Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat@11.0.20
purl pkg:maven/org.apache.tomcat/tomcat@11.0.20
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 10.0
Vulnerabilities affecting this package (82)
Advisory Summary Fixed in package version
CVE-2026-43515

Moderate: Security constraints not correctly applied
11.0.22
Vulnerable
CVE-2026-43514

Low: AJP secret compared in non-constant time
11.0.22
Vulnerable
CVE-2026-43513

Low: LockOutRealm treats user names as case-sensitive
11.0.22
Vulnerable
CVE-2026-43512

Moderate: Digest authenticator will authenticate any unknown user
11.0.22
Vulnerable
CVE-2026-42498

Low: WebSocket authentication header exposure
11.0.22
Vulnerable
CVE-2026-41293

Low: HTTP/2 request headers not validated
11.0.22
Vulnerable
CVE-2026-41284

Low: Unbounded read in WebDAV LOCK and PROPFIND handling
11.0.22
Vulnerable
CVE-2026-34500

Moderate: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
11.0.21
Vulnerable
CVE-2026-34487

Low: Cloud membership for clustering component exposed the Kubernetes bearer token
11.0.21
Vulnerable
CVE-2026-29146

Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
11.0.21
Vulnerable
CVE-2026-34483

Low: Incomplete escaping of JSON access logs
11.0.21
Vulnerable
CVE-2023-34981

Important: Information disclosure
11.0.0
Vulnerable
CVE-2023-24998

Important: Apache Tomcat denial of service
11.0.0
Vulnerable
CVE-2018-8014

Low: CORS filter has insecure defaults
8.0.53
Vulnerable
8.5.32
Vulnerable
CVE-2016-6797

Low: Unrestricted Access to Global Resources
8.5.5
Vulnerable
CVE-2016-6796

Low: Security Manager Bypass
8.5.5
Vulnerable
CVE-2016-6794

Low: System Property Disclosure
8.5.5
Vulnerable
CVE-2016-5018

Low: Security Manager Bypass
8.5.5
Vulnerable
CVE-2016-0762

Low: Timing Attack
8.5.5
Vulnerable
CVE-2016-3092

Moderate: Denial of Service
8.5.3
Vulnerable
CVE-2013-4286

Important: Information disclosure There are no reported fixed by versions.
CVE-2018-8014

Low: CORS filter has insecure defaults There are no reported fixed by versions.
GHSA-rv64-5gf8-9qq8
Aliases:
CVE-2026-34483
Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve Improper Encoding or Escaping of Output …
11.0.21
Vulnerable
GHSA-69r9-qgr7-g2wj
Aliases:
CVE-2026-34486
Apache Tomcat Missing Encryption of Sensitive Data vulnerability Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the …
11.0.21
Vulnerable
GHSA-gx5v-xp9w-j4cg
Aliases:
CVE-2026-41284
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …
11.0.22
Vulnerable
GHSA-5mp6-jrq3-r938
Aliases:
CVE-2026-43513
Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …
11.0.22
Vulnerable
GHSA-5m62-pw8w-7w9f
Aliases:
CVE-2026-43515
Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …
11.0.22
Vulnerable
GHSA-fv25-8xcx-gqjc
Aliases:
CVE-2026-42498
Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …
11.0.22
Vulnerable
GHSA-h6fc-48rj-7qqh
Aliases:
CVE-2026-43512
Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …
11.0.22
Vulnerable
GHSA-9m89-8frq-c98c
Aliases:
CVE-2026-43514
Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …
11.0.22
Vulnerable
CVE-2026-55956

Moderate: Security constraints for default servlet ignored method
11.0.23
Vulnerable
CVE-2026-55955

Low: EncryptInterceptor not protected against replay attacks
11.0.23
Vulnerable
CVE-2026-55276

Low: Logged effective web.xml is incomplete
11.0.23
Vulnerable
CVE-2026-53434

Low: Invalid CRL configuration doesn't trigger failure for FFM Connector
11.0.23
Vulnerable
CVE-2026-53404

Low: Bad ornext processing in RewriteValve
11.0.23
Vulnerable
CVE-2026-50229

Low: XSS in number guess example
11.0.23
Vulnerable
CVE-2026-59084

Low: EncryptInterceptor requirements not clearly documented
11.0.24
Vulnerable
CVE-2026-59083

Low: Incorrect URL decoding in RewriteValve may allow security control bypass
11.0.24
Vulnerable
CVE-2026-66299

Low: DoS in WebSocket chat example
11.0.25
Vulnerable
CVE-2026-34500
Aliases:
GHSA-24j9-x2wg-9qv6
Apache Tomcat: CLIENT_CERT authentication does not fail as expected CLIENT_CERT authentication does not fail as expected for some scenarios when …
11.0.21
Vulnerable
9.0.117
Vulnerable
10.1.54
Vulnerable
11.0.21
Vulnerable
9.0.117
Vulnerable
10.1.54
Vulnerable
GHSA-x4m4-345f-5h5g
Aliases:
CVE-2026-34487
Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File Insertion of Sensitive Information into Log File vulnerability in …
11.0.21
Vulnerable
11.0.21
Vulnerable
11.0.21
Vulnerable
CVE-2026-73180

Low: Authenticated WebSocket session survives end of HTTP session
11.0.25
Vulnerable
CVE-2026-68763

Important: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
11.0.25
Vulnerable
CVE-2026-68569

Important: Principal lookup could fail open in some cases
11.0.25
Vulnerable
CVE-2026-68525

