# org.apache.tomcat.embed:tomcat-embed-core (Maven) vulnerabilities

82 known vulnerabilities (14 critical, 32 high, 9 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 11.0.27 (Oct 6, 2026): no advisory affects it
- Newest unaffected release: 11.0.27 (Oct 6, 2026), the latest release
- Dependents: 1,160
- Releases: 473 since 7.0.0 (Jul 12, 2010)
- Registry: https://central.sonatype.com/artifact/org.apache.tomcat.embed/tomcat-embed-core
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-68525: 7.0.0 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.120 (9.0.121 is outside it); 10.1.0-M1 to 10.1.57 (10.1.59 is outside it); 11.0.0-M1 to 11.0.24 (11.0.25 is outside it)
- CVE-2026-65905: 7.0.30 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.120 (9.0.121 is outside it); 10.1.0-M1 to 10.1.57 (10.1.59 is outside it); 11.0.0-M1 to 11.0.24 (11.0.25 is outside it)
- CVE-2026-65637: 9.0.115 to 9.0.120 (9.0.121 is outside it); 10.1.53 to 10.1.57 (10.1.59 is outside it); 11.0.20 to 11.0.24 (11.0.25 is outside it)
- CVE-2026-65182: 7.0.0 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.120 (9.0.121 is outside it); 10.1.0-M1 to 10.1.57 (10.1.59 is outside it); 11.0.0-M1 to 11.0.24 (11.0.25 is outside it)
- CVE-2026-55957: 7.0.0 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.100 (9.0.102 is outside it); 10.1.0-M1 to 10.1.36 (10.1.39 is outside it); 11.0.0-M1 to 11.0.4 (11.0.5 is outside it)
- CVE-2026-55956: 7.0.0 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.118 (9.0.119 is outside it); 10.1.0-M1 to 10.1.55 (10.1.56 is outside it); 11.0.0-M1 to 11.0.22 (11.0.23 is outside it)
- CVE-2026-55276: 8.5.0 to 9.0.118 (9.0.119 is outside it); 10.1.0-M1 to 10.1.55 (10.1.56 is outside it); 11.0.0-M1 to 11.0.22 (11.0.23 is outside it)
- CVE-2026-53404: 8.5.0 to 9.0.118 (9.0.119 is outside it); 10.1.0-M1 to 10.1.55 (10.1.56 is outside it); 11.0.0-M1 to 11.0.22 (11.0.23 is outside it)
- CVE-2026-43515: 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
- CVE-2026-43514: 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
- CVE-2026-43513: 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
- CVE-2026-43512: 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
- CVE-2026-41293: 8.5.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
- CVE-2026-42498: 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
- CVE-2026-41284: 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
- CVE-2026-34487: 9.0.13 to 9.0.116 (9.0.117 is outside it); 10.1.0-M1 to 10.1.53 (10.1.54 is outside it); 11.0.0-M1 to 11.0.20 (11.0.21 is outside it)
- CVE-2026-34483: 9.0.40 to 9.0.115 (9.0.116 is outside it); 10.1.0-M1 to 10.1.53 (10.1.54 is outside it); 11.0.0-M1 to 11.0.20 (11.0.21 is outside it)
- CVE-2026-32990: 9.0.113 to 9.0.115 (9.0.116 is outside it); 10.1.50 to 10.1.52 (10.1.53 is outside it); 11.0.15 to 11.0.18 (11.0.20 is outside it)
- CVE-2026-29129: 9.0.115 (9.0.116 is outside it); 10.1.52 (10.1.53 is outside it); 11.0.18 (11.0.20 is outside it)
- CVE-2026-25854: 8.5.30 to 9.0.115 (9.0.116 is outside it); 10.1.0-M1 to 10.1.52 (10.1.53 is outside it); 11.0.0-M1 to 11.0.18 (11.0.20 is outside it)
- CVE-2026-24880: 7.0.0 to 9.0.115 (9.0.116 is outside it); 10.1.0-M1 to 10.1.50 (10.1.52 is outside it); 11.0.0-M1 to 11.0.18 (11.0.20 is outside it)
- CVE-2026-24734: 9.0.83 to 9.0.113 (9.0.115 is outside it); 10.1.0-M7 to 10.1.50 (10.1.52 is outside it); 11.0.0-M1 to 11.0.15 (11.0.18 is outside it)
- CVE-2025-66614: 8.5.0 to 9.0.112 (9.0.113 is outside it); 10.1.0-M1 to 10.1.49 (10.1.50 is outside it); 11.0.0-M1 to 11.0.14 (11.0.15 is outside it)
- CVE-2025-61795: 8.5.0 to 9.0.109 (9.0.110 is outside it); 10.1.0-M1 to 10.1.46 (10.1.47 is outside it); 11.0.0-M1 to 11.0.11 (11.0.12 is outside it)
- CVE-2025-55752: 8.5.6 to 9.0.108 (9.0.109 is outside it); 10.1.0-M1 to 10.1.44 (10.1.45 is outside it); 11.0.0-M1 to 11.0.10 (11.0.11 is outside it)
- CVE-2025-55754: 8.5.60 to 8.5.100 (9.0.0.M1 is outside it); 9.0.40 to 9.0.108 (9.0.109 is outside it); 10.1.0-M1 to 10.1.44 (10.1.45 is outside it); 11.0.0-M1 to 11.0.10 (11.0.11 is outside it)
- CVE-2025-55668: 9.0.0.M1 to 9.0.105 (9.0.106 is outside it); 10.1.0-M1 to 10.1.41 (10.1.42 is outside it); 11.0.0-M1 to 11.0.7 (11.0.8 is outside it)
- CVE-2025-48989: 9.0.0.M1 to 9.0.107 (9.0.108 is outside it); 10.1.0-M1 to 10.1.43 (10.1.44 is outside it); 11.0.0-M1 to 11.0.9 (11.0.10 is outside it)
- CVE-2025-53506: 8.5.0 to 9.0.106 (9.0.107 is outside it); 10.1.0-M1 to 10.1.42 (10.1.43 is outside it); 11.0.0-M1 to 11.0.8 (11.0.9 is outside it)
- CVE-2025-52520: 8.5.0 to 9.0.106 (9.0.107 is outside it); 10.1.0-M1 to 10.1.42 (10.1.43 is outside it); 11.0.0-M1 to 11.0.8 (11.0.9 is outside it)
- CVE-2025-52434: 8.5.0 to 9.0.106 (9.0.107 is outside it)
- CVE-2025-49124: 9.0.24 to 9.0.105 (9.0.106 is outside it); 10.1.0 to 10.1.41 (10.1.42 is outside it); 11.0.0-M1 to 11.0.7 (11.0.8 is outside it)
- CVE-2025-49125: 8.5.0 to 9.0.105 (9.0.106 is outside it); 10.1.0-M1 to 10.1.41 (10.1.42 is outside it); 11.0.0-M1 to 11.0.7 (11.0.8 is outside it)
- CVE-2025-48988: 8.5.0 to 9.0.105 (9.0.106 is outside it); 10.1.0-M1 to 10.1.41 (10.1.42 is outside it); 11.0.0-M1 to 11.0.7 (11.0.8 is outside it)
- CVE-2025-46701: 8.5.0 to 9.0.104 (9.0.105 is outside it); 10.1.0-M1 to 10.1.40 (10.1.41 is outside it); 11.0.0-M1 to 11.0.6 (11.0.7 is outside it)
- CVE-2025-31651: 8.5.0 to 8.5.100 (9.0.0.M1 is outside it); 9.0.76 to 9.0.102 (9.0.104 is outside it); 10.1.10 to 10.1.39 (10.1.40 is outside it); 11.0.0-M3 to 11.0.5 (11.0.6 is outside it)
- CVE-2025-31650: 8.5.0 to 8.5.100 (9.0.0.M1 is outside it); 9.0.76 to 9.0.102 (9.0.104 is outside it); 10.1.10 to 10.1.39 (10.1.40 is outside it); 11.0.0-M3 to 11.0.5 (11.0.6 is outside it)
- CVE-2025-24813: 8.5.0 to 9.0.98 (9.0.99 is outside it); 10.1.0-M1 to 10.1.34 (10.1.35 is outside it); 11.0.0-M1 to 11.0.2 (11.0.3 is outside it)
- CVE-2024-56337: 9.0.0.M1 to 9.0.97 (9.0.98 is outside it); 10.1.0-M1 to 10.1.33 (10.1.34 is outside it); 11.0.0-M1 to 11.0.1 (11.0.2 is outside it)
- CVE-2024-50379: 8.5.0 to 9.0.97 (9.0.98 is outside it); 10.1.0-M1 to 10.1.33 (10.1.34 is outside it); 11.0.0-M1 to 11.0.1 (11.0.2 is outside it)
- CVE-2024-52317: 9.0.93 to 9.0.95 (9.0.96 is outside it); 10.1.28 to 10.1.30 (10.1.31 is outside it); 11.0.0-M24 to 11.0.0-M26 (11.0.0 is outside it)
