Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.tomcat:tomcat-catalina

44 known vulnerabilities (12 critical, 15 high, 6 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
11.0.27 (Oct 6, 2026): no advisory affects it
Newest unaffected release
11.0.27 (Oct 6, 2026), the latest release
Advisories
44 · 12 critical, 15 high, 6 medium, 2 low
Dependents
22
Releases
473 since 7.0.0 (Jul 12, 2010)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-68525
    Affects 7.0.0 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.120 (9.0.121 is outside it); 10.1.0-M1 to 10.1.57 (10.1.59 is outside it); 11.0.0-M1 to 11.0.24 (11.0.25 is outside it)
  • CVE-2026-65905
    Affects 7.0.30 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.120 (9.0.121 is outside it); 10.1.0-M1 to 10.1.57 (10.1.59 is outside it); 11.0.0-M1 to 11.0.24 (11.0.25 is outside it)
  • CVE-2026-65182
    Affects 7.0.0 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.120 (9.0.121 is outside it); 10.1.0-M1 to 10.1.57 (10.1.59 is outside it); 11.0.0-M1 to 11.0.24 (11.0.25 is outside it)
  • CVE-2026-55957
    Affects 7.0.0 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.100 (9.0.102 is outside it); 10.1.0-M1 to 10.1.36 (10.1.39 is outside it); 11.0.0-M1 to 11.0.4 (11.0.5 is outside it)
  • CVE-2026-55956
    Affects 7.0.0 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.0 to 9.0.118 (9.0.119 is outside it); 10.1.0-M1 to 10.1.55 (10.1.56 is outside it); 11.0.0-M1 to 11.0.22 (11.0.23 is outside it)
  • CVE-2026-53404
    Affects 8.5.0 to 9.0.118 (9.0.119 is outside it); 10.1.0-M1 to 10.1.55 (10.1.56 is outside it); 11.0.0-M1 to 11.0.22 (11.0.23 is outside it)
  • CVE-2026-43515
    Affects 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
  • CVE-2026-43514
    Affects 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
  • CVE-2026-43513
    Affects 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
  • CVE-2026-43512
    Affects 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
  • CVE-2026-42498
    Affects 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
  • CVE-2026-41284
    Affects 7.0.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
Show all 44 advisoriesShow fewer advisories
  • CVE-2026-34483
    Affects 9.0.40 to 9.0.115 (9.0.116 is outside it); 10.1.0-M1 to 10.1.53 (10.1.54 is outside it); 11.0.0-M1 to 11.0.20 (11.0.21 is outside it)
  • CVE-2026-25854
    Affects 8.5.30 to 9.0.115 (9.0.116 is outside it); 10.1.0-M1 to 10.1.52 (10.1.53 is outside it); 11.0.0-M1 to 11.0.18 (11.0.20 is outside it)
  • CVE-2025-61795
    Affects 8.5.0 to 9.0.109 (9.0.110 is outside it); 10.1.0-M1 to 10.1.46 (10.1.47 is outside it); 11.0.0-M1 to 11.0.11 (11.0.12 is outside it)
  • CVE-2025-55752
    Affects 8.5.6 to 9.0.108 (9.0.109 is outside it); 10.1.0-M1 to 10.1.44 (10.1.45 is outside it); 11.0.0-M1 to 11.0.10 (11.0.11 is outside it)
  • CVE-2025-55754
    Affects 8.5.60 to 8.5.100 (9.0.0.M1 is outside it); 9.0.40 to 9.0.108 (9.0.109 is outside it); 10.1.0-M1 to 10.1.44 (10.1.45 is outside it); 11.0.0-M1 to 11.0.10 (11.0.11 is outside it)
  • CVE-2025-55668
    Affects 9.0.0.M1 to 9.0.105 (9.0.106 is outside it); 10.1.0-M1 to 10.1.41 (10.1.42 is outside it); 11.0.0-M1 to 11.0.7 (11.0.8 is outside it)
  • CVE-2025-52520
    Affects 8.5.0 to 9.0.106 (9.0.107 is outside it); 10.1.0-M1 to 10.1.42 (10.1.43 is outside it); 11.0.0-M1 to 11.0.8 (11.0.9 is outside it)
  • CVE-2025-49124
    Affects 9.0.24 to 9.0.105 (9.0.106 is outside it); 10.1.0 to 10.1.41 (10.1.42 is outside it); 11.0.0-M1 to 11.0.7 (11.0.8 is outside it)
  • CVE-2025-49125
    Affects 8.5.0 to 9.0.105 (9.0.106 is outside it); 10.1.0-M1 to 10.1.41 (10.1.42 is outside it); 11.0.0-M1 to 11.0.7 (11.0.8 is outside it)
  • CVE-2025-48988
