TO
Web Server
Tomcat
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
7
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 31High 89Medium 43Low 4
Watch
Add Tomcat to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-5425 | 7.8 | Oct 13 | The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for… Affected: All versions, or not specified |
| CVE-2016-1240 | 7.8 | Oct 3 | The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages… Affected: 6.0; 7.0; 8.0; 7.0; 8.0 |
| CVE-2026-87022 | 7.5 | Sep 23 | Apache Tomcat: WebSocket message smuggling with per-message-deflate Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.0.M1 through 9.0.121; 8.5.0 through 8.5.100; 7.0.56 through 7.0.109 |
| CVE-2026-79677 | 7.5 | Sep 23 | Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.0.M1 through 9.0.121; 8.5.0 through 8.5.100; 7.0.43 through 7.0.109 |
| CVE-2026-78383 | 7.5 | Sep 23 | Apache Tomcat: AJP DoS via missing request body Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.0.M1 through 9.0.121; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-77791 | 7.5 | Sep 23 | Apache Tomcat: DoS via busy wait during WebSocket close Affected: 11.0.0-M5 through 11.0.25; 10.1.8 through 10.1.59; 9.0.74 through 9.0.121; 8.5.88 through 8.5.100 |
| CVE-2026-68763 | 7.5 | Aug 25 | Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.39 through 9.0.120; 8.5.59 through 8.5.100 |
| CVE-2026-65927 | 7.5 | Aug 25 | Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.0.M1 through 9.0.120; 8.5.0 through 8.5.100 |
| CVE-2026-43513 | 7.5 | May 12 | Apache Tomcat: LockOutRealm treats user names as case-sensitive Affected: 11.0.0-M1 through 11.0.21; 10.1.0-M1 through 10.1.54; 9.0.0.M1 through 9.0.117; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-41284 | 7.5 | May 12 | Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Affected: 11.0.0-M1 through 11.0.21; 10.1.0-M1 through 10.1.54; 9.0.0.M1 through 9.0.117; 10.0.0-M1 through 10.0.27; 8.5.0 through 8.5.100; 4.0 through 7.0.109 |
| CVE-2026-34487 | 7.5 | Apr 9 | Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token Affected: 11.0.0-M1 through 11.0.20; 10.1.0-M1 through 10.1.53; 9.0.13 through 9.0.116 |
| CVE-2026-34483 | 7.5 | Apr 9 | Apache Tomcat: Incomplete escaping of JSON access logs Affected: 11.0.0-M1 through 11.0.20; 10.1.0-M1 through 10.1.53; 9.0.40 through 9.0.116; 8.5.84 through 8.5.100 |
| CVE-2026-29146 | 7.5 | Apr 9 | Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default Affected: 11.0.0-M1 through 11.0.18; 10.0.0-M1 through 10.1.52; 9.0.13 through 9.0.115; 8.5.38 through 8.5.100; 7.0.100 through 7.0.109 |
| CVE-2026-29129 | 7.5 | Apr 9 | Apache Tomcat: TLS cipher order is not preserved Affected: 11.0.16 through 11.0.18; 10.1.51 through 10.1.52; 9.0.114 through 9.0.115 |
| CVE-2026-24880 | 7.5 | Apr 9 | Apache Tomcat: Request smuggling via invalid chunk extension Affected: 11.0.0-M1 through 11.0.18; 10.1.0-M1 through 10.1.52; 9.0.0.M1 through 9.0.115; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-24734 | 7.5 | Feb 17 | Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat Affected: 9.0.83 before 9.0.115; 10.1.1 before 10.1.52; 11.0.1 before 11.0.18; 10.1.0; 10.1.0; 10.1.0; +34 more |