- CVE-2024-38286: 7.0.92 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.35 to 8.5.100 (9.0.0.M1 is outside it); 9.0.13 to 9.0.89 (9.0.90 is outside it); 10.1.0-M1 to 10.1.24 (10.1.25 is outside it); 11.0.0-M1 to 11.0.0-M20 (11.0.0-M21 is outside it)
- CVE-2024-34750: 8.5.0 to 9.0.89 (9.0.90 is outside it); 10.1.0-M1 to 10.1.24 (10.1.25 is outside it); 11.0.0-M1 to 11.0.0-M20 (11.0.0-M21 is outside it)
- CVE-2024-24549: 8.5.0 to 8.5.98 (8.5.99 is outside it); 9.0.0.M1 to 9.0.85 (9.0.86 is outside it); 10.1.0-M1 to 10.1.18 (10.1.19 is outside it); 11.0.0-M1 to 11.0.0-M16 (11.0.0-M17 is outside it)
- CVE-2024-21733: 8.5.8 to 8.5.63 (8.5.64 is outside it); 9.0.0.M1 to 9.0.43 (9.0.44 is outside it)
- CVE-2023-46589: 8.5.0 to 8.5.95 (8.5.96 is outside it); 9.0.0.M1 to 9.0.82 (9.0.83 is outside it); 10.1.0-M1 to 10.1.15 (10.1.16 is outside it); 11.0.0-M1 to 11.0.0-M10 (11.0.0-M11 is outside it)
- CVE-2023-45648: 8.5.0 to 8.5.93 (8.5.94 is outside it); 9.0.0.M1 to 9.0.80 (9.0.81 is outside it); 10.1.0-M1 to 10.1.13 (10.1.14 is outside it); 11.0.0-M1 to 11.0.0-M11 (11.0.0-M12 is outside it)
- CVE-2023-42795: 8.5.0 to 8.5.93 (8.5.94 is outside it); 9.0.0.M1 to 9.0.80 (9.0.81 is outside it); 10.1.0-M1 to 10.1.13 (10.1.14 is outside it); 11.0.0-M1 to 11.0.0-M11 (11.0.0-M12 is outside it)
- CVE-2023-44487: 8.5.0 to 8.5.93 (8.5.94 is outside it); 9.0.1 to 9.0.80 (9.0.81 is outside it); 10.0.0 to 10.1.13 (10.1.14 is outside it); 11.0.0-M1 to 11.0.0-M11 (11.0.0-M12 is outside it)
- CVE-2023-41080: 8.5.0 to 8.5.92 (8.5.93 is outside it); 9.0.0.M1 to 9.0.79 (9.0.80 is outside it); 10.1.0-M1 to 10.1.12 (10.1.13 is outside it); 11.0.0-M1 to 11.0.0-M10 (11.0.0-M11 is outside it)
- CVE-2023-34981: 9.0.74 (9.0.75 is outside it); 10.1.8 (10.1.9 is outside it); 11.0.0-M5 (11.0.0-M6 is outside it)
- CVE-2023-28709: 9.0.71 to 9.0.73 (9.0.74 is outside it); 10.1.5 to 10.1.7 (10.1.8 is outside it); 11.0.0-M3 to 11.0.0-M4 (11.0.0-M5 is outside it)
- CVE-2023-24998: 8.5.85 to 8.5.87 (8.5.88 is outside it); 9.0.0.M1 to 9.0.70 (9.0.71 is outside it); 10.1.0-M1 to 10.1.4 (10.1.5 is outside it); 11.0.0-M3 to 11.0.0-M4 (11.0.0-M5 is outside it)
- CVE-2022-45143: 8.5.83 (8.5.84 is outside it); 9.0.40 to 9.0.68 (9.0.69 is outside it); 10.1.0 to 10.1.1 (10.1.2 is outside it)
- CVE-2022-42252: 8.5.0 to 8.5.82 (8.5.83 is outside it); 9.0.0.M1 to 9.0.67 (9.0.68 is outside it); 10.0.0-M1 to 10.0.26 (10.0.27 is outside it); 10.1.0-M1 to 10.1.0 (10.1.1 is outside it)
- CVE-2021-25329: 7.0.0 to 7.0.107 (7.0.108 is outside it); 8.0.1 to 8.5.60 (8.5.61 is outside it); 9.0.1 to 9.0.40 (9.0.41 is outside it); 10.0.0-M1 to 10.0.0 (10.0.2 is outside it)
- CVE-2021-25122: 8.5.0 to 8.5.61 (8.5.63 is outside it); 9.0.0.M1 to 9.0.41 (9.0.43 is outside it); 10.0.0-M1 to 10.0.0 (10.0.2 is outside it)
- CVE-2021-24122: 7.0.0 to 7.0.106 (7.0.107 is outside it); 8.5.0 to 8.5.59 (8.5.60 is outside it); 9.0.1 to 9.0.39 (9.0.40 is outside it); 10.0.0-M1 to 10.0.0-M9 (10.0.0-M10 is outside it)
- CVE-2020-11996: 8.5.0 to 8.5.54 (8.5.55 is outside it); 9.0.0.M1 to 9.0.34 (9.0.35 is outside it); 10.0.0-M1 to 10.0.0-M4 (10.0.0-M5 is outside it)
- CVE-2020-9484: 7.0.0 to 7.0.103 (7.0.104 is outside it); 8.0.1 to 8.5.54 (8.5.55 is outside it); 9.0.1 to 9.0.34 (9.0.35 is outside it); 10.0.0-M1 to 10.0.0-M4 (10.0.0-M5 is outside it)
- CVE-2020-1938: 7.0.0 to 7.0.99 (7.0.100 is outside it); 8.0.1 to 8.5.50 (8.5.51 is outside it); 9.0.1 to 9.0.30 (9.0.31 is outside it)
- CVE-2020-1935: 7.0.0 to 7.0.99 (7.0.100 is outside it); 8.0.1 to 8.5.50 (8.5.51 is outside it); 9.0.1 to 9.0.30 (9.0.31 is outside it)
- CVE-2019-17569: 7.0.99 (7.0.100 is outside it); 8.5.49 to 8.5.50 (8.5.51 is outside it); 9.0.29 to 9.0.30 (9.0.31 is outside it)
- CVE-2019-12418: 7.0.0 to 7.0.96 (7.0.99 is outside it); 8.0.1 to 8.5.47 (8.5.49 is outside it); 9.0.1 to 9.0.27 (9.0.29 is outside it)
- CVE-2019-17563: 7.0.0 to 7.0.96 (7.0.99 is outside it); 8.0.1 to 8.5.49 (8.5.50 is outside it); 9.0.1 to 9.0.29 (9.0.30 is outside it)
- CVE-2019-10072: 8.5.0 to 8.5.40 (8.5.41 is outside it); 9.0.0.M1 to 9.0.19 (9.0.20 is outside it)
- CVE-2019-0221: 7.0.0 to 7.0.93 (7.0.94 is outside it); 8.5.0 to 8.5.39 (8.5.40 is outside it); 9.0.1 to 9.0.16 (9.0.17 is outside it)
- CVE-2019-0232: 7.0.0 to 7.0.93 (7.0.94 is outside it); 8.0.1 to 8.5.39 (8.5.40 is outside it); 9.0.0.M1 to 9.0.16 (9.0.17 is outside it)
- CVE-2019-0199: 8.0.1 to 8.5.37 (8.5.38 is outside it); 9.0.1 to 9.0.14 (9.0.16 is outside it)
- CVE-2018-11784: 7.0.23 to 7.0.90 (7.0.91 is outside it); 8.5.0 to 8.5.33 (8.5.34 is outside it); 9.0.1 to 9.0.11 (9.0.12 is outside it)
- CVE-2018-8037: 8.5.5 to 8.5.31 (8.5.32 is outside it); 9.0.0.M9 to 9.0.8 (9.0.10 is outside it)
- CVE-2018-1336: 7.0.28 to 7.0.86 (7.0.88 is outside it); 8.0.0-RC1 to 8.0.50 (8.0.51 is outside it); 8.5.0 to 8.5.30 (8.5.31 is outside it); 9.0.0.M9 to 9.0.7 (9.0.8 is outside it)
- CVE-2018-8034: 7.0.35 to 7.0.88 (7.0.90 is outside it); 8.0.1 to 8.0.52 (8.0.53 is outside it); 8.5.0 to 8.5.31 (8.5.32 is outside it); 9.0.1 to 9.0.8 (9.0.10 is outside it)
- CVE-2018-8014: 7.0.41 to 7.0.86 (7.0.88 is outside it); 8.0.0-RC1 to 8.0.52 (8.0.53 is outside it); 8.5.0 to 8.5.31 (8.5.32 is outside it); 9.0.0.M1 to 9.0.8 (9.0.10 is outside it)
- CVE-2018-1304: 7.0.0 to 7.0.85 (7.0.86 is outside it); 8.0.1 to 8.0.50 (8.0.51 is outside it); 8.5.0 to 8.5.27 (8.5.28 is outside it); 9.0.1 to 9.0.4 (9.0.5 is outside it)
- CVE-2018-1305: 7.0.0 to 7.0.84 (7.0.85 is outside it); 8.5.0 to 8.5.27 (8.5.28 is outside it); 9.0.0.M1 to 9.0.4 (9.0.5 is outside it)
- CVE-2017-12617: 7.0.0 to 7.0.81 (7.0.82 is outside it); 8.0.0-RC1 to 8.0.46 (8.0.47 is outside it); 8.5.0 to 8.5.21 (8.5.23 is outside it); 9.0.0.M1 to 9.0.0.M27 (9.0.1 is outside it)
- CVE-2017-12615: 7.0.0 to 7.0.78 (7.0.79 is outside it)
- CVE-2017-5651: 8.5.0 to 8.5.12 (8.5.13 is outside it); 9.0.0.M1 to 9.0.0.M18 (9.0.0.M19 is outside it)
- CVE-2017-5648: 7.0.0 to 7.0.75 (7.0.76 is outside it); 8.0.1 to 8.0.41 (8.0.42 is outside it); 8.5.0 to 8.5.12 (8.5.13 is outside it); 9.0.0.M1 to 9.0.0.M17 (9.0.0.M18 is outside it)
- CVE-2014-0095: 8.0.0-RC1 to 8.0.3 (8.0.5 is outside it)
- CVE-2008-1947: no published release is affected

