TO
Web Server
Tomcat
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
7
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 31High 89Medium 43Low 4
Watch
Add Tomcat to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-73180 | 6.8 | Aug 25 | Apache Tomcat: Authenticated WebSocket session survives end of HTTP session Affected: 11.0.0-M1 through 11.0.24; 10.1.0-M1 through 10.1.57; 9.0.0.M1 through 9.0.120; 8.5.0 through 8.5.100; 7.0.43 through 7.0.109 |
| CVE-2026-73581 | 6.5 | Sep 23 | Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore Affected: 11.0.0-M1 through 11.0.25; 10.1.0-M1 through 10.1.59; 9.0.0.M1 through 9.0.121; 8.5.0 through 8.5.100 |
| CVE-2026-55956 | 6.5 | Jun 29 | Apache Tomcat: Security constraints for default servlet ignored method Affected: 11.0.0-M1 through 11.0.22; 10.1.0-M1 through 10.1.55; 9.0.0.M1 through 9.0.118; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-55955 | 6.5 | Jun 29 | Apache Tomcat: EncryptInterceptor not protected against replay attacks Affected: 11.0.0-M1 through 11.0.22; 10.1.0-M1 through 10.1.55; 9.0.13 through 9.0.118; 8.5.38 through 8.5.100; 7.0.100 through 7.0.109 |
| CVE-2026-34500 | 6.5 | Apr 9 | Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled Affected: 11.0.0-M14 through 11.0.20; 10.1.22 through 10.1.53; 9.0.92 through 9.0.116 |
| CVE-2025-55668 | 6.5 | Aug 13 | Session Fixation vulnerability in Apache Tomcat via rewrite valve Affected: 9.0.1 before 9.0.106; 10.0.0 before 10.1.42; 11.0.0 before 11.0.8; 9.0.0; 9.0.0; 9.0.0; +24 more |
| CVE-2024-52317 | 6.5 | Nov 18 | Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or… Affected: 9.0.92 before 9.0.96; 10.1.27 before 10.1.31; 11.0.0; 11.0.0; 11.0.0; 11.0.0 |
| CVE-2021-30640 | 6.5 | Jul 12 | Auth weakness in JNDIRealm Affected: Apache Tomcat 10 10.0.0-M1 to 10.0.5; Apache Tomcat 9 9.0.0.M1 to 9.0.45; Apache Tomcat 8.5 8.5.0 to 8.5.65; Apache Tomcat 7 7.0.0 to 7.0.108 |
| CVE-2018-1305 | 6.5 | Feb 23 | Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a… Affected: Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84 |
| CVE-2024-23672 | 6.3 | Mar 13 | Denial of Service via incomplete cleanup vulnerability in Apache Tomcat Affected: 8.5.0 before 8.5.99; 9.0.0 before 9.0.86; 10.1.0 before 10.1.19; 11.0.0; 11.0.0; 11.0.0; +13 more |
| CVE-2016-0763 | 6.3 | Feb 25 | The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider… Affected: 7.0.0; 7.0.2; 7.0.4; 7.0.5; 7.0.6; 7.0.10; +34 more |
| CVE-2026-50229 | 6.1 | Jun 29 | Apache Tomcat: XSS in number guess example Affected: 11.0.0-M1 through 11.0.22; 10.1.0-M1 through 10.1.55; 9.0.0.M1 through 9.0.118; 8.5.0 through 8.5.100; 7.0.0 through 7.0.109 |
| CVE-2026-25854 | 6.1 | Apr 9 | Apache Tomcat: Occasionally open redirect Affected: 11.0.0-M1 through 11.0.18; 10.1.0-M1 through 10.1.52; 9.0.0.M23 through 9.0.115; 8.5.30 through 8.5.100 |
| CVE-2024-52318 | 6.1 | Nov 18 | Incorrect object recycling and reuse vulnerability in Apache Tomcat Affected: 9.0.96; 10.1.31; 11.0.0 |
| CVE-2023-41080 | 6.1 | Aug 25 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10,… Affected: 8.5.0 through 8.5.92; 9.0.0 through 9.0.79; 10.1.0 through 10.1.12; 11.0.0; 11.0.0; 11.0.0; +7 more |
| CVE-2022-34305 | 6.1 | Jun 23 | XSS in examples web application Affected: Apache Tomcat 8.5 8.5.50 to 8.5.81; Apache Tomcat 9 9.0.30 to 9.0.64; Apache Tomcat 10.0 10.0.0-M1 to 10.0.22; Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M16 |
| CVE-2019-0221 | 6.1 | May 28 | The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS Affected: 7.0.0 through 7.0.93; 8.5.0 through 8.5.39; 9.0.1 through 9.0.17; 9.0.0; 9.0.0; 9.0.0; +24 more |
| CVE-2023-42794 | 5.9 | Oct 10 | Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows Affected: 9.0.70 through 9.0.80; 8.5.85 through 8.5.93 |
| CVE-2021-24122 | 5.9 | Jan 14 | Apache Tomcat information disclosure Affected: Apache Tomcat 10 before 10.0.0-M10; Apache Tomcat 9 before 9.0.40; Apache Tomcat 8.5 before 8.5.60; Apache Tomcat 7 before 7.0.106 |
| CVE-2019-2684 | 5.9 | Apr 23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: 7.0.0 through 7.0.97; 8.5.0 through 8.5.47; 9.0.1 through 9.0.28; 9.0.0; 9.0.0; 9.0.0; +24 more |
| CVE-2018-8037 | 5.9 | Aug 2 | If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a… Affected: 9.0.0.M9 to 9.0.9; 8.5.5 to 8.5.31 |
| CVE-2018-1304 | 5.9 | Feb 28 | The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49… Affected: Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84 |
| CVE-2016-0762 | 5.9 | Aug 10 | The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied… Affected: 9.0.0.M1 to 9.0.0.M9; 8.5.0 to 8.5.4; 8.0.0.RC1 to 8.0.36; 7.0.0 to 7.0.70; 6.0.0 to 6.0.45 |
| CVE-2026-66299 | 5.3 | Jul 28 | Apache Tomcat: DoS via WebSocket chat example Affected: 11.0.0-M20 through 11.0.24; 10.1.24 through 10.1.57; 9.0.89 through 9.0.120 |
| CVE-2026-32990 | 5.3 | Apr 9 | Apache Tomcat: Fix for CVE-2025-66614 is incomplete Affected: 11.0.15 through 11.0.19; 10.1.50 through 10.1.52; 9.0.113 through 9.0.115 |
| CVE-2025-61795 | 5.3 | Oct 27 | Improper Resource Shutdown or Release vulnerability in Apache Tomcat Affected: 8.5.0 through 8.5.100; 9.0.0 before 9.0.110; 10.0.0 before 10.0.27; 10.1.0 before 10.1.47; 11.0.0 before 11.0.12 |
| CVE-2024-54677 | 5.3 | Dec 17 | Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service Affected: 9.0.0 before 9.0.98; 10.1.0 before 10.1.34; 11.0.0 before 11.0.2 |
| CVE-2024-21733 | 5.3 | Jan 19 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through… Affected: 8.5.7 before 8.5.64; 9.0.1 before 9.0.44; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +13 more |
| CVE-2023-45648 | 5.3 | Oct 10 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0… Affected: 8.5.0 before 8.5.94; 9.0.1 before 9.0.81; 10.1.1 before 10.1.14; 9.0.0; 9.0.0; 9.0.0; +34 more |
| CVE-2023-42795 | 5.3 | Oct 10 | Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from… Affected: 8.5.0 before 8.5.94; 9.0.1 before 9.0.81; 10.1.1 before 10.1.14; 9.0.0; 9.0.0; 9.0.0; +34 more |
| CVE-2021-33037 | 5.3 | Jul 12 | Incorrect Transfer-Encoding handling with HTTP/1.0 Affected: Apache Tomcat 10 10.0.0-M1 to 10.0.6; Apache Tomcat 9 9.0.0.M1 to 9.0.46; Apache Tomcat 8 8.5.0 to 8.5.66 |
| CVE-2017-15706 | 5.3 | Jan 31 | As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description… Affected: 7.0.79 through 7.0.82; 8.0.45 through 8.0.47; 8.5.16 through 8.5.23; 9.0.0; 9.0.0; 9.0.0; +7 more |
| CVE-2016-6794 | 5.3 | Aug 10 | When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager Affected: 9.0.0.M1 to 9.0.0.M9; 8.5.0 to 8.5.4; 8.0.0.RC1 to 8.0.36; 7.0.0 to 7.0.70; 6.0.0 to 6.0.45 |
| CVE-2015-5345 | 5.3 | Feb 25 | The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints… Affected: 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; 6.0.2; +34 more |
| CVE-2019-17569 | 4.8 | Feb 24 | The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression Affected: 7.0.98 through 7.0.99; 8.5.48 through 8.5.50; 9.0.28 through 9.0.30 |
| CVE-2020-1935 | 4.8 | Feb 24 | In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP… Affected: Apache Tomcat 9.0.0.M1 to 9.0.30; 8.5.0 to 8.5.50; 7.0.0 to 7.0.99 |
| CVE-2023-28708 | 4.3 | Mar 22 | When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache… Affected: 8.5.0 before 8.5.86; after 9.0.0 before 9.0.72; after 10.1.0 before 10.1.6; 11.0.0; 11.0.0 |
| CVE-2020-13943 | 4.3 | Oct 12 | If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a… Affected: Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57 |
| CVE-2018-11784 | 4.3 | Oct 4 | When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g Affected: 9.0.0.M1 to 9.0.11; 8.5.0 to 8.5.33; 7.0.23 to 7.0.90 |
| CVE-2017-7674 | 4.3 | Aug 11 | The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response… Affected: 9.0.0.M1 to 9.0.0.M21; 8.5.0 to 8.5.15; 8.0.0.RC1 to 8.0.44; 7.0.41 to 7.0.78 |
| CVE-2016-0706 | 4.3 | Feb 25 | Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the… Affected: 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; 6.0.2; +34 more |
| CVE-2015-5174 | 4.3 | Feb 25 | Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass… Affected: 6.0.0; 6.0.0; 6.0.1; 6.0.1; 6.0.2; 6.0.2; +34 more |
| CVE-2009-0783 | 4.2 | Jun 5 | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows… Affected: 4.1.0 through 4.1.39; 5.5.0 through 5.5.27; 6.0.0 through 6.0.18 |
Showing 43