Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat@9.0.36 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults |
Vulnerable Vulnerable |
|
CVE-2016-6797
|
Low: Unrestricted Access to Global Resources |
Vulnerable |
|
CVE-2016-6796
|
Low: Security Manager Bypass |
Vulnerable |
|
CVE-2016-6794
|
Low: System Property Disclosure |
Vulnerable |
|
CVE-2016-5018
|
Low: Security Manager Bypass |
Vulnerable |
|
CVE-2016-0762
|
Low: Timing Attack |
Vulnerable |
|
CVE-2016-3092
|
Moderate: Denial of Service |
Vulnerable |
|
CVE-2013-4286
|
Important: Information disclosure | There are no reported fixed by versions. |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
|
GHSA-4vww-mc66-62m6
Aliases: CVE-2021-33037 |
HTTP Request Smuggling in Apache Tomcat Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not … |
Vulnerable |
|
GHSA-44qp-qhfv-c7f6
Aliases: CVE-2021-30639 |
Improper Handling of Exceptional Conditions in Apache Tomcat A vulnerability in Apache Tomcat allows an attacker to remotely trigger a … |
Vulnerable |
|
GHSA-36qh-35cm-5w2w
Aliases: CVE-2021-30640 |
Authentication Bypass by Alternate Name in Apache Tomcat A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker … |
Vulnerable |
|
GHSA-59g9-7gfx-c72p
Aliases: CVE-2021-41079 |
Infinite loop in Tomcat due to parsing error Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 … |
Vulnerable |
|
GHSA-hgrr-935x-pq79
Aliases: CVE-2025-61795 |
Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of … |
Vulnerable |
|
GHSA-wmwf-9ccg-fff5
Aliases: CVE-2025-55752 |
Apache Tomcat Vulnerable to Relative Path Traversal The fix for bug 60013 introduced a regression where the rewritten URL was … |
Vulnerable |
|
GHSA-42wg-hm62-jcwg
Aliases: CVE-2025-49124 |
Apache Tomcat installer for Windows has an untrusted search path vulnerability Untrusted Search Path vulnerability in Apache Tomcat installer for … |
Vulnerable |
|
GHSA-9f3j-pm6f-9fm5
Aliases: CVE-2022-23181 |
Race condition in Apache Tomcat The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into … |
Vulnerable |
|
GHSA-r84p-88g2-2vx2
Aliases: CVE-2022-29885 |
Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, … |
Vulnerable |
|
GHSA-jx7c-7mj5-9438
Aliases: CVE-2021-43980 |
Apache Tomcat Race Condition vulnerability The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to … |
Vulnerable |
|
GHSA-g8pj-r55q-5c2v
Aliases: CVE-2023-42795 |
Apache Tomcat Incomplete Cleanup vulnerability Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from … |
Vulnerable |
|
GHSA-r6j3-px5g-cq3x
Aliases: CVE-2023-45648 |
Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 … |
Vulnerable |
|
GHSA-q3mw-pvr8-9ggc
Aliases: CVE-2023-41080 |
Apache Tomcat Open Redirect vulnerability URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue … |
Vulnerable |
|
GHSA-9m3c-qcxr-9x87
Aliases: CVE-2026-25854 |
Apache Tomcat has an Open Redirect vulnerability Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via … |
Vulnerable |
|
GHSA-gx5v-xp9w-j4cg
Aliases: CVE-2026-41284 |
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
Vulnerable |
|
GHSA-5mp6-jrq3-r938
Aliases: CVE-2026-43513 |
Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This … |
Vulnerable |
|
GHSA-5m62-pw8w-7w9f
Aliases: CVE-2026-43515 |
Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
Vulnerable |
|
GHSA-fv25-8xcx-gqjc
Aliases: CVE-2026-42498 |
Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache … |
Vulnerable |
|
GHSA-h6fc-48rj-7qqh
Aliases: CVE-2026-43512 |
Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
Vulnerable |
|
GHSA-9m89-8frq-c98c
Aliases: CVE-2026-43514 |
Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to … |
Vulnerable |
|
CVE-2022-42252
Aliases: GHSA-p22x-g9px-3945 |
Improper Input Validation If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-29885
|
Uncontrolled Resource Consumption The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-34305
Aliases: GHSA-6j88-6whg-x687 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2024-21733
Aliases: GHSA-f4qf-m5gf-8jm8 |
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from … |
Vulnerable Vulnerable |
|
CVE-2021-30640
|
Improper Authentication A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-17527
|
Information Exposure While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2023-46589
|
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-24122
|
Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-653p-vg55-5652
Aliases: CVE-2024-54677 |
Apache Tomcat Uncontrolled Resource Consumption vulnerability Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads … |
Vulnerable Vulnerable |
|
CVE-2026-24880