## Advisories (82)

### [CVE-2026-68525](https://cve.now/CVE-2026-68525): Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

- Severity: Critical 9.1
- Published: Aug 25, 2026
- Affected: from 11.0.0-M1, fixed in 11.0.25; from 10.1.0-M1, fixed in 10.1.58; from 9.0.0-M1, fixed in 9.0.121; from 8.5.0, through 8.5.100; from 7.0.0, through 7.0.109.
- Fixed in 9.0.121 (released Aug 12, 2026, 13 days before disclosure), 10.1.59 (released Aug 13, 2026, 12 days before disclosure, the advisory names 10.1.58, which was never published) and 11.0.25 (released Aug 12, 2026, 13 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-65905](https://cve.now/CVE-2026-65905): Apache Tomcat: Limited replay attack possible with DIGEST authentication

- Severity: Critical 9.8
- Published: Aug 25, 2026
- Affected: from 11.0.0-M1, fixed in 11.0.25; from 10.1.0-M1, fixed in 10.1.58; from 9.0.0.M1, fixed in 9.0.121; from 8.5.0, through 8.5.100; from 7.0.30, through 7.0.109.
- Fixed in 9.0.121 (released Aug 12, 2026, 13 days before disclosure), 10.1.59 (released Aug 13, 2026, 12 days before disclosure, the advisory names 10.1.58, which was never published) and 11.0.25 (released Aug 12, 2026, 13 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-65637](https://cve.now/CVE-2026-65637): Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

- Severity: Critical 9.8
- Published: Aug 25, 2026
- Affected: from 11.0.20, fixed in 11.0.25; from 10.1.53, fixed in 10.1.59; from 9.0.115, fixed in 9.0.121.
- Fixed in 9.0.121 (released Aug 12, 2026, 13 days before disclosure), 10.1.59 (released Aug 13, 2026, 12 days before disclosure) and 11.0.25 (released Aug 12, 2026, 13 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-65182](https://cve.now/CVE-2026-65182): Apache Tomcat: Bypass longest prefix security constraint

- Severity: Critical 9.1
- Published: Aug 25, 2026
- Affected: from 11.0.0-M1, fixed in 11.0.25; from 10.1.0-M1, fixed in 10.1.58; from 9.0.0-M1, fixed in 9.0.121; from 8.5.0, through 8.5.100; from 7.0.0, through 7.0.109.
- Fixed in 9.0.121 (released Aug 12, 2026, 13 days before disclosure), 10.1.59 (released Aug 13, 2026, 12 days before disclosure, the advisory names 10.1.58, which was never published) and 11.0.25 (released Aug 12, 2026, 13 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-55957](https://cve.now/CVE-2026-55957): Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

- Severity: High 7.3
- Published: Jun 29, 2026
- Affected: from 11.0.0-M1, fixed in 11.0.5; from 10.1.0-M1, fixed in 10.1.37; from 9.0.0.M1, fixed in 9.0.101; from 8.5.0, through 8.5.100; through 7.0.109.
- Fixed in 9.0.102 (released Mar 3, 2025, 483 days before disclosure, the advisory names 9.0.101, which was never published), 10.1.39 (released Mar 4, 2025, 482 days before disclosure, the advisory names 10.1.37, which was never published) and 11.0.5 (released Feb 28, 2025, 486 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-55956](https://cve.now/CVE-2026-55956): Apache Tomcat: Security constraints for default servlet ignored method

- Severity: Medium 6.5
- Published: Jun 29, 2026
- Affected: from 11.0.0-M1, fixed in 11.0.23; from 10.1.0-M1, fixed in 10.1.56; from 9.0.0.M1, fixed in 9.0.119; from 8.5.0, through 8.5.100; through 7.0.109.
- Fixed in 9.0.119 (released Jun 18, 2026, 11 days before disclosure), 10.1.56 (released Jun 17, 2026, 12 days before disclosure) and 11.0.23 (released Jun 17, 2026, 12 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-55276](https://cve.now/CVE-2026-55276): Apache Tomcat: Logged effective web.xml is incomplete