    Affects 8.5.0 to 9.0.105 (9.0.106 is outside it); 10.1.0-M1 to 10.1.41 (10.1.42 is outside it); 11.0.0-M1 to 11.0.7 (11.0.8 is outside it)
  • CVE-2025-46701
    Affects 8.5.0 to 9.0.104 (9.0.105 is outside it); 10.1.0-M1 to 10.1.40 (10.1.41 is outside it); 11.0.0-M1 to 11.0.6 (11.0.7 is outside it)
  • CVE-2025-31651
    Affects 8.5.0 to 8.5.100 (9.0.0.M1 is outside it); 9.0.76 to 9.0.102 (9.0.104 is outside it); 10.1.10 to 10.1.39 (10.1.40 is outside it); 11.0.0-M3 to 11.0.5 (11.0.6 is outside it)
  • CVE-2025-24813
    Affects 8.5.0 to 9.0.98 (9.0.99 is outside it); 10.1.0-M1 to 10.1.34 (10.1.35 is outside it); 11.0.0-M1 to 11.0.2 (11.0.3 is outside it)
  • CVE-2024-56337
    Affects 10.1.0-M1 to 10.1.33 (10.1.34 is outside it); 11.0.0-M1 to 11.0.1 (11.0.2 is outside it)
  • CVE-2024-50379
    Affects 8.5.0 to 9.0.97 (9.0.98 is outside it); 10.1.0-M1 to 10.1.33 (10.1.34 is outside it); 11.0.0-M1 to 11.0.1 (11.0.2 is outside it)
  • CVE-2024-52316
    Affects 7.0.0 to 9.0.95 (9.0.96 is outside it); 10.1.0-M1 to 10.1.29 (10.1.30 is outside it); 11.0.0-M1 to 11.0.0 (11.0.1 is outside it)
  • CVE-2023-46589
    Affects 8.5.0 to 8.5.95 (8.5.96 is outside it); 9.0.0.M1 to 9.0.82 (9.0.83 is outside it); 10.1.0-M1 to 10.1.15 (10.1.16 is outside it); 11.0.0-M1 to 11.0.0-M10 (11.0.0-M11 is outside it)
  • CVE-2023-42795
    Affects 8.5.0 to 8.5.93 (8.5.94 is outside it); 9.0.0.M1 to 9.0.80 (9.0.81 is outside it); 10.1.0-M1 to 10.1.13 (10.1.14 is outside it); 11.0.0-M1 to 11.0.0-M11 (11.0.0-M12 is outside it)
  • CVE-2023-41080
    Affects 8.5.0 to 8.5.92 (8.5.93 is outside it); 9.0.0.M1 to 9.0.79 (9.0.80 is outside it); 10.1.0-M1 to 10.1.12 (10.1.13 is outside it)
  • CVE-2023-28708
    Affects 8.5.0 to 8.5.85 (8.5.86 is outside it); 9.0.0.M1 to 9.0.71 (9.0.72 is outside it); 10.1.0-M1 to 10.1.5 (10.1.6 is outside it); 11.0.0-M1 (11.0.0-M3 is outside it)
  • CVE-2023-24998
    Affects 8.5.85 to 8.5.87 (8.5.88 is outside it); 9.0.0.M1 to 9.0.70 (9.0.71 is outside it); 10.1.0-M1 to 10.1.4 (10.1.5 is outside it); 11.0.0-M3 to 11.0.0-M4 (11.0.0-M5 is outside it)
  • CVE-2022-45143
    Affects 10.1.0 to 10.1.1 (10.1.2 is outside it)
  • CVE-2020-9484
    Affects 7.0.0 to 7.0.103 (7.0.104 is outside it); 8.0.1 to 8.5.54 (8.5.55 is outside it); 9.0.1 to 9.0.34 (9.0.35 is outside it); 10.0.0-M1 to 10.0.0-M4 (10.0.0-M5 is outside it)
  • CVE-2019-0221
    Affects 7.0.0 to 7.0.93 (7.0.94 is outside it); 8.5.0 to 8.5.39 (8.5.40 is outside it); 9.0.1 to 9.0.16 (9.0.17 is outside it)
  • CVE-2017-12617
    Affects 7.0.0 to 7.0.81 (7.0.82 is outside it); 8.0.0-RC1 to 8.0.46 (8.0.47 is outside it); 8.5.0 to 8.5.21 (8.5.23 is outside it); 9.0.0.M1 to 9.0.0.M27 (9.0.1 is outside it)
  • CVE-2017-12616
    Affects 7.0.0 to 7.0.79 (7.0.81 is outside it)
  • CVE-2017-5648
    Affects 7.0.0 to 7.0.75 (7.0.76 is outside it); 8.0.1 to 8.0.41 (8.0.42 is outside it); 8.5.0 to 8.5.12 (8.5.13 is outside it); 9.0.0.M1 to 9.0.0.M17 (9.0.0.M18 is outside it)
  • CVE-2016-8735
    Affects 7.0.0 to 7.0.72 (7.0.73 is outside it); 8.0.1 to 8.0.38 (8.0.39 is outside it); 8.5.0 to 8.5.6 (8.5.8 is outside it); 9.0.0.M1 to 9.0.0.M11 (9.0.0.M13 is outside it)
  • CVE-2016-5388
    Affects 7.0.0 to 7.0.70 (7.0.72 is outside it); 8.0.1 to 8.5.4 (8.5.5 is outside it)
  • CVE-2014-0119
    Affects 7.0.0 to 7.0.53 (7.0.54 is outside it); 8.0.1 to 8.0.5 (8.0.8 is outside it)
  • CVE-2014-0096
    Affects 7.0.0 to 7.0.53 (7.0.54 is outside it); 8.0.1 to 8.0.5 (8.0.8 is outside it)
  • CVE-2012-5886
    Affects 7.0.0 to 7.0.29 (7.0.30 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 44

  • CVE-2026-68525Critical 9.1

    Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

    Affected: from 11.0.0-M1, fixed in 11.0.25; from 10.1.0-M1, fixed in 10.1.58; from 9.0.0-M1, fixed in 9.0.121; from 8.5.0, through 8.5.100; from 7.0.0, through 7.0.109.