Low: Redirect after FORM authentication may bypass method specific constraints
11.0.25
Vulnerable
CVE-2026-66422

Low: Servlet role references can bypass declarative role constraints
11.0.25
Vulnerable
CVE-2026-65927

Important: RewriteValve [N] restarts at the second rule and may bypass access control
11.0.25
Vulnerable
CVE-2026-65905

Low: Limited replay attack possible with DIGEST authentication
11.0.25
Vulnerable
CVE-2026-65637

Moderate: HTTP/2 no-authority bypass of strict SNI validation
11.0.25
Vulnerable
CVE-2026-65183

Low: TOCTOU when setting specific permissions for Unix Domain Sockets
11.0.25
Vulnerable
CVE-2026-65182

Important: Security constraint bypass
11.0.25
Vulnerable
GHSA-r29c-68gh-xp6x
Aliases:
CVE-2026-41293
Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …
11.0.22
Vulnerable
11.0.22
Vulnerable
GHSA-9xv2-5v5q-p794
Aliases:
CVE-2026-65905
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …
11.0.25
Vulnerable
GHSA-gcx9-497g-6cp6
Aliases:
CVE-2026-65182
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads …
11.0.25
Vulnerable
GHSA-h3x4-894j-xpx5
Aliases:
CVE-2026-68525
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows …
11.0.25
Vulnerable
CVE-2026-87022

Low: WebSocket message smuggling with per-message-deflate
11.0.26
Vulnerable
CVE-2026-86248

Moderate: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
11.0.26
Vulnerable
CVE-2026-79677

Moderate: WebSocket DoS due to lost asynchronous write timeout
11.0.26
Vulnerable
CVE-2026-78437

Low: HTTP/2 DoS via malformed request
11.0.26
Vulnerable
CVE-2026-78383

Important: AJP DoS via missing request body
11.0.26
Vulnerable
CVE-2026-77791

Important: DoS via busy wait during WebSocket close
11.0.26
Vulnerable
CVE-2026-77762

Low: Stale HPACK emitter injects trailers into recycled pooled Request
11.0.26
Vulnerable
CVE-2026-77756

Low: Transfer-Encoding honored for HTTP/1.0 requests
11.0.26
Vulnerable
CVE-2026-76183

Important: Bypass of security constraints for WebSocket endpoints
11.0.26
Vulnerable
CVE-2026-75973

Low: Cross-context authentication mix-up with Jakarta Authentication configured
11.0.26
Vulnerable
CVE-2026-73581

Moderate: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
11.0.26
Vulnerable
CVE-2026-66299

Low: DoS in WebSocket chat example
10.1.59
Vulnerable
CVE-2026-66299

Low: DoS in WebSocket chat example
9.0.121
Vulnerable
CVE-2018-8014

Low: CORS filter has insecure defaults There are no reported fixed by versions.
CVE-2026-55956

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method …
11.0.23
Vulnerable
10.1.56
Vulnerable
9.0.119
Vulnerable
CVE-2026-50229

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache …
11.0.23
Vulnerable
10.1.56
Vulnerable
9.0.119
Vulnerable
CVE-2026-59084

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This …
9.0.120
Vulnerable
11.0.25
Vulnerable
10.1.59
Vulnerable
CVE-2026-55955

Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects …
11.0.23
Vulnerable
10.1.56
Vulnerable
9.0.119
Vulnerable
CVE-2026-65905
Aliases:
GHSA-9xv2-5v5q-p794
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …
11.0.25
Vulnerable
9.0.121
Vulnerable
CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from …
11.0.25
Vulnerable
9.0.121
Vulnerable
CVE-2026-53404

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain …
11.0.23
Vulnerable
10.1.56
Vulnerable
9.0.119
Vulnerable
CVE-2026-103119

Important: AJP response mix-up
11.0.27
Vulnerable
CVE-2026-101296

Important: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
11.0.27
Vulnerable
CVE-2026-93446

Low: Possible TLS 1.3 connection failures
11.0.27
Vulnerable
CVE-2026-88041

Low: HTTP/2 trailer header cross-contamination
11.0.27
Vulnerable
CVE-2026-74049

Low: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
11.0.27
Vulnerable
CVE-2026-74048

Low: OpenSSL-FFM FIPS failure does not prevent start-up
11.0.27
Vulnerable
Vulnerabilities fixed by this package (12)

Advisory Summary Aliases
CVE-2026-29146
Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
CVE-2025-66614
Moderate: The fix for CVE-2025-66614 was incomplete
CVE-2026-29145
Moderate: OCSP checks sometimes soft-fail even when soft-fail is disabled
CVE-2026-29129
Low: Configured TLS cipher preference order not preserved
CVE-2026-25854
Low: Occasionally open redirect
CVE-2026-24880
Low: Request smuggling via invalid chunk extension
GHSA-95jq-rwvf-vjx4
Apache Tomcat: CLIENT_CERT authentication does not fail as expected CLIENT_CERT authentication does not fail as expected for some scenarios when … CVE-2026-29145
GHSA-69cc-cv78-qc8g
Apache Tomcat: Configured cipher preference order not preserved Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue … CVE-2026-29129
GHSA-9m3c-qcxr-9x87
Apache Tomcat has an Open Redirect vulnerability Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via … CVE-2026-25854
CVE-2026-24880
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat … GHSA-563x-q5rq-57qp
GHSA-8mc5-53m5-3qj2
Apache Tomcat has an Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix … CVE-2026-32990
GHSA-h468-7pvh-8vr8
Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects … CVE-2026-29146