- Severity: Critical 9.1
- Published: Jun 29, 2026
- Affected: from 11.0.0-M1, fixed in 11.0.23; from 10.1.0-M1, fixed in 10.1.56; from 9.0.0.M1, fixed in 9.0.119; from 8.5.0, through 8.5.100.
- Fixed in 9.0.119 (released Jun 18, 2026, 11 days before disclosure), 10.1.56 (released Jun 17, 2026, 12 days before disclosure) and 11.0.23 (released Jun 17, 2026, 12 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-53404](https://cve.now/CVE-2026-53404): Apache Tomcat: Bad ornext processing in RewriteValve

- Severity: High 7.3
- Published: Jun 29, 2026
- Affected: from 11.0.0-M1, fixed in 11.0.23; from 10.1.0-M1, fixed in 10.1.56; from 9.0.0.M1, fixed in 9.0.119; from 8.5.0, through 8.5.100.
- Fixed in 9.0.119 (released Jun 18, 2026, 11 days before disclosure), 10.1.56 (released Jun 17, 2026, 12 days before disclosure) and 11.0.23 (released Jun 17, 2026, 12 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-43515](https://cve.now/CVE-2026-43515): Apache Tomcat: Security constraints not correctly applied

- Severity: Critical 9.1
- Published: May 12, 2026
- Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.
- Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-43514](https://cve.now/CVE-2026-43514): Apache Tomcat: AJP secret compared in non-constant time

- Severity: Low 3.7
- Published: May 12, 2026
- Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.
- Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-43513](https://cve.now/CVE-2026-43513): Apache Tomcat: LockOutRealm treats user names as case-sensitive

- Severity: High 7.5
- Published: May 12, 2026
- Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.
- Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-43512](https://cve.now/CVE-2026-43512): Apache Tomcat: Digest authenticator will authenticate any unknown user

- Severity: Critical 9.8
- Published: May 12, 2026
- Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.
- Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-41293](https://cve.now/CVE-2026-41293): Apache Tomcat: HTTP/2 request headers not validated

- Severity: Critical 9.8
- Published: May 12, 2026
- Affected: from 8.5.0, fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.
- Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-42498](https://cve.now/CVE-2026-42498): Apache Tomcat: WebSocket authentication header exposure

- Severity: High 7.3
- Published: May 12, 2026
- Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.
- Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-41284](https://cve.now/CVE-2026-41284): Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

- Severity: High 7.5
- Published: May 12, 2026
- Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.
- Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-34487](https://cve.now/CVE-2026-34487): Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

- Severity: High 7.5
- Published: Apr 9, 2026
- Affected: from 9.0.13, fixed in 9.0.117; from 10.1.0-M1, fixed in 10.1.54; from 11.0.0-M1, fixed in 11.0.21.
- Fixed in 9.0.117 (released Mar 30, 2026, 10 days before disclosure), 10.1.54 (released Mar 30, 2026, 10 days before disclosure) and 11.0.21 (released Mar 30, 2026, 10 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-34483](https://cve.now/CVE-2026-34483): Apache Tomcat: Incomplete escaping of JSON access logs

- Severity: High 7.5
- Published: Apr 9, 2026
- Affected: from 9.0.40, fixed in 9.0.116; from 10.1.0-M1, fixed in 10.1.54; from 11.0.0-M1, fixed in 11.0.21.
- Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.54 (released Mar 30, 2026, 10 days before disclosure) and 11.0.21 (released Mar 30, 2026, 10 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-32990](https://cve.now/CVE-2026-32990): Apache Tomcat: Fix for CVE-2025-66614 is incomplete

- Severity: Medium 5.3
- Published: Apr 9, 2026
- Affected: from 9.0.113, fixed in 9.0.116; from 10.1.50, fixed in 10.1.53; from 11.0.15, fixed in 11.0.20.
- Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.53 (released Mar 18, 2026, 22 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-29129](https://cve.now/CVE-2026-29129): Apache Tomcat: TLS cipher order is not preserved

- Severity: High 7.5
- Published: Apr 9, 2026
- Affected: from 9.0.114, fixed in 9.0.116; from 10.1.51, fixed in 10.1.53; from 11.0.16, fixed in 11.0.20.
- Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.53 (released Mar 18, 2026, 22 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-25854](https://cve.now/CVE-2026-25854): Apache Tomcat: Occasionally open redirect

- Severity: Medium 6.1
- Published: Apr 9, 2026
- Affected: from 8.5.30, fixed in 9.0.116; from 10.1.0-M1, fixed in 10.1.53; from 11.0.0-M1, fixed in 11.0.20.
- Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.53 (released Mar 18, 2026, 22 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-24880](https://cve.now/CVE-2026-24880): Apache Tomcat: Request smuggling via invalid chunk extension

- Severity: High 7.5
- Published: Apr 9, 2026
- Affected: from 7.0.0, fixed in 9.0.116; from 10.1.0-M1, fixed in 10.1.52; from 11.0.0-M1, fixed in 11.0.20.
- Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.52 (released Jan 23, 2026, 76 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2026-24734](https://cve.now/CVE-2026-24734): Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

- Severity: High 7.4
- Published: Feb 17, 2026
- Affected: from 11.0.0-M1, fixed in 11.0.18; from 10.1.0-M7, fixed in 10.1.52; from 9.0.83, fixed in 9.0.115.
- Fixed in 9.0.115 (released Jan 21, 2026, 27 days before disclosure), 10.1.52 (released Jan 23, 2026, 25 days before disclosure) and 11.0.18 (released Jan 23, 2026, 25 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-66614](https://cve.now/CVE-2025-66614): Apache Tomcat: Client certificate verification bypass due to virtual host mapping

- Severity: High 7.6
- Published: Feb 17, 2026
- Affected: from 11.0.0-M1, fixed in 11.0.15; from 10.1.0-M1, fixed in 10.1.50; from 9.0.0-M1, fixed in 9.0.113; from 8.5.0, through 8.5.100.
- Fixed in 9.0.113 (released Dec 2, 2025, 77 days before disclosure), 10.1.50 (released Dec 2, 2025, 77 days before disclosure) and 11.0.15 (released Dec 2, 2025, 77 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-61795](https://cve.now/CVE-2025-61795): Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS

- Severity: Medium 5.3
- Published: Oct 27, 2025
- Affected: from 11.0.0-M1, fixed in 11.0.12; from 10.1.0-M1, fixed in 10.1.47; from 9.0.0.M1, fixed in 9.0.110; from 8.5.0, through 8.5.100.
- Fixed in 9.0.110 (released Oct 1, 2025, 26 days before disclosure), 10.1.47 (released Oct 2, 2025, 25 days before disclosure) and 11.0.12 (released Oct 1, 2025, 26 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-55752](https://cve.now/CVE-2025-55752): Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

- Severity: High 7.5
- Published: Oct 27, 2025
- Affected: from 11.0.0-M1, fixed in 11.0.11; from 10.1.0-M1, fixed in 10.1.45; from 9.0.0-M11, fixed in 9.0.109; from 8.5.6, through 8.5.100.
- Fixed in 9.0.109 (released Sep 1, 2025, 56 days before disclosure), 10.1.45 (released Sep 2, 2025, 55 days before disclosure) and 11.0.11 (released Sep 1, 2025, 56 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-55754](https://cve.now/CVE-2025-55754): Apache Tomcat: console manipulation via escape sequences in log messages

