TO
Web Server
Tomcat
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
7
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 31High 89Medium 43Low 4
Watch
Add Tomcat to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-24813 In wildKEV | 9.8 | Mar 10 | Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Affected: 11.0.0-M1 through 11.0.2; 10.1.0-M1 through 10.1.34; 9.0.0.M1 through 9.0.98; 8.5.0 through 8.5.100 |
| CVE-2020-1938 In wildKEV | 9.8 | Feb 24 | Apache Tomcat Improper Privilege Management Vulnerability Affected: Apache Tomcat 9.0.0.M1 to 9.0.0.30; 8.5.0 to 8.5.50; 7.0.0 to 7.0.99 |
| CVE-2016-8735 In wildKEV | 9.8 | Apr 6 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if… Affected: before 6.0.48; 7.x before 7.0.73; 8.x before 8.0.39; 8.5.x before 8.5.7; 9.x before 9.0.0.M12 |
| CVE-2017-12617 In wildKEV | 8.1 | Oct 3 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g Affected: 9.0.0.M1 to 9.0.0; 8.5.0 to 8.5.22; 8.0.0.RC1 to 8.0.46; 7.0.0 to 7.0.81 |
| CVE-2017-12615 RansomwareIn wildKEV | 8.1 | Sep 19 | When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g Affected: 7.0.0 to 7.0.79 |
| CVE-2026-34486 In wildKEV | 7.5 | Apr 9 | Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor Affected: 11.0.20; 10.1.53; 9.0.116 |
| CVE-2023-44487 In wildKEV | 7.5 | Oct 10 | HTTP/2 Rapid Reset Attack Vulnerability Affected: 8.5.0 through 8.5.93; 9.0.0 through 9.0.80; 10.1.0 through 10.1.13; 11.0.0; 11.0.0; 11.0.0; +8 more |
| CVE-2026-86248 | 9.8 | Sep 23 | Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled Affected: 11.0.0-M14 through 11.0.25; 10.1.22 through 10.1.59; 9.0.92 through 9.0.121 |
| CVE-2026-76183 | 9.8 | Sep 23 | Apache Tomcat: Bypass of security constraints for WebSocket endpoints Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.0.M1 through 9.0.121; 8.5.0 through 8.5.100; 7.0.43 through 7.0.109 |
| CVE-2026-65905 | 9.8 | Aug 25 | Apache Tomcat: Limited replay attack possible with DIGEST authentication Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.0.M1 through 9.0.120; 8.5.0 through 8.5.100; 7.0.30 through 7.0.109 |
| CVE-2026-65637 | 9.8 | Aug 25 | Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete Affected: 11.0.20 through 11.0.24; 10.1.53 through 10.1.57; 9.0.115 through 9.0.120 |
| CVE-2026-43512 | 9.8 | May 12 | Apache Tomcat: Digest authenticator will authenticate any unknown user Affected: 11.0.0-M1 through 11.0.21; 10.1.0-M1 through 10.1.54; 9.0.0.M1 through 9.0.117; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-41293 | 9.8 | May 12 | Apache Tomcat: HTTP/2 request headers not validated Affected: 11.0.0-M1 through 11.0.21; 10.1.0-M1 through 10.1.54; 9.0.0.M1 through 9.0.117; 10.0.0-M1 through 10.0.27; 8.5.0 through 8.5.100 |
| CVE-2025-31651 | 9.8 | Apr 28 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a… Affected: 9.0.0 before 9.0.104; 10.1.0 before 10.1.40; 11.0.0 before 11.0.6 |
| CVE-2024-56337 | 9.8 | Dec 20 | Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete Affected: 11.0.0-M1 through 11.0.1; 10.1.0-M1 through 10.1.33; 9.0.0.M1 through 9.0.97; 8.5.0 through 8.5.100 |
| CVE-2024-50379 | 9.8 | Dec 17 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is… Affected: 9.0.0 before 9.0.98; 10.1.0 before 10.1.34; 11.0.0 before 11.0.2 |
| CVE-2024-52316 | 9.8 | Nov 18 | Unchecked Error Condition vulnerability in Apache Tomcat Affected: 9.0.0 before 9.0.96; 10.1.0 before 10.1.31; 11.0.0; 11.0.0; 11.0.0; 11.0.0; +22 more |
| CVE-2018-8014 | 9.8 | May 16 | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable… Affected: 9.0.0.M1 to 9.0.8; 8.5.0 to 8.5.31; 8.0.0.RC1 to 8.0.52; 7.0.41 to 7.0.88 |
| CVE-2017-5651 | 9.8 | Apr 17 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing Affected: 8.5.0; 8.5.1; 8.5.2; 8.5.3; 8.5.4; 8.5.5; +25 more |
| CVE-2025-55754 | 9.6 | Oct 27 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat Affected: 8.5.60 through 8.5.100; 9.0.40 before 9.0.109; 10.0.0 before 10.0.27; 10.1.0 before 10.1.45; 11.0.0 before 11.0.11 |
| CVE-2026-103119 | 9.1 | Oct 20 | Apache Tomcat: AJP response mix-up Affected: 11.0.0-M25 through 11.0.26 |
| CVE-2026-101356 | 9.1 | Oct 20 | Apache Tomcat: HTTP/2 request/response mix-up after error during async processing Affected: 11.0.22 through 11.0.26; 10.1.55 through 10.1.60; 9.0.118 through 9.0.122 |
| CVE-2026-101296 | 9.1 | Oct 20 | Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms Affected: 11.0.0-M1 through 11.0.26; 10.1.0-M1 through 10.1.60; 9.0.0.M1 through 9.0.122; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-86350 | 9.1 | Sep 23 | Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up Affected: 11.0.22 through 11.0.25; 10.1.55 through 10.1.59; 9.0.118 through 9.0.121 |
