TO
Web Server
Tomcat
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
7
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 31High 89Medium 43Low 4
Watch
Add Tomcat to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-45143 | 7.5 | Jan 3 | The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values Affected: 9.0.40 before 9.0.69; 8.5.83; 10.1.0; 10.1.0; 10.1.0; 10.1.0; +14 more |
| CVE-2022-42252 | 7.5 | Nov 1 | Apache Tomcat request smuggling via malformed content-length Affected: 10.1.0-M1 through 10.1.0; 10.0.0-M1 through 10.0.26; 9.0.0-M1 through 9.0.67; 8.5.0 through 8.5.82 |
| CVE-2022-29885 | 7.5 | May 12 | EncryptInterceptor does not provide complete protection on insecure networks Affected: Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14; Apache Tomcat 10 10.0.0-M1 to 10.0.20; Apache Tomcat 9 9.0.13 to 9.0.62; Apache Tomcat 8.5 8.5.38 to 8.5.78 |
| CVE-2021-42340 | 7.5 | Oct 14 | The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak Affected: 8.5.60 before 8.5.72; 9.0.40 before 9.0.54; 10.0.1 before 10.0.12; 10.0.0; 10.1.0; 10.1.0; +3 more |
| CVE-2021-41079 | 7.5 | Sep 16 | Apache Tomcat DoS with unexpected TLS packet Affected: Apache Tomcat 8.5 8.5.0 to 8.5.63; Apache Tomcat 9 9.0.0-M1 to 9.0.43; Apache Tomcat 10 10.0.0-M1 to 10.0.2 |
| CVE-2021-30639 | 7.5 | Jul 12 | A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service Affected: 8.5.64; 9.0.44; 10.0.3; 10.0.4 |
| CVE-2021-25122 | 7.5 | Mar 1 | Apache Tomcat h2c request mix-up Affected: Apache Tomcat 10 before 10.0.2; Apache Tomcat 9 before 9.0.42; Apache Tomcat 8.5 before 8.5.62 |
| CVE-2020-17527 | 7.5 | Dec 3 | Apache Tomcat: Request header mix-up between HTTP/2 streams Affected: Apache Tomcat 10 10.0.0-M1 to 10.0.0-M9; Apache Tomcat 9 9.0.0-M1 to 9.0.39; Apache Tomcat 8.5 8.5.0 to 8.5.59 |
| CVE-2020-13935 | 7.5 | Jul 14 | The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104 Affected: Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56, 7.0.27 to 7.0.104 |
| CVE-2020-13934 | 7.5 | Jul 14 | An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2 Affected: Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, 8.5.1 to 8.5.56 |
| CVE-2020-11996 | 7.5 | Jun 26 | A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several… Affected: 10.0.0-M1 to 10.0.0-M5; 9.0.0.M1 to 9.0.35; 8.5.0 to 8.5.55 |
| CVE-2019-17563 | 7.5 | Dec 23 | When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session… Affected: 9.0.0.M1 to 9.0.29; 8.5.0 to 8.5.49; 7.0.0 to 7.0.98 |
| CVE-2019-10072 | 7.5 | Jun 21 | The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 Affected: 8.5.0 through 8.5.40; 9.0.1 through 9.0.19; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +23 more |
| CVE-2019-0199 | 7.5 | Apr 10 | The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep… Affected: 8.5.0 through 8.5.37; 9.0.1 through 9.0.14; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +17 more |
| CVE-2018-1336 | 7.5 | Aug 2 | An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service Affected: 9.0.0.M9 to 9.0.7; 8.5.0 to 8.5.30; 8.0.0.RC1 to 8.0.51; 7.0.28 to 7.0.86 |
| CVE-2018-8034 | 7.5 | Aug 1 | The host name verification when using TLS with the WebSocket client was missing Affected: 9.0.0.M1 to 9.0.9; 8.5.0 to 8.5.31; 8.0.0.RC1 to 8.0.52; 7.0.35 to 7.0.88 |
| CVE-2017-12616 | 7.5 | Sep 19 | When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the… Affected: 7.0.0 to 7.0.80 |
| CVE-2017-7675 | 7.5 | Aug 11 | The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks Affected: 8.5.0; 8.5.1; 8.5.2; 8.5.3; 8.5.4; 8.5.5; +31 more |