- Severity: Critical 9.6
- Published: Oct 27, 2025
- Affected: from 11.0.0-M1, fixed in 11.0.11; from 10.1.0-M1, fixed in 10.1.45; from 9.0.40, fixed in 9.0.109; from 8.5.60, through 8.5.100.
- Fixed in 9.0.109 (released Sep 1, 2025, 56 days before disclosure), 10.1.45 (released Sep 2, 2025, 55 days before disclosure) and 11.0.11 (released Sep 1, 2025, 56 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-55668](https://cve.now/CVE-2025-55668): Apache Tomcat: session fixation via rewrite valve

- Severity: Medium 6.5
- Published: Aug 13, 2025
- Affected: from 11.0.0-M1, fixed in 11.0.8; from 10.1.0-M1, fixed in 10.1.42; from 9.0.0.M1, fixed in 9.0.106.
- Fixed in 9.0.106 (released Jun 5, 2025, 69 days before disclosure), 10.1.42 (released Jun 5, 2025, 69 days before disclosure) and 11.0.8 (released Jun 5, 2025, 69 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-48989](https://cve.now/CVE-2025-48989): Apache Tomcat: h2 DoS - Made You Reset

- Severity: High 7.5
- Published: Aug 13, 2025
- Affected: from 11.0.0-M1, fixed in 11.0.10; from 10.1.0-M1, fixed in 10.1.44; from 9.0.0.M1, fixed in 9.0.108.
- Fixed in 9.0.108 (released Jul 31, 2025, 13 days before disclosure), 10.1.44 (released Aug 4, 2025, 9 days before disclosure) and 11.0.10 (released Jul 31, 2025, 13 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-53506](https://cve.now/CVE-2025-53506): Apache Tomcat: DoS via excessive h2 streams at connection start

- Severity: High 7.5
- Published: Jul 10, 2025
- Affected: from 8.5.0, through 8.5.100; from 9.0.0.M1, fixed in 9.0.107; from 10.1.0-M1, fixed in 10.1.43; from 11.0.0-M1, fixed in 11.0.9.
- Fixed in 9.0.107 (released Jul 2, 2025, 8 days before disclosure), 10.1.43 (released Jul 1, 2025, 9 days before disclosure) and 11.0.9 (released Jul 1, 2025, 9 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-52520](https://cve.now/CVE-2025-52520): Apache Tomcat: DoS via integer overflow in multipart file upload

- Severity: High 7.5
- Published: Jul 10, 2025
- Affected: from 11.0.0-M1, fixed in 11.0.9; from 10.1.0-M1, fixed in 10.1.43; from 9.0.0.M1, fixed in 9.0.107; from 8.5.0, through 8.5.100.
- Fixed in 9.0.107 (released Jul 2, 2025, 8 days before disclosure), 10.1.43 (released Jul 1, 2025, 9 days before disclosure) and 11.0.9 (released Jul 1, 2025, 9 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-52434](https://cve.now/CVE-2025-52434): Apache Tomcat: APR/Native Connector crash leading to DoS

- Severity: High 7.5
- Published: Jul 10, 2025
- Affected: from 9.0.0.M1, fixed in 9.0.107; from 8.5.0, through 8.5.100.
- Fixed in 9.0.107 (released Jul 2, 2025, 8 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-49124](https://cve.now/CVE-2025-49124): Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows

- Severity: High 8.4
- Published: Jun 16, 2025
- Affected: from 11.0.0-M1, fixed in 11.0.8; from 10.1.0, fixed in 10.1.42; from 9.0.23, fixed in 9.0.106.
- Fixed in 9.0.106 (released Jun 5, 2025, 11 days before disclosure), 10.1.42 (released Jun 5, 2025, 11 days before disclosure) and 11.0.8 (released Jun 5, 2025, 11 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-49125](https://cve.now/CVE-2025-49125): Apache Tomcat: Security constraint bypass for pre/post-resources

- Severity: High 7.5
- Published: Jun 16, 2025
- Affected: from 11.0.0-M1, fixed in 11.0.8; from 10.1.0-M1, fixed in 10.1.42; from 9.0.0.M1, fixed in 9.0.106; from 8.5.0, through 8.5.100.
- Fixed in 9.0.106 (released Jun 5, 2025, 11 days before disclosure), 10.1.42 (released Jun 5, 2025, 11 days before disclosure) and 11.0.8 (released Jun 5, 2025, 11 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-48988](https://cve.now/CVE-2025-48988): Apache Tomcat: FileUpload large number of parts with headers DoS

- Severity: High 7.5
- Published: Jun 16, 2025
- Affected: from 11.0.0-M1, fixed in 11.0.8; from 10.1.0-M1, fixed in 10.1.42; from 9.0.0.M1, fixed in 9.0.106; from 8.5.0, through 8.5.100.
- Fixed in 9.0.106 (released Jun 5, 2025, 11 days before disclosure), 10.1.42 (released Jun 5, 2025, 11 days before disclosure) and 11.0.8 (released Jun 5, 2025, 11 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-46701](https://cve.now/CVE-2025-46701): Apache Tomcat: Security constraint bypass for CGI scripts

- Severity: High 7.3
- Published: May 29, 2025
- Affected: from 9.0.0.M1, fixed in 9.0.105; from 10.1.0-M1, fixed in 10.1.41; from 11.0.0-M1, fixed in 11.0.7; from 8.5.0, through 8.5.100.
- Fixed in 9.0.105 (released May 7, 2025, 22 days before disclosure), 10.1.41 (released May 8, 2025, 21 days before disclosure) and 11.0.7 (released May 7, 2025, 22 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-31651](https://cve.now/CVE-2025-31651): Apache Tomcat: Bypass of rules in Rewrite Valve

- Severity: Critical 9.8
- Published: Apr 28, 2025
- Affected: from 9.0.76, fixed in 9.0.104; from 10.1.10, fixed in 10.1.40; from 11.0.0-M2, fixed in 11.0.6; from 8.5.0, through 8.5.100.
- Fixed in 9.0.104 (released Apr 4, 2025, 24 days before disclosure), 10.1.40 (released Apr 1, 2025, 27 days before disclosure) and 11.0.6 (released Apr 1, 2025, 27 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-31650](https://cve.now/CVE-2025-31650): Apache Tomcat: DoS via malformed HTTP/2 PRIORITY\_UPDATE frame

- Severity: High 7.5
- Published: Apr 28, 2025
- Affected: from 9.0.76, fixed in 9.0.104; from 10.1.10, fixed in 10.1.40; from 11.0.0-M2, fixed in 11.0.6; from 8.5.0, through 8.5.100.
- Fixed in 9.0.104 (released Apr 4, 2025, 24 days before disclosure), 10.1.40 (released Apr 1, 2025, 27 days before disclosure) and 11.0.6 (released Apr 1, 2025, 27 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2025-24813](https://cve.now/CVE-2025-24813): Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

- Severity: Critical 10.0 · KEV
- Published: Mar 10, 2025
- Affected: from 11.0.0-M1, fixed in 11.0.3; from 10.1.0-M1, fixed in 10.1.35; from 9.0.0.M1, fixed in 9.0.99; from 8.5.0, through 8.5.100.
- Fixed in 9.0.99 (released Feb 4, 2025, 34 days before disclosure), 10.1.35 (released Feb 4, 2025, 34 days before disclosure) and 11.0.3 (released Feb 4, 2025, 34 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2024-56337](https://cve.now/CVE-2024-56337): Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

- Severity: Critical 9.8
- Published: Dec 20, 2024
- Affected: from 11.0.0-M1, fixed in 11.0.2; from 10.1.0-M1, fixed in 10.1.34; from 9.0.0.M1, fixed in 9.0.98.
- Fixed in 9.0.98 (released Dec 5, 2024, 15 days before disclosure), 10.1.34 (released Dec 5, 2024, 15 days before disclosure) and 11.0.2 (released Dec 5, 2024, 15 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2024-50379](https://cve.now/CVE-2024-50379): Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