| CVE-2026-68525 | 9.1 | Aug 25 | Apache Tomcat: Redirect after FORM auth may bypass method specific constraints Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.0.M1 through 9.0.120; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-65182 | 9.1 | Aug 25 | Apache Tomcat: Bypass longest prefix security constraint Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.0.M1 through 9.0.120; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-59084 | 9.1 | Jul 14 | Apache Tomcat: EncryptInterceptor requirements not clearly documented Affected: 11.0.0-M1 through 11.0.23; 10.1.0-M1 through 10.1.56; 9.0.13 through 9.0.119; 8.5.38 through 8.5.100; 7.0.100 through 7.0.109 |
| CVE-2026-59083 | 9.1 | Jul 14 | Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass Affected: 11.0.0-M1 through 11.0.23; 10.1.0-M1 through 10.1.56; 9.0.0.M1 through 9.0.119; 8.5.0 through 8.5.100 |
| CVE-2026-55276 | 9.1 | Jun 29 | Apache Tomcat: Logged effective web.xml is incomplete Affected: 11.0.0-M1 through 11.0.22; 10.1.0-M1 through 10.1.55; 9.0.0.M1 through 9.0.118; 8.5.0 through 8.5.100 |
| CVE-2026-53434 | 9.1 | Jun 29 | Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector Affected: 11.0.0-M1 through 11.0.22; 10.1.0-M7 through 10.1.55; 9.0.83 through 9.0.118 |
| CVE-2026-43515 | 9.1 | May 12 | Apache Tomcat: Security constraints not correctly applied Affected: 11.0.0-M1 through 11.0.21; 10.1.0-M1 through 10.1.54; 9.0.0.M1 through 9.0.117; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-29145 | 9.1 | Apr 9 | Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled Affected: 11.0.0-M1 through 11.0.18; 10.1.0-M7 through 10.1.52; 9.0.83 through 9.0.115 |
| CVE-2025-66614 | 9.1 | Feb 17 | Improper Input Validation vulnerability Affected: 9.0.1 before 9.0.113; 10.1.1 before 10.1.50; 11.0.1 before 11.0.15; 9.0.0; 9.0.0; 9.0.0; +34 more |
| CVE-2016-5018 | 9.1 | Aug 10 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured… Affected: 9.0.0.M1 to 9.0.0.M9; 8.5.0 to 8.5.4; 8.0.0.RC1 to 8.0.36; 7.0.0 to 7.0.70; 6.0.0 to 6.0.45 |
| CVE-2017-5648 | 9.1 | Apr 17 | While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to… Affected: 9.0.0.M1 to 9.0.0.M17; 8.5.0 to 8.5.11; 8.0.0.RC1 to 8.0.41; 7.0.0 to 7.0.75 |
| CVE-2016-0714 | 8.8 | Feb 25 | The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which… Affected: 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; 6.0.2; +34 more |
| CVE-2015-5351 | 8.8 | Feb 25 | The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for… Affected: 7.0.0; 7.0.2; 7.0.4; 7.0.5; 7.0.6; 7.0.10; +34 more |
| CVE-2022-25762 | 8.6 | May 13 | Response mix-up with WebSocket concurrent send and close Affected: Apache Tomcat 9 9.0.0.M1 to 9.0.20; Apache Tomcat 8.5 8.5.0 to 8.5.75 |
| CVE-2025-49124 | 8.4 | Jun 16 | Untrusted Search Path vulnerability in Apache Tomcat installer for Windows Affected: 9.0.23 before 9.0.106; 10.1.0 before 10.1.42; 11.0.0 before 11.0.8 |
| CVE-2026-77762 | 8.1 | Sep 23 | Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.39 through 9.0.121; 8.5.59 through 8.5.100 |
| CVE-2026-68569 | 8.1 | Aug 25 | Apache Tomcat: Principal lookup can fail open in some cases Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.0.M1 through 9.0.120; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-66422 | 8.1 | Aug 25 | Apache Tomcat: Servlet role references can bypass declarative role constraints Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.25 through 9.0.120; 8.5.46 through 8.5.100; 7.0.97 through 7.0.109 |
| CVE-2026-65183 | 8.1 | Aug 25 | Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.42 through 9.0.120 |
| CVE-2019-0232 | 8.1 | Apr 15 | When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code… Affected: 7.0.0 through 7.0.93; 8.5.0 through 8.5.39; 9.0.1 through 9.0.17; 9.0.0; 9.0.0; 9.0.0; +23 more |
| CVE-2016-5388 | 8.1 | Jul 19 | Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the… Affected: 6.0 through 6.0.45; 7.0 through 7.0.70; 8.0 through 8.5.4 |
| CVE-2015-5346 | 8.1 | Feb 25 | Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple… Affected: 7.0.0; 7.0.2; 7.0.4; 7.0.5; 7.0.6; 7.0.10; +34 more |
| CVE-2020-8022 | 7.8 | Jun 29 | User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges Affected: before 8.0.53-29.32.1; before 8.0.53-29.32.1; before 8.0.53-29.32.1; before 8.0.53-29.32.1; before 8.0.53-29.32.1; before 8.0.53-29.32.1; +7 more |
| CVE-2016-9775 | 7.8 | Mar 23 | The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS… Affected: 6.0; 7.0; 8.0 |
| CVE-2016-9774 | 7.8 | Mar 23 | The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package… Affected: 6.0; 7.0; 8.0 |
| CVE-2016-6325 | 7.8 | Oct 13 | The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2)… Affected: All versions, or not specified |