| CVE-2016-6796 | 7.5 | Aug 11 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured… Affected: 9.0.0.M1 to 9.0.0.M9; 8.5.0 to 8.5.4; 8.0.0.RC1 to 8.0.36; 7.0.0 to 7.0.70; 6.0.0 to 6.0.45 |
| CVE-2016-8745 | 7.5 | Aug 10 | A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +34 more |
| CVE-2016-6817 | 7.5 | Aug 10 | The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer Affected: 8.5.0; 8.5.1; 8.5.2; 8.5.3; 8.5.4; 8.5.5; +12 more |
| CVE-2016-6797 | 7.5 | Aug 10 | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web… Affected: 9.0.0.M1 to 9.0.0.M9; 8.5.0 to 8.5.4; 8.0.0.RC1 to 8.0.36; 7.0.0 to 7.0.70; 6.0.0 to 6.0.45 |
| CVE-2017-5664 | 7.5 | Jun 6 | The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request… Affected: 9.0.0.M1 to 9.0.0.M20; 8.5.0 to 8.5.14; 8.0.0.RC1 to 8.0.43; 7.0.0 to 7.0.77 |
| CVE-2017-5650 | 7.5 | Apr 17 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were… Affected: 8.5.0; 8.5.1; 8.5.2; 8.5.3; 8.5.4; 8.5.5; +25 more |
| CVE-2017-5647 | 7.5 | Apr 17 | A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file… Affected: 6.0.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5; +34 more |
| CVE-2016-8747 | 7.5 | Mar 14 | An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations Affected: 8.5.7 before 8.5.10; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0 |
| CVE-2016-3092 | 7.5 | Jul 4 | The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and… Affected: 9.0.0; 9.0.0; 9.0.0; 9.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2014-0050 | 7.5 | Mar 28 | MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service… Affected: 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.2; 7.0.3; +34 more |
| CVE-2026-78437 | 7.3 | Sep 23 | Apache Tomcat: HTTP/2 DoS via malformed request Affected: 11.0.19 through 11.0.25; 10.1.53 through 10.1.59; 9.0.116 through 9.0.121 |
| CVE-2026-75973 | 7.3 | Sep 23 | Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.0.M4 through 9.0.121; 8.5.0 through 8.5.100 |
| CVE-2026-55957 | 7.3 | Jun 29 | Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind Affected: 11.0.0-M1 through 11.0.4; 10.1.0-M1 through 10.1.36; 9.0.0.M1 through 9.0.100; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-53404 | 7.3 | Jun 29 | Apache Tomcat: Bad ornext processing in RewriteValve Affected: 11.0.0-M1 through 11.0.22; 10.1.0-M1 through 10.1.55; 9.0.0.M1 through 9.0.118; 8.5.0 through 8.5.100 |
| CVE-2026-42498 | 7.3 | May 12 | Apache Tomcat: WebSocket authentication header exposure Affected: 11.0.0-M1 through 11.0.21; 10.1.0-M1 through 10.1.54; 9.0.2 through 9.0.117; 8.5.24 through 8.5.100; 7.0.83 through 7.0.109 |
| CVE-2025-46701 | 7.3 | May 29 | Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component… Affected: 9.0.0 before 9.0.105; 10.1.0 before 10.1.41; 11.0.0 before 11.0.7 |
| CVE-2016-6816 | 7.1 | Mar 20 | The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid… Affected: 6.0.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5; +34 more |
| CVE-2022-23181 | 7.0 | Jan 27 | The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to… Affected: 8.5.55 through 8.5.73; 9.0.35 through 9.0.56; 10.0.1 through 10.0.14; 10.0.0; 10.0.0; 10.0.0; +11 more |
| CVE-2021-25329 | 7.0 | Mar 1 | Incomplete fix for CVE-2020-9484 Affected: Apache Tomcat 10 before 10.0.0; Apache Tomcat 9 before 9.0.41; Apache Tomcat 8.5 before 8.5.61; Apache Tomcat 7 before 7.0.107 |
| CVE-2020-9484 | 7.0 | May 20 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a… Affected: Apache Tomcat 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54, 7.0.0 to 7.0.103 |
| CVE-2019-12418 | 7.0 | Dec 23 | When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat… Affected: 9.0.0.M1 to 9.0.28; 8.5.0 to 8.5.47; 7.0.0 to 7.0.97 |