- Severity: Critical 9.8
- Published: Dec 17, 2024
- Affected: from 11.0.0-M1, fixed in 11.0.2; from 10.1.0-M1, fixed in 10.1.34; from 9.0.0.M1, fixed in 9.0.98; from 8.5.0, through 8.5.100.
- Fixed in 9.0.98 (released Dec 5, 2024, 12 days before disclosure), 10.1.34 (released Dec 5, 2024, 12 days before disclosure) and 11.0.2 (released Dec 5, 2024, 12 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2024-52317](https://cve.now/CVE-2024-52317): Apache Tomcat: Request/response mix-up with HTTP/2

- Severity: Medium 6.5
- Published: Nov 18, 2024
- Affected: from 9.0.92, fixed in 9.0.96; from 10.1.27, fixed in 10.1.31; from 11.0.0-M23, fixed in 11.0.0.
- Fixed in 9.0.96 (released Oct 3, 2024, 46 days before disclosure), 10.1.31 (released Oct 3, 2024, 46 days before disclosure) and 11.0.0 (released Oct 3, 2024, 46 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2024-38286](https://cve.now/CVE-2024-38286): Apache Tomcat: Denial of Service

- Severity: High 8.6
- Published: Nov 7, 2024
- Affected: from 11.0.0-M1, fixed in 11.0.0-M21; from 10.1.0-M1, fixed in 10.1.25; from 9.0.13, fixed in 9.0.90; from 8.5.35, through 8.5.100; from 7.0.92, through 7.0.109.
- Fixed in 9.0.90 (released Jun 14, 2024, 146 days before disclosure), 10.1.25 (released Jun 14, 2024, 146 days before disclosure) and 11.0.0-M21 (released Jun 14, 2024, 146 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2024-34750](https://cve.now/CVE-2024-34750): Apache Tomcat: HTTP/2 excess header handling DoS

- Severity: High 7.5
- Published: Jul 3, 2024
- Affected: from 11.0.0-M1, fixed in 11.0.0-M21; from 10.1.0-M1, fixed in 10.1.25; from 9.0.0-M1, fixed in 9.0.90; from 8.5.0, through 8.5.100.
- Fixed in 9.0.90 (released Jun 14, 2024, 19 days before disclosure), 10.1.25 (released Jun 14, 2024, 19 days before disclosure) and 11.0.0-M21 (released Jun 14, 2024, 19 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2024-24549](https://cve.now/CVE-2024-24549): Apache Tomcat: HTTP/2 header handling DoS

- Severity: High 7.5
- Published: Mar 13, 2024
- Affected: from 8.5.0, fixed in 8.5.99; from 9.0.0-M1, fixed in 9.0.86; from 10.1.0-M1, fixed in 10.1.19; from 11.0.0-M1, fixed in 11.0.0-M17.
- Fixed in 8.5.99 (released Feb 14, 2024, 28 days before disclosure), 9.0.86 (released Feb 14, 2024, 28 days before disclosure), 10.1.19 (released Feb 14, 2024, 28 days before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2024-21733](https://cve.now/CVE-2024-21733): Apache Tomcat: Leaking of unrelated request bodies in default error page

- Severity: Medium 5.3
- Published: Jan 19, 2024
- Affected: from 8.5.7, fixed in 8.5.64; from 9.0.0-M11, fixed in 9.0.44.
- Fixed in 8.5.64 (released Mar 4, 2021, 1051 days before disclosure) and 9.0.44 (released Mar 4, 2021, 1051 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2023-46589](https://cve.now/CVE-2023-46589): Apache Tomcat: HTTP request smuggling via malformed trailer headers

- Severity: High 7.5
- Published: Nov 28, 2023
- Affected: from 11.0.0-M1, fixed in 11.0.0-M11; from 10.1.0-M1, fixed in 10.1.16; from 9.0.0-M1, fixed in 9.0.83; from 8.5.0, fixed in 8.5.96.
- Fixed in 8.5.96 (released Nov 10, 2023, 18 days before disclosure), 9.0.83 (released Nov 9, 2023, 19 days before disclosure), 10.1.16 (released Nov 10, 2023, 18 days before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2023-45648](https://cve.now/CVE-2023-45648): Apache Tomcat: Trailer header parsing too lenient

- Severity: Medium 5.3
- Published: Oct 10, 2023
- Affected: from 11.0.0-M1, fixed in 11.0.0-M12; from 10.1.0-M1, fixed in 10.1.14; from 9.0.0-M1, fixed in 9.0.81; from 8.5.0, fixed in 8.5.94.
- Fixed in 8.5.94 (released Oct 9, 2023, 1 day before disclosure), 9.0.81 (released Oct 9, 2023, 1 day before disclosure), 10.1.14 (released Oct 9, 2023, 1 day before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2023-42795](https://cve.now/CVE-2023-42795): Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

- Severity: Medium 5.3
- Published: Oct 10, 2023
- Affected: from 10.1.0-M1, fixed in 10.1.14; from 9.0.0-M1, fixed in 9.0.81; from 8.5.0, fixed in 8.5.94; from 11.0.0-M1, fixed in 11.0.0-M12.
- Fixed in 8.5.94 (released Oct 9, 2023, 1 day before disclosure), 9.0.81 (released Oct 9, 2023, 1 day before disclosure), 10.1.14 (released Oct 9, 2023, 1 day before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2023-44487](https://cve.now/CVE-2023-44487): The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

- Severity: High 7.5 · KEV
- Published: Oct 10, 2023
- Affected: from 11.0.0-M1, fixed in 11.0.0-M12; from 10.0.0, fixed in 10.1.14; from 9.0.0, fixed in 9.0.81; from 8.5.0, fixed in 8.5.94.
- Fixed in 8.5.94 (released Oct 9, 2023, 1 day before disclosure), 9.0.81 (released Oct 9, 2023, 1 day before disclosure), 10.1.14 (released Oct 9, 2023, 1 day before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2023-41080](https://cve.now/CVE-2023-41080): Apache Tomcat: Open redirect with FORM authentication

- Severity: Unrated
- Published: Aug 25, 2023
- Affected: from 8.5.0, fixed in 8.5.93; from 9.0.0-M1, fixed in 9.0.80; from 10.1.0-M1, fixed in 10.1.13; from 11.0.0-M1, fixed in 11.0.0-M11.
- Fixed in 8.5.93 (released Aug 23, 2023, 2 days before disclosure), 9.0.80 (released Aug 23, 2023, 2 days before disclosure), 10.1.13 (released Aug 23, 2023, 2 days before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2023-34981](https://cve.now/CVE-2023-34981): Apache Tomcat: AJP response header mix-up

- Severity: High 7.5
- Published: Jun 21, 2023
- Affected: from 11.0.0-M5, fixed in 11.0.0-M6; from 10.1.8, fixed in 10.1.9; from 9.0.74, fixed in 9.0.75.
- Fixed in 9.0.75 (released May 4, 2023, 48 days before disclosure), 10.1.9 (released May 9, 2023, 43 days before disclosure) and 11.0.0-M6 (released May 3, 2023, 49 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2023-28709](https://cve.now/CVE-2023-28709): Apache Tomcat: Fix for CVE-2023-24998 is incomplete

- Severity: Unrated
- Published: May 22, 2023
- Affected: from 11.0.0-M2, fixed in 11.0.0-M5; from 10.1.5, fixed in 10.1.8; from 9.0.71, fixed in 9.0.74.
- Fixed in 9.0.74 (released Apr 13, 2023, 39 days before disclosure), 10.1.8 (released Apr 14, 2023, 38 days before disclosure) and 11.0.0-M5 (released Apr 12, 2023, 40 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2023-24998](https://cve.now/CVE-2023-24998): Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

