Apache Software Foundation Apache Tomcat

• CVE-2026-42498 High 7.3 Apache Tomcat: WebSocket authentication header exposure 0.7%
• CVE-2026-41284 High 7.5 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling 0.8%
• CVE-2026-34500 Medium 6.5 Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled 0.5%
• CVE-2026-34487 High 7.5 Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token 0.5%
• CVE-2026-34483 High 7.5 Apache Tomcat: Incomplete escaping of JSON access logs 0.5%
• CVE-2026-32990 Medium 5.3 Apache Tomcat: Fix for CVE-2025-66614 is incomplete 0.3%
• CVE-2026-29146 High 7.5 Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default 8.8%
• CVE-2026-29145 Critical 9.1 Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled 0.7%
• CVE-2026-29129 High 7.5 Apache Tomcat: TLS cipher order is not preserved 0.3%
• CVE-2026-25854 Medium 6.1 Apache Tomcat: Occasionally open redirect 0.6%
• CVE-2026-24880 High 7.5 Apache Tomcat: Request smuggling via invalid chunk extension 0.7%
• CVE-2026-24734 High 7.4 Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass 0.6%
• CVE-2026-24733 Medium 6.5 Apache Tomcat: Security constraint bypass with HTTP/0.9 0.6%
• CVE-2025-66614 High 7.6 Apache Tomcat: Client certificate verification bypass due to virtual host mapping 0.3%
• CVE-2025-61795 Medium 5.3 Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS 1.2%
• CVE-2025-55752 High 7.5 Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled 64.4%
• CVE-2025-55754 Critical 9.6 Apache Tomcat: console manipulation via escape sequences in log messages 10.3%
• CVE-2025-55668 Medium 6.5 Apache Tomcat: session fixation via rewrite valve 0.9%
• CVE-2025-48989 High 7.5 Apache Tomcat: h2 DoS - Made You Reset 3.8%
• CVE-2025-53506 High 7.5 Apache Tomcat: DoS via excessive h2 streams at connection start 2.1%
• CVE-2025-52520 High 7.5 Apache Tomcat: DoS via integer overflow in multipart file upload 2.2%
• CVE-2025-52434 High 7.5 Apache Tomcat: APR/Native Connector crash leading to DoS 2.1%
• CVE-2025-49124 High 8.4 Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows 0.4%
• CVE-2025-49125 High 7.5 Apache Tomcat: Security constraint bypass for pre/post-resources 3.4%
• CVE-2025-48988 High 7.5 Apache Tomcat: FileUpload large number of parts with headers DoS 30.4%
• CVE-2025-46701 High 7.3 Apache Tomcat: Security constraint bypass for CGI scripts 3.1%
• CVE-2025-31651 Critical 9.8 Apache Tomcat: Bypass of rules in Rewrite Valve 4.3%
• CVE-2025-31650 High 7.5 Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame 61.3%
• CVE-2024-56337 Critical 9.8 Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete 9.0%
• CVE-2024-54677 Medium 5.3 Apache Tomcat: DoS in examples web application 1.9%
• CVE-2024-50379 Critical 9.8 Apache Tomcat: RCE due to TOCTOU issue in JSP compilation 31.8%
• CVE-2024-52318 Medium 6.1 Apache Tomcat: Incorrect JSP tag recycling leads to XSS 1.9%
• CVE-2024-52317 Medium 6.5 Apache Tomcat: Request/response mix-up with HTTP/2 2.1%
• CVE-2024-52316 Critical 9.8 Apache Tomcat: Authentication bypass when using Jakarta Authentication API 6.2%
• CVE-2024-38286 High 8.6 Apache Tomcat: Denial of Service 1.7%
• CVE-2024-34750 High 7.5 Apache Tomcat: HTTP/2 excess header handling DoS 4.6%
• CVE-2024-23672 Medium 6.3 Apache Tomcat: WebSocket DoS with incomplete closing handshake 2.3%
• CVE-2024-24549 High 7.5 Apache Tomcat: HTTP/2 header handling DoS 23.1%
• CVE-2024-21733 Medium 5.3 Apache Tomcat: Leaking of unrelated request bodies in default error page 14.3%
• CVE-2023-46589 High 7.5 Apache Tomcat: HTTP request smuggling via malformed trailer headers 2.7%
• CVE-2023-45648 Medium 5.3 Apache Tomcat: Trailer header parsing too lenient 5.9%
• CVE-2023-42795 Medium 5.3 Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests 2.5%
• CVE-2023-42794 Unrated Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows 2.3%
• CVE-2023-41080 Unrated Apache Tomcat: Open redirect with FORM authentication 6.5%
• CVE-2023-34981 High 7.5 Apache Tomcat: AJP response header mix-up 1.1%
• CVE-2023-28709 Unrated Apache Tomcat: Fix for CVE-2023-24998 is incomplete 48.0%
• CVE-2023-28708 Medium 4.3 Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations 1.8%
• CVE-2023-24998 High 7.5 Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts 48.8%
• CVE-2022-45143 Unrated Apache Tomcat: JsonErrorReportValve escaping 2.7%
• CVE-2022-42252 High 7.5 Apache Tomcat request smuggling via malformed content-length 1.8%