| CVE-2025-55752 | 7.5 | Oct 27 | Relative Path Traversal vulnerability in Apache Tomcat Affected: 8.5.6 through 8.5.100; 9.0.1 before 9.0.109; 10.0.0 before 10.0.27; 10.1.0 before 10.1.45; 11.0.0 before 11.0.11; 9.0.0; +17 more |
| CVE-2025-48989 | 7.5 | Aug 13 | Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack Affected: 9.0.1 before 9.0.108; 10.0.0 before 10.1.44; 11.0.0 before 11.0.10; 9.0.0; 9.0.0; 9.0.0; +24 more |
| CVE-2025-53506 | 7.5 | Jul 10 | Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent… Affected: 9.0.0 through 9.0.106; 10.1.0 through 10.1.42; 11.0.0 through 11.0.8 |
| CVE-2025-52520 | 7.5 | Jul 10 | For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits Affected: 9.0.0 before 9.0.107; 10.1.0 before 10.1.43; 11.0.0 before 11.0.9 |
| CVE-2025-52434 | 7.5 | Jul 10 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector Affected: 9.0.0 before 9.0.107 |
| CVE-2025-49125 | 7.5 | Jun 16 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web… Affected: 9.0.0 before 9.0.106; 10.1.0 before 10.1.42; 11.0.0 before 11.0.8 |
| CVE-2025-48988 | 7.5 | Jun 16 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat Affected: 9.0.0 before 9.0.106; 10.1.0 before 10.1.42; 11.0.0 before 11.0.8 |
| CVE-2025-31650 | 7.5 | Apr 28 | Improper Input Validation vulnerability in Apache Tomcat Affected: 9.0.76 before 9.0.104; 10.1.10 before 10.1.40; 11.0.1 before 11.0.6; 11.0.0; 11.0.0; 11.0.0; +21 more |
| CVE-2024-38286 | 7.5 | Nov 7 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat Affected: 9.0.13 before 9.0.90; 10.1.1 before 10.1.25; 10.1.0; 10.1.0; 10.1.0; 10.1.0; +34 more |
| CVE-2024-34750 | 7.5 | Jul 3 | Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat Affected: 9.0.0 before 9.0.90; 10.1.0 before 10.1.25; 11.0.0; 11.0.0; 11.0.0; 11.0.0; +16 more |
| CVE-2024-24549 | 7.5 | Mar 13 | Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat Affected: 8.5.0 before 8.5.99; 9.0.0 before 9.0.86; 10.1.0 before 10.1.19; 11.0.0; 11.0.0; 11.0.0; +13 more |
| CVE-2023-46589 | 7.5 | Nov 28 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0… Affected: 8.5.0 before 8.5.96; 9.0.0 before 9.0.83; 10.1.0 before 10.1.16; 11.0.0; 11.0.0; 11.0.0; +7 more |
| CVE-2023-34981 | 7.5 | Jun 21 | A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare… Affected: 8.5.88; 9.0.74; 10.1.8; 11.0.0 |
| CVE-2023-28709 | 7.5 | May 22 | The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87 Affected: 8.5.85 through 8.5.87; 9.0.71 through 9.0.73; 10.1.5 through 10.1.7; 11.0.0; 11.0.0; 11.0.0 |
| CVE-2023-24998 | 7.5 | Feb 20 | Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts Affected: 11.0.0-M1; 10.0.0-M1 through 10.1.4; 9.0.0-M1 through 9.0.70; 8.5.0 through 8.5.84 |
| CVE-2022-45143 | 7.5 | Jan 3 | The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values Affected: 9.0.40 before 9.0.69; 8.5.83; 10.1.0; 10.1.0; 10.1.0; 10.1.0; +14 more |
| CVE-2022-42252 | 7.5 | Nov 1 | Apache Tomcat request smuggling via malformed content-length Affected: 10.1.0-M1 through 10.1.0; 10.0.0-M1 through 10.0.26; 9.0.0-M1 through 9.0.67; 8.5.0 through 8.5.82 |