- Severity: High 7.5
- Published: Feb 20, 2023
- Affected: from 10.1.0-M1, fixed in 10.1.5; from 11.0.0-M2, fixed in 11.0.0-M5; from 8.5.85, fixed in 8.5.88; from 9.0.0-M1, fixed in 9.0.71.
- Fixed in 8.5.88 (released Apr 14, 2023, 53 days after disclosure), 9.0.71 (released Jan 9, 2023, 42 days before disclosure), 10.1.5 (released Jan 9, 2023, 42 days before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2022-45143](https://cve.now/CVE-2022-45143): Apache Tomcat: JsonErrorReportValve escaping

- Severity: Low
- Published: Jan 3, 2023
- Affected: from 8.5.83, fixed in 8.5.84; from 9.0.40, fixed in 9.0.69; from 10.1.0, fixed in 10.1.2.
- Fixed in 8.5.84 (released Nov 16, 2022, 48 days before disclosure), 9.0.69 (released Nov 9, 2022, 55 days before disclosure) and 10.1.2 (released Nov 9, 2022, 55 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2022-42252](https://cve.now/CVE-2022-42252): Apache Tomcat request smuggling via malformed content-length

- Severity: High 7.5
- Published: Nov 1, 2022
- Affected: from 8.5.0, fixed in 8.5.83; from 9.0.0-M1, fixed in 9.0.68; from 10.0.0-M1, fixed in 10.0.27; from 10.1.0-M1, fixed in 10.1.1.
- Fixed in 8.5.83 (released Oct 3, 2022, 29 days before disclosure), 9.0.68 (released Oct 3, 2022, 29 days before disclosure), 10.0.27 (released Oct 3, 2022, 29 days before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2021-25329](https://cve.now/CVE-2021-25329): Incomplete fix for CVE-2020-9484

- Severity: Unrated
- Published: Mar 1, 2021
- Affected: from 10.0.0-M1, fixed in 10.0.2; from 9.0.0, fixed in 9.0.41; from 8.0.0, fixed in 8.5.61; from 7.0.0, fixed in 7.0.108.
- Fixed in 7.0.108 (released Jan 28, 2021, 32 days before disclosure), 8.5.61 (released Dec 3, 2020, 88 days before disclosure), 9.0.41 (released Dec 3, 2020, 88 days before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2021-25122](https://cve.now/CVE-2021-25122): Apache Tomcat h2c request mix-up

- Severity: Unrated
- Published: Mar 1, 2021
- Affected: from 10.0.0-M1, fixed in 10.0.2; from 9.0.0-M1, fixed in 9.0.43; from 8.5.0, fixed in 8.5.63.
- Fixed in 8.5.63 (released Jan 29, 2021, 31 days before disclosure), 9.0.43 (released Jan 28, 2021, 32 days before disclosure) and 10.0.2 (released Jan 28, 2021, 32 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2021-24122](https://cve.now/CVE-2021-24122): Apache Tomcat information disclosure

- Severity: Unrated
- Published: Jan 14, 2021
- Affected: from 10.0.0-M1, fixed in 10.0.0-M10; from 9.0.0, fixed in 9.0.40; from 8.5.0, fixed in 8.5.60; from 7.0.0, fixed in 7.0.107.
- Fixed in 7.0.107 (released Nov 18, 2020, 57 days before disclosure), 8.5.60 (released Nov 12, 2020, 63 days before disclosure), 9.0.40 (released Nov 12, 2020, 63 days before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2020-11996](https://cve.now/CVE-2020-11996): A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could t

- Severity: Unrated
- Published: Jun 26, 2020
- Affected: from 10.0.0-M1, fixed in 10.0.0-M5; from 9.0.0.M1, fixed in 9.0.35; from 8.5.0, fixed in 8.5.55.
- Fixed in 8.5.55 (released May 5, 2020, 52 days before disclosure), 9.0.35 (released May 5, 2020, 52 days before disclosure) and 10.0.0-M5 (released May 5, 2020, 52 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2020-9484](https://cve.now/CVE-2020-9484): When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able

- Severity: Unrated
- Published: May 20, 2020
- Affected: from 10.0.0-M1, fixed in 10.0.0-M5; from 9.0.0, fixed in 9.0.35; from 8.0.0, fixed in 8.5.55; from 7.0.0, fixed in 7.0.104.
- Fixed in 7.0.104 (released May 7, 2020, 13 days before disclosure), 8.5.55 (released May 5, 2020, 15 days before disclosure), 9.0.35 (released May 5, 2020, 15 days before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2020-1938](https://cve.now/CVE-2020-1938): When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat.

- Severity: Critical 9.8 · KEV
- Published: Feb 24, 2020
- Affected: from 9.0.0, fixed in 9.0.31; from 8.0.0, fixed in 8.5.51; from 7.0.0, fixed in 7.0.100.
- Fixed in 7.0.100 (released Feb 11, 2020, 13 days before disclosure), 8.5.51 (released Feb 5, 2020, 19 days before disclosure) and 9.0.31 (released Feb 5, 2020, 19 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2020-1935](https://cve.now/CVE-2020-1935): In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsin

- Severity: Unrated
- Published: Feb 24, 2020
- Affected: fixed in 7.0.100; from 8.0.0, fixed in 8.5.51; from 9.0.0, fixed in 9.0.31.
- Fixed in 7.0.100 (released Feb 11, 2020, 13 days before disclosure), 8.5.51 (released Feb 5, 2020, 19 days before disclosure) and 9.0.31 (released Feb 5, 2020, 19 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2019-17569](https://cve.now/CVE-2019-17569): The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression.

- Severity: Unrated
- Published: Feb 24, 2020
- Affected: from 7.0.98, fixed in 7.0.100; from 8.5.48, fixed in 8.5.51; from 9.0.28, fixed in 9.0.31.
- Fixed in 7.0.100 (released Feb 11, 2020, 13 days before disclosure), 8.5.51 (released Feb 5, 2020, 19 days before disclosure) and 9.0.31 (released Feb 5, 2020, 19 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2019-12418](https://cve.now/CVE-2019-12418): When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attac

- Severity: Unrated
- Published: Dec 23, 2019
- Affected: fixed in 7.0.99; from 8.0.0, fixed in 8.5.49; from 9.0.0, fixed in 9.0.29.
- Fixed in 7.0.99 (released Dec 11, 2019, 12 days before disclosure), 8.5.49 (released Nov 17, 2019, 36 days before disclosure) and 9.0.29 (released Nov 16, 2019, 37 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2019-17563](https://cve.now/CVE-2019-17563): When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an

- Severity: Unrated
- Published: Dec 23, 2019
- Affected: fixed in 7.0.99; from 8.0.0, fixed in 8.5.50; from 9.0.0, fixed in 9.0.30.
- Fixed in 7.0.99 (released Dec 11, 2019, 12 days before disclosure), 8.5.50 (released Dec 7, 2019, 16 days before disclosure) and 9.0.30 (released Dec 7, 2019, 16 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2019-10072](https://cve.now/CVE-2019-10072): The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions…

- Severity: Unrated
- Published: Jun 21, 2019
- Affected: from 9.0.0.M1, fixed in 9.0.20; from 8.5.0, fixed in 8.5.41.
- Fixed in 8.5.41 (released May 4, 2019, 48 days before disclosure) and 9.0.20 (released May 3, 2019, 49 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2019-0221](https://cve.now/CVE-2019-0221): The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without…

