TO
Web Server
Tomcat
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
7
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 31High 89Medium 43Low 4
Watch
Add Tomcat to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-33037 | 5.3 | Jul 12 | Incorrect Transfer-Encoding handling with HTTP/1.0 Affected: Apache Tomcat 10 10.0.0-M1 to 10.0.6; Apache Tomcat 9 9.0.0.M1 to 9.0.46; Apache Tomcat 8 8.5.0 to 8.5.66 |
| CVE-2017-15706 | 5.3 | Jan 31 | As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description… Affected: 7.0.79 through 7.0.82; 8.0.45 through 8.0.47; 8.5.16 through 8.5.23; 9.0.0; 9.0.0; 9.0.0; +7 more |
| CVE-2016-6794 | 5.3 | Aug 10 | When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager Affected: 9.0.0.M1 to 9.0.0.M9; 8.5.0 to 8.5.4; 8.0.0.RC1 to 8.0.36; 7.0.0 to 7.0.70; 6.0.0 to 6.0.45 |
| CVE-2015-5345 | 5.3 | Feb 25 | The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints… Affected: 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; 6.0.2; +34 more |
| CVE-2019-17569 | 4.8 | Feb 24 | The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression Affected: 7.0.98 through 7.0.99; 8.5.48 through 8.5.50; 9.0.28 through 9.0.30 |
| CVE-2020-1935 | 4.8 | Feb 24 | In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP… Affected: Apache Tomcat 9.0.0.M1 to 9.0.30; 8.5.0 to 8.5.50; 7.0.0 to 7.0.99 |
| CVE-2023-28708 | 4.3 | Mar 22 | When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache… Affected: 8.5.0 before 8.5.86; after 9.0.0 before 9.0.72; after 10.1.0 before 10.1.6; 11.0.0; 11.0.0 |
| CVE-2020-13943 | 4.3 | Oct 12 | If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a… Affected: Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57 |
| CVE-2018-11784 | 4.3 | Oct 4 | When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g Affected: 9.0.0.M1 to 9.0.11; 8.5.0 to 8.5.33; 7.0.23 to 7.0.90 |
| CVE-2017-7674 | 4.3 | Aug 11 | The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response… Affected: 9.0.0.M1 to 9.0.0.M21; 8.5.0 to 8.5.15; 8.0.0.RC1 to 8.0.44; 7.0.41 to 7.0.78 |
| CVE-2016-0706 | 4.3 | Feb 25 | Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the… Affected: 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; 6.0.2; +34 more |
| CVE-2015-5174 | 4.3 | Feb 25 | Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass… Affected: 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; 6.0.2; +34 more |
| CVE-2009-0783 | 4.2 | Jun 5 | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows… Affected: 4.1.0 through 4.1.39; 5.5.0 through 5.5.27; 6.0.0 through 6.0.18 |
| CVE-2026-77756 | 3.7 | Sep 23 | Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.47 through 9.0.121; 8.5.67 through 8.5.100 |
| CVE-2026-43514 | 3.7 | May 12 | Apache Tomcat: AJP secret compared in non-constant time Affected: 11.0.0-M1 through 11.0.21; 10.1.0-M1 through 10.1.54; 9.0.0.M1 through 9.0.117; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-24733 | 3.7 | Feb 17 | Apache Tomcat: Security constraint bypass with HTTP/0.9 Affected: 11.0.0-M1 through 11.0.14; 10.1.0-M1 through 10.1.49; 9.0.0.M1 through 9.0.112; through 8.5.100 |
| CVE-2021-43980 | 3.7 | Sep 28 | The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger)… Affected: 8.5.0 through 8.5.77; 9.0.0 through 9.0.60; 10.0.0 through 10.0.18; 10.1.0; 10.1.0; 10.1.0; +9 more |
| CVE-2026-93446 | – | Oct 20 | Apache Tomcat: Possible TLS 1.3 connection failures Affected: 11.0.0-M21 through 11.0.26; 10.1.25 through 10.1.60; 9.0.90 through 9.0.122 |
| CVE-2026-88041 | – | Oct 20 | Apache Tomcat: HTTP/2 trailer header cross-contamination Affected: 11.0.0-M23 through 11.0.26; 10.1.27 through 10.1.60; 9.0.92 through 9.0.122 |
| CVE-2026-80353 | – | Oct 20 | Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector Affected: 9.0.47 through 9.0.122 |
| CVE-2026-74049 | – | Oct 20 | Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) Affected: 11.0.0-M1 through 11.0.26; 10.1.0-M1 through 10.1.60; 9.0.0.M1 through 9.0.122; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-74048 | – | Oct 20 | Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up Affected: 11.0.0-M14 through 11.0.26; 10.1.22 through 10.1.60; 9.0.92 through 9.0.122 |
