TO
Web Server
Tomcat
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
7
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 31High 89Medium 43Low 4
Watch
Add Tomcat to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-12617 In wildKEV | 8.1 | Oct 3 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g Affected: 9.0.0.M1 to 9.0.0; 8.5.0 to 8.5.22; 8.0.0.RC1 to 8.0.46; 7.0.0 to 7.0.81 |
| CVE-2017-12615 RansomwareIn wildKEV | 8.1 | Sep 19 | When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g Affected: 7.0.0 to 7.0.79 |
| CVE-2026-34486 In wildKEV | 7.5 | Apr 9 | Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor Affected: 11.0.20; 10.1.53; 9.0.116 |
| CVE-2023-44487 In wildKEV | 7.5 | Oct 10 | HTTP/2 Rapid Reset Attack Vulnerability Affected: 8.5.0 through 8.5.93; 9.0.0 through 9.0.80; 10.1.0 through 10.1.13; 11.0.0; 11.0.0; 11.0.0; +8 more |
| CVE-2016-0714 | 8.8 | Feb 25 | The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which… Affected: 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; 6.0.2; +34 more |
| CVE-2015-5351 | 8.8 | Feb 25 | The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for… Affected: 7.0.0; 7.0.2; 7.0.4; 7.0.5; 7.0.6; 7.0.10; +34 more |
| CVE-2022-25762 | 8.6 | May 13 | Response mix-up with WebSocket concurrent send and close Affected: Apache Tomcat 9 9.0.0.M1 to 9.0.20; Apache Tomcat 8.5 8.5.0 to 8.5.75 |
| CVE-2025-49124 | 8.4 | Jun 16 | Untrusted Search Path vulnerability in Apache Tomcat installer for Windows Affected: 9.0.23 before 9.0.106; 10.1.0 before 10.1.42; 11.0.0 before 11.0.8 |
| CVE-2026-77762 | 8.1 | Sep 23 | Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.39 through 9.0.121; 8.5.59 through 8.5.100 |
| CVE-2026-68569 | 8.1 | Aug 25 | Apache Tomcat: Principal lookup can fail open in some cases Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.0.M1 through 9.0.120; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-66422 | 8.1 | Aug 25 | Apache Tomcat: Servlet role references can bypass declarative role constraints Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.25 through 9.0.120; 8.5.46 through 8.5.100; 7.0.97 through 7.0.109 |
| CVE-2026-65183 | 8.1 | Aug 25 | Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.42 through 9.0.120 |
| CVE-2019-0232 | 8.1 | Apr 15 | When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code… Affected: 7.0.0 through 7.0.93; 8.5.0 through 8.5.39; 9.0.1 through 9.0.17; 9.0.0; 9.0.0; 9.0.0; +23 more |
| CVE-2016-5388 | 8.1 | Jul 19 | Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the… Affected: 6.0 through 6.0.45; 7.0 through 7.0.70; 8.0 through 8.5.4 |
| CVE-2015-5346 | 8.1 | Feb 25 | Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple… Affected: 7.0.0; 7.0.2; 7.0.4; 7.0.5; 7.0.6; 7.0.10; +34 more |
| CVE-2020-8022 | 7.8 | Jun 29 | User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges Affected: before 8.0.53-29.32.1; before 8.0.53-29.32.1; before 8.0.53-29.32.1; before 8.0.53-29.32.1; before 8.0.53-29.32.1; before 8.0.53-29.32.1; +7 more |
| CVE-2016-9775 | 7.8 | Mar 23 | The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS… Affected: 6.0; 7.0; 8.0 |
| CVE-2016-9774 | 7.8 | Mar 23 | The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS; the tomcat7 package… Affected: 6.0; 7.0; 8.0 |
| CVE-2016-6325 | 7.8 | Oct 13 | The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat and (2)… Affected: All versions, or not specified |
| CVE-2016-5425 | 7.8 | Oct 13 | The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for… Affected: All versions, or not specified |
| CVE-2016-1240 | 7.8 | Oct 3 | The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages… Affected: 6.0; 7.0; 8.0; 7.0; 8.0 |
| CVE-2026-87022 | 7.5 | Sep 23 | Apache Tomcat: WebSocket message smuggling with per-message-deflate Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.0.M1 through 9.0.121; 8.5.0 through 8.5.100; 7.0.56 through 7.0.109 |
| CVE-2026-79677 | 7.5 | Sep 23 | Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.0.M1 through 9.0.121; 8.5.0 through 8.5.100; 7.0.43 through 7.0.109 |
| CVE-2026-78383 | 7.5 | Sep 23 | Apache Tomcat: AJP DoS via missing request body Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.0.M1 through 9.0.121; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-77791 | 7.5 | Sep 23 | Apache Tomcat: DoS via busy wait during WebSocket close Affected: 11.0.0-M5 through 11.0.25; 10.1.8 through 10.1.59; 9.0.74 through 9.0.121; 8.5.88 through 8.5.100 |
| CVE-2026-68763 | 7.5 | Aug 25 | Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.39 through 9.0.120; 8.5.59 through 8.5.100 |