- Severity: Unrated
- Published: May 28, 2019
- Affected: from 9.0.0, fixed in 9.0.17; from 8.5.0, fixed in 8.5.40; from 7.0.0, fixed in 7.0.94.
- Fixed in 7.0.94 (released Apr 10, 2019, 48 days before disclosure), 8.5.40 (released Apr 10, 2019, 48 days before disclosure) and 9.0.17 (released Mar 13, 2019, 76 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2019-0232](https://cve.now/CVE-2019-0232): When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and…

- Severity: Unrated
- Published: Apr 15, 2019
- Affected: from 9.0.0.M1, fixed in 9.0.17; from 8.0.0, fixed in 8.5.40; from 7.0.0, fixed in 7.0.94.
- Fixed in 7.0.94 (released Apr 10, 2019, 5 days before disclosure), 8.5.40 (released Apr 10, 2019, 5 days before disclosure) and 9.0.17 (released Mar 13, 2019, 33 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2019-0199](https://cve.now/CVE-2019-0199): The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS…

- Severity: Unrated
- Published: Apr 10, 2019
- Affected: from 9.0.0, fixed in 9.0.16; from 8.0.0, fixed in 8.5.38.
- Fixed in 8.5.38 (released Feb 5, 2019, 64 days before disclosure) and 9.0.16 (released Feb 4, 2019, 65 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2018-11784](https://cve.now/CVE-2018-11784): When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directo

- Severity: Unrated
- Published: Oct 4, 2018
- Affected: from 8.5.0, fixed in 8.5.34; from 7.0.23, fixed in 7.0.91; from 9.0.0, fixed in 9.0.12.
- Fixed in 7.0.91 (released Sep 13, 2018, 21 days before disclosure), 8.5.34 (released Sep 4, 2018, 30 days before disclosure) and 9.0.12 (released Sep 4, 2018, 30 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2018-8037](https://cve.now/CVE-2018-8037): If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition…

- Severity: Unrated
- Published: Aug 2, 2018
- Affected: from 9.0.0.M9, fixed in 9.0.10; from 8.5.5, fixed in 8.5.32.
- Fixed in 8.5.32 (released Jun 20, 2018, 43 days before disclosure) and 9.0.10 (released Jun 20, 2018, 43 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2018-1336](https://cve.now/CVE-2018-1336): An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a…

- Severity: Unrated
- Published: Aug 2, 2018
- Affected: from 9.0.0.M9, fixed in 9.0.8; from 8.5.0, fixed in 8.5.31; from 8.0.0RC1, fixed in 8.0.51; from 7.0.28, fixed in 7.0.87.
- Fixed in 7.0.88 (released May 7, 2018, 87 days before disclosure, the advisory names 7.0.87, which was never published), 8.0.51 (released Apr 9, 2018, 115 days before disclosure), 8.5.31 (released Apr 27, 2018, 97 days before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2018-8034](https://cve.now/CVE-2018-8034): The host name verification when using TLS with the WebSocket client was missing.

- Severity: High 7.5
- Published: Aug 1, 2018
- Affected: from 9.0.0, fixed in 9.0.10; from 8.5.0, fixed in 8.5.32; from 8.0.0, fixed in 8.0.53; from 7.0.35, fixed in 7.0.90.
- Fixed in 7.0.90 (released Jul 2, 2018, 30 days before disclosure), 8.0.53 (released Jun 29, 2018, 33 days before disclosure), 8.5.32 (released Jun 20, 2018, 42 days before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2018-8014](https://cve.now/CVE-2018-8014): The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.8

- Severity: Unrated
- Published: May 16, 2018
- Affected: from 9.0.0.M1, fixed in 9.0.9; from 8.5.0, fixed in 8.5.32; from 8.0.0RC1, fixed in 8.0.53; from 7.0.41, fixed in 7.0.88.
- Fixed in 7.0.88 (released May 7, 2018, 9 days before disclosure), 8.0.53 (released Jun 29, 2018, 44 days after disclosure), 8.5.32 (released Jun 20, 2018, 35 days after disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2018-1304](https://cve.now/CVE-2018-1304): The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4

- Severity: Unrated
- Published: Feb 28, 2018
- Affected: from 9.0.0, fixed in 9.0.5; from 8.5.0, fixed in 8.5.28; from 8.0.0, fixed in 8.0.51; from 7.0.0, fixed in 7.0.86.
- Fixed in 7.0.86 (released Apr 9, 2018, 40 days after disclosure), 8.0.51 (released Apr 9, 2018, 40 days after disclosure), 8.5.28 (released Feb 6, 2018, 22 days before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2018-1305](https://cve.now/CVE-2018-1305): Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 t

- Severity: Unrated
- Published: Feb 23, 2018
- Affected: from 9.0.0M1, fixed in 9.0.5; from 8.5.0, fixed in 8.5.28; from 7.0.0, fixed in 7.0.85.
- Fixed in 7.0.85 (released Feb 7, 2018, 16 days before disclosure), 8.5.28 (released Feb 6, 2018, 17 days before disclosure) and 9.0.5 (released Feb 6, 2018, 17 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2017-12617](https://cve.now/CVE-2017-12617): When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.

- Severity: High 8.1 · KEV
- Published: Oct 3, 2017
- Affected: from 9.0.0.M1, fixed in 9.0.1; from 8.5.0, fixed in 8.5.23; from 8.0.0-RC1, fixed in 8.0.47; from 7.0.0, fixed in 7.0.82.
- Fixed in 7.0.82 (released Sep 29, 2017, 4 days before disclosure), 8.0.47 (released Sep 29, 2017, 4 days before disclosure), 8.5.23 (released Sep 28, 2017, 5 days before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2017-12615](https://cve.now/CVE-2017-12615): When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g.

- Severity: High 8.1 · KEV
- Published: Sep 19, 2017
- Affected: from 7.0.0, fixed in 7.0.79.
- Fixed in 7.0.79 (released Jun 26, 2017, 85 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2017-5651](https://cve.now/CVE-2017-5651): In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send…

- Severity: Unrated
- Published: Apr 17, 2017
- Affected: from 9.0.0.M1, fixed in 9.0.0.M19; from 8.5.0, fixed in 8.5.13.
- Fixed in 8.5.13 (released Mar 27, 2017, 21 days before disclosure) and 9.0.0.M19 (released Mar 27, 2017, 21 days before disclosure).
- The latest release, 11.0.27, is not affected.

### [CVE-2017-5648](https://cve.now/CVE-2017-5648): While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.

- Severity: Unrated
- Published: Apr 17, 2017
- Affected: from 9.0.0.M1, fixed in 9.0.0.M18; from 8.5.0, fixed in 8.5.13; from 8.0.0, fixed in 8.0.42; from 7.0.0, fixed in 7.0.76.
- Fixed in 7.0.76 (released Mar 9, 2017, 39 days before disclosure), 8.0.42 (released Mar 8, 2017, 40 days before disclosure), 8.5.13 (released Mar 27, 2017, 21 days before disclosure) and 1 other version.
- The latest release, 11.0.27, is not affected.

### [CVE-2014-0095](https://cve.now/CVE-2014-0095): java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of…

- Severity: Unrated
- Published: May 31, 2014
- Affected: from 8.0.0-RC1, fixed in 8.0.4.
- Fixed in 8.0.5 (released Mar 24, 2014, 68 days before disclosure, the advisory names 8.0.4, which was never published).
- The latest release, 11.0.27, is not affected.

### [CVE-2008-1947](https://cve.now/CVE-2008-1947): Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject…

- Severity: Unrated
- Published: Jun 4, 2008
- Affected: from 5.5.9, fixed in 5.5.27; from 6.0.0, fixed in 6.0.18.
- Fixed in 7.0.0 (released Jul 12, 2010, 768 days after disclosure, the advisory names 5.5.27, which was never published).
- The latest release, 11.0.27, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.tomcat.embed:tomcat-embed-core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.