Aliases: GHSA-563x-q5rq-57qp |
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2025-61795
Aliases: GHSA-hgrr-935x-pq79 |
Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2024-54677
Aliases: GHSA-653p-vg55-5652 |
Apache Tomcat Uncontrolled Resource Consumption vulnerability Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-43980
Aliases: GHSA-jx7c-7mj5-9438 |
Apache Tomcat Race Condition vulnerability The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to … | There are no reported fixed by versions. |
|
CVE-2020-13935
Aliases: GHSA-m7jv-hq7h-mq7c |
Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-m7jv-hq7h-mq7c
Aliases: CVE-2020-13935 |
Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 … |
Vulnerable Vulnerable |
|
GHSA-x4m4-345f-5h5g
Aliases: CVE-2026-34487 |
Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File Insertion of Sensitive Information into Log File vulnerability in … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-r29c-68gh-xp6x
Aliases: CVE-2026-41293 |
Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
Vulnerable Vulnerable |
|
GHSA-fpj8-gq4v-p354
Aliases: CVE-2025-66614 |
Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, … |
Vulnerable Vulnerable |
|
GHSA-9xv2-5v5q-p794
Aliases: CVE-2026-65905 |
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … |
Vulnerable |
|
GHSA-gcx9-497g-6cp6
Aliases: CVE-2026-65182 |
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads … |
Vulnerable |
|
GHSA-h3x4-894j-xpx5
Aliases: CVE-2026-68525 |
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows … |
Vulnerable |
|
CVE-2026-87022
|
Low: WebSocket message smuggling with per-message-deflate |
Vulnerable |
|
CVE-2026-79677
|
Moderate: WebSocket DoS due to lost asynchronous write timeout |
Vulnerable |
|
CVE-2026-78383
|
Important: AJP DoS via missing request body |
Vulnerable |
|
CVE-2026-76183
|
Important: Bypass of security constraints for WebSocket endpoints |
Vulnerable |
|
CVE-2026-75973
|
Low: Cross-context authentication mix-up with Jakarta Authentication configured |
Vulnerable |
|
CVE-2026-73581
|
Moderate: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore |
Vulnerable |
|
CVE-2026-73180
|
Low: Authenticated WebSocket session survives end of HTTP session |
Vulnerable |
|
CVE-2026-68569
|
Important: Principal lookup could fail open in some cases |
Vulnerable |
|
CVE-2026-68525
|
Low: Redirect after FORM authentication may bypass method specific constraints |
Vulnerable |
|
CVE-2026-66422
|
Low: Servlet role references can bypass declarative role constraints |
Vulnerable |
|
CVE-2026-65927
|
Important: RewriteValve [N] restarts at the second rule and may bypass access control |
Vulnerable |
|
CVE-2026-65905
|
Low: Limited replay attack possible with DIGEST authentication |
Vulnerable |
|
CVE-2026-65182
|
Important: Security constraint bypass |
Vulnerable |
|
CVE-2026-59084
|
Low: EncryptInterceptor requirements not clearly documented |
Vulnerable |
|
CVE-2026-59083
|
Low: Incorrect URL decoding in RewriteValve may allow security control bypass |
Vulnerable |
|
CVE-2026-55956
|
Moderate: Security constraints for default servlet ignored method |
Vulnerable |
|
CVE-2026-55955
|
Low: EncryptInterceptor not protected against replay attacks |
Vulnerable |
|
CVE-2026-55276
|
Low: Logged effective web.xml is incomplete |
Vulnerable |
|
CVE-2026-53404
|
Low: Bad ornext processing in RewriteValve |
Vulnerable |
|
CVE-2026-50229
|
Low: XSS in number guess example |
Vulnerable |
|
CVE-2026-43515
|
Moderate: Security constraints not correctly applied |
Vulnerable |
|
CVE-2026-43514
|
Low: AJP secret compared in non-constant time |
Vulnerable |
|
CVE-2026-43513
|
Low: LockOutRealm treats user names as case-sensitive |
Vulnerable |
|
CVE-2026-43512
|
Moderate: Digest authenticator will authenticate any unknown user |
Vulnerable |
|
CVE-2026-42498
|
Low: WebSocket authentication header exposure |
Vulnerable |
|
CVE-2026-41293
|
Low: HTTP/2 request headers not validated |
Vulnerable |
|
CVE-2026-41284
|
Low: Unbounded read in WebDAV LOCK and PROPFIND handling |
Vulnerable |
|
CVE-2026-34487
|
Low: Cloud membership for clustering component exposed the Kubernetes bearer token |
Vulnerable |
|
CVE-2026-29146
|
Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor |
Vulnerable |
|
CVE-2025-66614
|
Moderate: The fix for CVE-2025-66614 was incomplete |
Vulnerable |
|
CVE-2026-25854
|
Low: Occasionally open redirect |
Vulnerable |
|
CVE-2026-24880
|
Low: Request smuggling via invalid chunk extension |
Vulnerable |
|
CVE-2026-24733
|
Low: Security constraint bypass |
Vulnerable |
|
CVE-2025-61795
|
Low: Delayed cleaning of multipart upload temporary files may lead to DoS |