| CVE-2026-65927 | 7.5 | Aug 25 | Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.0.M1 through 9.0.120; 8.5.0 through 8.5.100 |
| CVE-2026-43513 | 7.5 | May 12 | Apache Tomcat: LockOutRealm treats user names as case-sensitive Affected: 11.0.0-M1 through 11.0.21; 10.1.0-M1 through 10.1.54; 9.0.0.M1 through 9.0.117; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-41284 | 7.5 | May 12 | Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Affected: 11.0.0-M1 through 11.0.21; 10.1.0-M1 through 10.1.54; 9.0.0.M1 through 9.0.117; 10.0.0-M1 through 10.0.27; 8.5.0 through 8.5.100; 4.0 through 7.0.109 |
| CVE-2026-34487 | 7.5 | Apr 9 | Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token Affected: 11.0.0-M1 through 11.0.20; 10.1.0-M1 through 10.1.53; 9.0.13 through 9.0.116 |
| CVE-2026-34483 | 7.5 | Apr 9 | Apache Tomcat: Incomplete escaping of JSON access logs Affected: 11.0.0-M1 through 11.0.20; 10.1.0-M1 through 10.1.53; 9.0.40 through 9.0.116; 8.5.84 through 8.5.100 |
| CVE-2026-29146 | 7.5 | Apr 9 | Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default Affected: 11.0.0-M1 through 11.0.18; 10.0.0-M1 through 10.1.52; 9.0.13 through 9.0.115; 8.5.38 through 8.5.100; 7.0.100 through 7.0.109 |
| CVE-2026-29129 | 7.5 | Apr 9 | Apache Tomcat: TLS cipher order is not preserved Affected: 11.0.16 through 11.0.18; 10.1.51 through 10.1.52; 9.0.114 through 9.0.115 |
| CVE-2026-24880 | 7.5 | Apr 9 | Apache Tomcat: Request smuggling via invalid chunk extension Affected: 11.0.0-M1 through 11.0.18; 10.1.0-M1 through 10.1.52; 9.0.0.M1 through 9.0.115; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-24734 | 7.5 | Feb 17 | Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat Affected: 9.0.83 before 9.0.115; 10.1.1 before 10.1.52; 11.0.1 before 11.0.18; 10.1.0; 10.1.0; 10.1.0; +34 more |
| CVE-2025-55752 | 7.5 | Oct 27 | Relative Path Traversal vulnerability in Apache Tomcat Affected: 8.5.6 through 8.5.100; 9.0.1 before 9.0.109; 10.0.0 before 10.0.27; 10.1.0 before 10.1.45; 11.0.0 before 11.0.11; 9.0.0; +17 more |
| CVE-2025-48989 | 7.5 | Aug 13 | Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack Affected: 9.0.1 before 9.0.108; 10.0.0 before 10.1.44; 11.0.0 before 11.0.10; 9.0.0; 9.0.0; 9.0.0; +24 more |
| CVE-2025-53506 | 7.5 | Jul 10 | Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent… Affected: 9.0.0 through 9.0.106; 10.1.0 through 10.1.42; 11.0.0 through 11.0.8 |
| CVE-2025-52520 | 7.5 | Jul 10 | For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits Affected: 9.0.0 before 9.0.107; 10.1.0 before 10.1.43; 11.0.0 before 11.0.9 |
| CVE-2025-52434 | 7.5 | Jul 10 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector Affected: 9.0.0 before 9.0.107 |
| CVE-2025-49125 | 7.5 | Jun 16 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web… Affected: 9.0.0 before 9.0.106; 10.1.0 before 10.1.42; 11.0.0 before 11.0.8 |
| CVE-2025-48988 | 7.5 | Jun 16 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat Affected: 9.0.0 before 9.0.106; 10.1.0 before 10.1.42; 11.0.0 before 11.0.8 |
| CVE-2025-31650 | 7.5 | Apr 28 | Improper Input Validation vulnerability in Apache Tomcat Affected: 9.0.76 before 9.0.104; 10.1.10 before 10.1.40; 11.0.1 before 11.0.6; 11.0.0; 11.0.0; 11.0.0; +21 more |
| CVE-2024-38286 | 7.5 | Nov 7 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat Affected: 9.0.13 before 9.0.90; 10.1.1 before 10.1.25; 10.1.0; 10.1.0; 10.1.0; 10.1.0; +34 more |
| CVE-2024-34750 | 7.5 | Jul 3 | Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat Affected: 9.0.0 before 9.0.90; 10.1.0 before 10.1.25; 11.0.0; 11.0.0; 11.0.0; 11.0.0; +16 more |
| CVE-2024-24549 | 7.5 | Mar 13 | Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat Affected: 8.5.0 before 8.5.99; 9.0.0 before 9.0.86; 10.1.0 before 10.1.19; 11.0.0; 11.0.0; 11.0.0; +13 more |
| CVE-2023-46589 | 7.5 | Nov 28 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0… Affected: 8.5.0 before 8.5.96; 9.0.0 before 9.0.83; 10.1.0 before 10.1.16; 11.0.0; 11.0.0; 11.0.0; +7 more |
| CVE-2023-34981 | 7.5 | Jun 21 | A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare… Affected: 8.5.88; 9.0.74; 10.1.8; 11.0.0 |
| CVE-2023-28709 | 7.5 | May 22 | The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87 Affected: 8.5.85 through 8.5.87; 9.0.71 through 9.0.73; 10.1.5 through 10.1.7; 11.0.0; 11.0.0; 11.0.0 |
| CVE-2023-24998 | 7.5 | Feb 20 | Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts Affected: 11.0.0-M1; 10.0.0-M1 through 10.1.4; 9.0.0-M1 through 9.0.70; 8.5.0 through 8.5.84 |