| CVE-2022-29885 | 7.5 | May 12 | EncryptInterceptor does not provide complete protection on insecure networks Affected: Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14; Apache Tomcat 10 10.0.0-M1 to 10.0.20; Apache Tomcat 9 9.0.13 to 9.0.62; Apache Tomcat 8.5 8.5.38 to 8.5.78 |
| CVE-2021-42340 | 7.5 | Oct 14 | The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak Affected: 8.5.60 before 8.5.72; 9.0.40 before 9.0.54; 10.0.1 before 10.0.12; 10.0.0; 10.1.0; 10.1.0; +3 more |
| CVE-2021-41079 | 7.5 | Sep 16 | Apache Tomcat DoS with unexpected TLS packet Affected: Apache Tomcat 8.5 8.5.0 to 8.5.63; Apache Tomcat 9 9.0.0-M1 to 9.0.43; Apache Tomcat 10 10.0.0-M1 to 10.0.2 |
| CVE-2021-30639 | 7.5 | Jul 12 | A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service Affected: 8.5.64; 9.0.44; 10.0.3; 10.0.4 |
| CVE-2021-25122 | 7.5 | Mar 1 | Apache Tomcat h2c request mix-up Affected: Apache Tomcat 10 before 10.0.2; Apache Tomcat 9 before 9.0.42; Apache Tomcat 8.5 before 8.5.62 |
| CVE-2020-17527 | 7.5 | Dec 3 | Apache Tomcat: Request header mix-up between HTTP/2 streams Affected: Apache Tomcat 10 10.0.0-M1 to 10.0.0-M9; Apache Tomcat 9 9.0.0-M1 to 9.0.39; Apache Tomcat 8.5 8.5.0 to 8.5.59 |
| CVE-2020-13935 | 7.5 | Jul 14 | The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104 Affected: Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, 7.0.27 to 7.0.104 |
| CVE-2020-13934 | 7.5 | Jul 14 | An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2 Affected: Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, 8.5.1 to 8.5.56 |
| CVE-2020-11996 | 7.5 | Jun 26 | A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several… Affected: 10.0.0-M1 to 10.0.0-M5; 9.0.0.M1 to 9.0.35; 8.5.0 to 8.5.55 |
| CVE-2019-17563 | 7.5 | Dec 23 | When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session… Affected: 9.0.0.M1 to 9.0.29; 8.5.0 to 8.5.49; 7.0.0 to 7.0.98 |
| CVE-2019-10072 | 7.5 | Jun 21 | The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 Affected: 8.5.0 through 8.5.40; 9.0.1 through 9.0.19; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +23 more |
| CVE-2019-0199 | 7.5 | Apr 10 | The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep… Affected: 8.5.0 through 8.5.37; 9.0.1 through 9.0.14; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +17 more |
| CVE-2018-1336 | 7.5 | Aug 2 | An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service Affected: 9.0.0.M9 to 9.0.7; 8.5.0 to 8.5.30; 8.0.0.RC1 to 8.0.51; 7.0.28 to 7.0.86 |
| CVE-2018-8034 | 7.5 | Aug 1 | The host name verification when using TLS with the WebSocket client was missing Affected: 9.0.0.M1 to 9.0.9; 8.5.0 to 8.5.31; 8.0.0.RC1 to 8.0.52; 7.0.35 to 7.0.88 |
| CVE-2017-12616 | 7.5 | Sep 19 | When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the… Affected: 7.0.0 to 7.0.80 |
| CVE-2017-7675 | 7.5 | Aug 11 | The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks Affected: 8.5.0; 8.5.1; 8.5.2; 8.5.3; 8.5.4; 8.5.5; +31 more |
| CVE-2016-6796 | 7.5 | Aug 11 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured… Affected: 9.0.0.M1 to 9.0.0.M9; 8.5.0 to 8.5.4; 8.0.0.RC1 to 8.0.36; 7.0.0 to 7.0.70; 6.0.0 to 6.0.45 |