| CVE-2014-7810 | – | Jun 7 | The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an… Affected: 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; 6.0.2; +34 more |
| CVE-2014-0230 | – | Jun 7 | Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire… Affected: 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; 6.0.2; +34 more |
| CVE-2014-0227 | – | Feb 16 | java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to… Affected: 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; 6.0.2; +34 more |
| CVE-2013-4444 | – | Sep 12 | Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote… Affected: through 7.0.39; 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.2; +32 more |
| CVE-2014-0095 | – | May 31 | java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a… Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.1; 8.0.3 |
| CVE-2014-0096 | – | May 31 | java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict… Affected: 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.2; 7.0.3; +34 more |
| CVE-2014-0119 | – | May 31 | Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which… Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.1; 8.0.3; +34 more |
| CVE-2014-0099 | – | May 31 | Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy,… Affected: through 6.0.39; 6; 6.0; 6.0.0; 6.0.0; 6.0.1; +34 more |
| CVE-2014-0075 | – | May 31 | Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x… Affected: 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.2; 7.0.3; +34 more |
| CVE-2014-0033 | – | Feb 26 | org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL,… Affected: 6.0.33; 6.0.34; 6.0.35; 6.0.36; 6.0.37 |
| CVE-2013-4590 | – | Feb 26 | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web… Affected: 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; 8.0.0; +34 more |
| CVE-2013-4286 | – | Feb 26 | Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP… Affected: 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.2; 7.0.3; +34 more |
| CVE-2013-4322 | – | Feb 26 | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or… Affected: 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.2; 7.0.3; +34 more |
| CVE-2013-0346 | – | Feb 15 | Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file Affected: 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.2; 7.0.3; +34 more |
| CVE-2013-2185 | – | Jan 19 | The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0,… Affected: through 7.0.39 |
| CVE-2013-6357 | – | Nov 13 | Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of… Affected: through 5.5.25; 1.1.3; 3.0; 3.1; 3.1.1; 3.2; +34 more |
| CVE-2013-2071 | – | Jun 1 | java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an… Affected: 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.2; 7.0.3; +25 more |
| CVE-2013-2067 | – | Jun 1 | java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly… Affected: 6.0.21; 6.0.24; 6.0.26; 6.0.27; 6.0.28; 6.0.29; +34 more |
| CVE-2012-3544 | – | Jun 1 | Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of… Affected: 6.0; 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; +34 more |
| CVE-2012-3546 | – | Dec 19 | org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass… Affected: 6.0; 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; +34 more |
| CVE-2012-4534 | – | Dec 19 | org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows… Affected: 6.0; 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; +34 more |
| CVE-2012-4431 | – | Dec 19 | org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery… Affected: 6.0; 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; +34 more |
| CVE-2012-5568 | – | Nov 30 | Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris Affected: 7.0.0 through 7.0.105 |
| CVE-2012-5885 | – | Nov 17 | The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |
| CVE-2012-5886 | – | Nov 17 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |
| CVE-2012-5887 | – | Nov 17 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values… Affected: 5.5.0 before 5.5.36; 6.0.0 before 6.0.36; 7.0.0 before 7.0.30 |
| CVE-2012-2733 | – | Nov 16 | java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the… Affected: 6.0; 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; +34 more |
| CVE-2012-0022 | – | Jan 19 | Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |