Apache Software Foundation Apache Tomcat

• CVE-2026-34486 High 7.5 Exploited Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor 98.5%
• CVE-2025-24813 Critical 10.0 Exploited Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT 99.9%
• CVE-2017-12617 High 8.1 Exploited When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the De 100.0%
• CVE-2017-12615 High 8.1 Exploited When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to th 99.7%
• CVE-2016-8735 Critical 9.8 Exploited Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an atta 90.3%
• CVE-2026-103119 Critical 9.1 Apache Tomcat: AJP response mix-up 0.6%
• CVE-2026-101356 Critical 9.1 Apache Tomcat: HTTP/2 request/response mix-up after error during async processing 0.5%
• CVE-2026-101296 Critical 9.1 Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms 0.6%
• CVE-2026-93446 High 7.5 Apache Tomcat: Possible TLS 1.3 connection failures 0.6%
• CVE-2026-88041 High 7.5 Apache Tomcat: HTTP/2 trailer header cross-contamination 0.5%
• CVE-2026-80353 High 8.1 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector 0.4%
• CVE-2026-74049 Medium 6.1 Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) 0.4%
• CVE-2026-74048 Medium 6.5 Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up 0.4%
• CVE-2026-87022 High 7.5 Apache Tomcat: WebSocket message smuggling with per-message-deflate 0.5%
• CVE-2026-86350 Critical 9.1 Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up 0.5%
• CVE-2026-86248 Critical 9.8 Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled 0.5%
• CVE-2026-79677 High 7.5 Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout 0.4%
• CVE-2026-78437 High 7.3 Apache Tomcat: HTTP/2 DoS via malformed request 0.5%
• CVE-2026-78383 High 7.5 Apache Tomcat: AJP DoS via missing request body 0.5%
• CVE-2026-77791 High 7.5 Apache Tomcat: DoS via busy wait during WebSocket close 0.7%
• CVE-2026-77762 High 8.1 Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request 0.5%
• CVE-2026-77756 Low 3.7 Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests 0.5%
• CVE-2026-76183 Critical 9.8 Apache Tomcat: Bypass of security constraints for WebSocket endpoints 0.6%
• CVE-2026-75973 High 7.3 Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured 0.5%
• CVE-2026-73581 Medium 6.5 Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore 0.2%
• CVE-2026-73180 Medium 6.8 Apache Tomcat: Authenticated WebSocket session survives end of HTTP session 0.4%
• CVE-2026-68763 High 7.5 Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset 0.7%
• CVE-2026-68569 High 8.1 Apache Tomcat: Principal lookup can fail open in some cases 0.5%
• CVE-2026-68525 Critical 9.1 Apache Tomcat: Redirect after FORM auth may bypass method specific constraints 0.6%
• CVE-2026-66422 High 8.1 Apache Tomcat: Servlet role references can bypass declarative role constraints 0.4%
• CVE-2026-65927 High 7.5 Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control 0.7%
• CVE-2026-65905 Critical 9.8 Apache Tomcat: Limited replay attack possible with DIGEST authentication 0.8%
• CVE-2026-65637 Critical 9.8 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete 0.8%
• CVE-2026-65183 High 8.1 Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets 0.4%
• CVE-2026-65182 Critical 9.1 Apache Tomcat: Bypass longest prefix security constraint 0.7%
• CVE-2026-66299 High 7.5 Apache Tomcat: DoS via WebSocket chat example 0.6%
• CVE-2026-59084 Critical 9.1 Apache Tomcat: EncryptInterceptor requirements not clearly documented 0.5%
• CVE-2026-59083 Critical 9.1 Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass 0.5%
• CVE-2026-55957 High 7.3 Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind 2.9%
• CVE-2026-55956 Medium 6.5 Apache Tomcat: Security constraints for default servlet ignored method 0.7%
• CVE-2026-55955 Medium 6.5 Apache Tomcat: EncryptInterceptor not protected against replay attacks 0.4%
• CVE-2026-55276 Critical 9.1 Apache Tomcat: Logged effective web.xml is incomplete 0.6%
• CVE-2026-53434 Critical 9.1 Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector 0.6%
• CVE-2026-53404 High 7.3 Apache Tomcat: Bad ornext processing in RewriteValve 0.7%
• CVE-2026-50229 Medium 6.1 Apache Tomcat: XSS in number guess example 4.1%
• CVE-2026-43515 Critical 9.1 Apache Tomcat: Security constraints not correctly applied 1.2%
• CVE-2026-43514 Low 3.7 Apache Tomcat: AJP secret compared in non-constant time 0.4%
• CVE-2026-43513 High 7.5 Apache Tomcat: LockOutRealm treats user names as case-sensitive 0.5%
• CVE-2026-43512 Critical 9.8 Apache Tomcat: Digest authenticator will authenticate any unknown user 1.3%
• CVE-2026-41293 Critical 9.8 Apache Tomcat: HTTP/2 request headers not validated 1.7%