Vulnerable |
|
CVE-2025-55752
|
Important: Directory traversal via Rewrite Valve with possible remote code execution if PUT is enabled |
Vulnerable |
|
CVE-2025-48989
|
Important: DoS in HTTP/2 due to client triggered stream reset |
Vulnerable |
|
CVE-2025-52434
|
Important: APR/Native Connector crash leading to DoS |
Vulnerable |
|
CVE-2025-52520
|
Low: DoS due to overflow in file upload limit |
Vulnerable |
|
CVE-2025-53506
|
Important: DoS via excessive HTTP/2 streams |
Vulnerable |
|
CVE-2025-55668
|
Moderate: Session fixation possible via rewrite valve |
Vulnerable |
|
CVE-2025-49125
|
Moderate: Security constraint bypass for PreResources and PostResources |
Vulnerable |
|
CVE-2025-49124
|
Low: Side-loading via Tomcat installer for Windows |
Vulnerable |
|
CVE-2025-48988
|
Important: DoS in multipart upload |
Vulnerable |
|
CVE-2025-48976
|
Important: DoS in Commons FileUpload |
Vulnerable |
|
CVE-2025-46701
|
Low: CGI security constraint bypass |
Vulnerable |
|
CVE-2025-31651
|
Low: Rewrite rule bypass |
Vulnerable |
|
CVE-2026-55957
|
Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind |
Vulnerable |
|
CVE-2025-24813
|
Important: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet - |
Vulnerable |
|
CVE-2024-56337
|
Important: Remote Code Execution via write enabled Default Servlet. Mitigation for CVE-2024-50379 was incomplete - |
Vulnerable |
|
CVE-2024-54677
|
Low: DoS in examples web application |
Vulnerable |
|
CVE-2024-50379
|
Important: Remote Code Execution via write enabled Default Servlet |
Vulnerable |
|
CVE-2024-52316
|
Low: Authentication Bypass |
Vulnerable |
|
CVE-2024-34750
|
Important: Denial of Service |
Vulnerable |
|
CVE-2024-38286
|
Important: Denial of Service |
Vulnerable |
|
CVE-2024-23672
|
Important: Denial of Service |
Vulnerable |
|
CVE-2024-24549
|
Important: Denial of Service |
Vulnerable |
|
CVE-2023-46589
|
Important: Request smuggling |
Vulnerable |
|
CVE-2023-45648
|
Important: Request smuggling |
Vulnerable |
|
CVE-2023-44487
|
Important: Denial of Service |
Vulnerable |
|
CVE-2023-42795
|
Important: Information Disclosure |
Vulnerable |
|
CVE-2023-41080
|
Moderate: Open redirect |
Vulnerable |
|
CVE-2023-28708
|
Important: Apache Tomcat information disclosure |
Vulnerable |
|
CVE-2023-24998
|
Important: Apache Tomcat denial of service |
Vulnerable |
|
CVE-2022-42252
|
Low: Apache Tomcat request smuggling |
Vulnerable |
|
CVE-2022-34305
|
Low: Apache Tomcat XSS in examples web application |
Vulnerable |
|
CVE-2022-29885
|
Low: Apache Tomcat EncryptInterceptor DoS |
Vulnerable |
|
CVE-2021-43980
|
High: Information Disclosure |
Vulnerable |
|
CVE-2022-23181
|
Low: Local Privilege Escalation |
Vulnerable |
|
CVE-2021-33037
|
Important: Request Smuggling |
Vulnerable |
|
CVE-2021-30640
|
Low: Authentication weakness |
Vulnerable |
|
CVE-2021-41079
|
Important: Denial of Service |
Vulnerable |
|
CVE-2024-21733
|
Important: Information Disclosure |
Vulnerable |
|
CVE-2020-9484
|
Low: Fix for CVE-2020-9484 was incomplete |
Vulnerable |
|
CVE-2021-25122
|
Important: Request mix-up with h2c |
Vulnerable |
|
CVE-2021-24122
|
Important: Information disclosure |
Vulnerable |
|
CVE-2020-17527
|
Moderate: HTTP/2 request header mix-up |
Vulnerable |
|
CVE-2020-13943
|
Moderate: HTTP/2 request mix-up |
Vulnerable |
|
CVE-2020-13935
|
Important: WebSocket DoS |
Vulnerable |
|
CVE-2020-13934
|
Moderate: HTTP/2 DoS |
Vulnerable |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
|
GHSA-6j88-6whg-x687
Aliases: CVE-2022-34305 |
Cross-site Scripting in Apache Tomcat In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-h468-7pvh-8vr8
Aliases: CVE-2026-29146 |
Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-55956
|
Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-50229
|
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-59084
|
Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-55955
|
Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-65905
Aliases: GHSA-9xv2-5v5q-p794 |
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … |
Vulnerable Vulnerable |
|
CVE-2026-53404
|
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-101296
|
Important: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms |
Vulnerable |
|
CVE-2026-74049
|
Low: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2020-13934
|
Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat An h2c direct connection to Apache … |
GHSA-vf77-8h7g-gghp
|
|
CVE-2020-11996
|
Important: HTTP/2 DoS | |
|
GHSA-vf77-8h7g-gghp
|
Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat An h2c direct connection to Apache … |
CVE-2020-13934
|