number guess example
10.1.56
Vulnerable
CVE-2026-43515

Moderate: Security constraints not correctly applied
10.1.55
Vulnerable
CVE-2026-43514

Low: AJP secret compared in non-constant time
10.1.55
Vulnerable
CVE-2026-43513

Low: LockOutRealm treats user names as case-sensitive
10.1.55
Vulnerable
CVE-2026-43512

Moderate: Digest authenticator will authenticate any unknown user
10.1.55
Vulnerable
CVE-2026-42498

Low: WebSocket authentication header exposure
10.1.55
Vulnerable
CVE-2026-41293

Low: HTTP/2 request headers not validated
10.1.55
Vulnerable
CVE-2026-41284

Low: Unbounded read in WebDAV LOCK and PROPFIND handling
10.1.55
Vulnerable
CVE-2026-34487

Low: Cloud membership for clustering component exposed the Kubernetes bearer token
10.1.54
Vulnerable
CVE-2026-29146

Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
10.1.53
Vulnerable
CVE-2026-34483

Low: Incomplete escaping of JSON access logs
10.1.54
Vulnerable
CVE-2025-66614

Moderate: The fix for CVE-2025-66614 was incomplete
10.1.50
Vulnerable
CVE-2026-29145

Moderate: OCSP checks sometimes soft-fail even when soft-fail is disabled
10.1.53
Vulnerable
CVE-2026-25854

Low: Occasionally open redirect
10.1.53
Vulnerable
CVE-2026-24880

Low: Request smuggling via invalid chunk extension
10.1.53
Vulnerable
CVE-2026-24734

Moderate: Incomplete OCSP verification checks
10.1.52
Vulnerable
CVE-2026-24733

Low: Security constraint bypass
10.1.50
Vulnerable
CVE-2025-61795

Low: Delayed cleaning of multipart upload temporary files may lead to DoS
10.1.47
Vulnerable
CVE-2025-55754

Low: Console manipulation via escape sequences in log messages
10.1.45
Vulnerable
CVE-2025-55752

Important: Directory traversal via Rewrite Valve with possible remote code execution if PUT is enabled
10.1.45
Vulnerable
CVE-2025-48989

Important: DoS in HTTP/2 due to client triggered stream reset
10.1.44
Vulnerable
CVE-2025-52520

Low: DoS due to overflow in file upload limit
10.1.43
Vulnerable
CVE-2025-53506

Important: DoS via excessive HTTP/2 streams
10.1.43
Vulnerable
CVE-2025-55668

Moderate: Session fixation possible via rewrite valve
10.1.42
Vulnerable
CVE-2025-49125

Moderate: Security constraint bypass for PreResources and PostResources
10.1.42
Vulnerable
CVE-2025-48988

Important: DoS in multipart upload
10.1.42
Vulnerable
CVE-2025-48976

Important: DoS in Commons FileUpload
10.1.42
Vulnerable
CVE-2025-46701

Low: CGI security constraint bypass
10.1.41
Vulnerable
CVE-2025-31651

Low: Rewrite rule bypass
10.1.40
Vulnerable
CVE-2026-55957

Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
10.1.39
Vulnerable
CVE-2025-24813

Important: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet -
10.1.35
Vulnerable
CVE-2024-56337

Important: Remote Code Execution via write enabled Default Servlet. Mitigation for CVE-2024-50379 was incomplete -
10.1.34
Vulnerable
CVE-2024-54677

Low: DoS in examples web application
10.1.34
Vulnerable
CVE-2024-50379

Important: Remote Code Execution via write enabled Default Servlet
10.1.34
Vulnerable
CVE-2024-52316

Low: Authentication Bypass
10.1.31
Vulnerable
CVE-2024-34750

Important: Denial of Service
10.1.25
Vulnerable
CVE-2024-38286

Important: Denial of Service
10.1.25
Vulnerable
CVE-2024-23672

Important: Denial of Service
10.1.19
Vulnerable
CVE-2024-24549

Important: Denial of Service
10.1.19
Vulnerable
CVE-2023-46589

Important: Request smuggling
10.1.16
Vulnerable
CVE-2023-45648

Important: Request smuggling
10.1.14
Vulnerable
CVE-2023-44487

Important: Denial of Service
10.1.14
Vulnerable
CVE-2023-42795

Important: Information Disclosure
10.1.14
Vulnerable
CVE-2023-41080

Moderate: Open redirect
10.1.13
Vulnerable
CVE-2023-28708

Important: Apache Tomcat information disclosure
10.1.6
Vulnerable
CVE-2023-24998

Important: Apache Tomcat denial of service
10.1.5
Vulnerable
CVE-2022-45143

Low: Apache Tomcat JsonErrorReportValve injection
10.1.2
Vulnerable
CVE-2022-42252

Low: Apache Tomcat request smuggling
10.1.1
Vulnerable
CVE-2022-34305

Low: Apache Tomcat XSS in examples web application
10.1.0
Vulnerable
CVE-2022-29885

Low: Apache Tomcat EncryptInterceptor DoS
10.1.0
Vulnerable
CVE-2021-43980

High: Information Disclosure
10.1.0
Vulnerable
CVE-2026-66299

Low: DoS in WebSocket chat example
9.0.121
Vulnerable
CVE-2018-8014

Low: CORS filter has insecure defaults There are no reported fixed by versions.
GHSA-6j88-6whg-x687
Aliases:
CVE-2022-34305
Cross-site Scripting in Apache Tomcat In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to …
10.1.0-M17
Vulnerable
10.1.0-M17
Vulnerable
CVE-2026-55956

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method …
11.0.23
Vulnerable
10.1.56
Vulnerable
9.0.119
Vulnerable
CVE-2026-50229

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache …
11.0.23
Vulnerable
10.1.56
Vulnerable
9.0.119
Vulnerable
CVE-2026-59084

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This …
9.0.120
Vulnerable
11.0.25
Vulnerable
10.1.59
Vulnerable
CVE-2026-55955

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects …
11.0.23
Vulnerable
10.1.56
Vulnerable
9.0.119
Vulnerable
CVE-2026-65905
Aliases:
GHSA-9xv2-5v5q-p794
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …
11.0.25
Vulnerable
9.0.121
Vulnerable
CVE-2026-53404

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain …
11.0.23
Vulnerable
10.1.56
Vulnerable
9.0.119
Vulnerable
CVE-2026-101296

Important: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
10.1.61
Vulnerable
CVE-2026-74049

Low: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
10.1.61
Vulnerable
This package is not known to fix any advisories.