    Fixed in 9.0.121 (released Aug 12, 2026, 13 days before disclosure), 10.1.59 (released Aug 13, 2026, 12 days before disclosure, the advisory names 10.1.58, which was never published) and 11.0.25 (released Aug 12, 2026, 13 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-65905Critical 9.8

    Apache Tomcat: Limited replay attack possible with DIGEST authentication

    Affected: from 11.0.0-M1, fixed in 11.0.25; from 10.1.0-M1, fixed in 10.1.58; from 9.0.0.M1, fixed in 9.0.121; from 8.5.0, through 8.5.100; from 7.0.30, through 7.0.109.

    Fixed in 9.0.121 (released Aug 12, 2026, 13 days before disclosure), 10.1.59 (released Aug 13, 2026, 12 days before disclosure, the advisory names 10.1.58, which was never published) and 11.0.25 (released Aug 12, 2026, 13 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-65182Critical 9.1

    Apache Tomcat: Bypass longest prefix security constraint

    Affected: from 11.0.0-M1, fixed in 11.0.25; from 10.1.0-M1, fixed in 10.1.58; from 9.0.0-M1, fixed in 9.0.121; from 8.5.0, through 8.5.100; from 7.0.0, through 7.0.109.

    Fixed in 9.0.121 (released Aug 12, 2026, 13 days before disclosure), 10.1.59 (released Aug 13, 2026, 12 days before disclosure, the advisory names 10.1.58, which was never published) and 11.0.25 (released Aug 12, 2026, 13 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

    Affected: from 11.0.0-M1, fixed in 11.0.5; from 10.1.0-M1, fixed in 10.1.37; from 9.0.0.M1, fixed in 9.0.101; from 8.5.0, through 8.5.100; through 7.0.109.

    Fixed in 9.0.102 (released Mar 3, 2025, 483 days before disclosure, the advisory names 9.0.101, which was never published), 10.1.39 (released Mar 4, 2025, 482 days before disclosure, the advisory names 10.1.37, which was never published) and 11.0.5 (released Feb 28, 2025, 486 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-55956Medium 6.5

    Apache Tomcat: Security constraints for default servlet ignored method

    Affected: from 11.0.0-M1, fixed in 11.0.23; from 10.1.0-M1, fixed in 10.1.56; from 9.0.0.M1, fixed in 9.0.119; from 8.5.0, through 8.5.100; through 7.0.109.

    Fixed in 9.0.119 (released Jun 18, 2026, 11 days before disclosure), 10.1.56 (released Jun 17, 2026, 12 days before disclosure) and 11.0.23 (released Jun 17, 2026, 12 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Bad ornext processing in RewriteValve

    Affected: from 11.0.0-M1, fixed in 11.0.23; from 10.1.0-M1, fixed in 10.1.56; from 9.0.0.M1, fixed in 9.0.119; from 8.5.0, through 8.5.100.

    Fixed in 9.0.119 (released Jun 18, 2026, 11 days before disclosure), 10.1.56 (released Jun 17, 2026, 12 days before disclosure) and 11.0.23 (released Jun 17, 2026, 12 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-43515Critical 9.1

    Apache Tomcat: Security constraints not correctly applied

    Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: AJP secret compared in non-constant time

    Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: LockOutRealm treats user names as case-sensitive

    Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-43512Critical 9.8

    Apache Tomcat: Digest authenticator will authenticate any unknown user

    Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: WebSocket authentication header exposure

    Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

    Affected: fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Incomplete escaping of JSON access logs

    Affected: from 9.0.40, fixed in 9.0.116; from 10.1.0-M1, fixed in 10.1.54; from 11.0.0-M1, fixed in 11.0.21.

    Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.54 (released Mar 30, 2026, 10 days before disclosure) and 11.0.21 (released Mar 30, 2026, 10 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-25854Medium 6.1

    Apache Tomcat: Occasionally open redirect

    Affected: from 8.5.30, fixed in 9.0.116; from 10.1.0-M1, fixed in 10.1.53; from 11.0.0-M1, fixed in 11.0.20.

    Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.53 (released Mar 18, 2026, 22 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2025-61795Medium 5.3

    Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS

    Affected: from 11.0.0-M1, fixed in 11.0.12; from 10.1.0-M1, fixed in 10.1.47; from 9.0.0.M1, fixed in 9.0.110; from 8.5.0, through 8.5.100.

    Fixed in 9.0.110 (released Oct 1, 2025, 26 days before disclosure), 10.1.47 (released Oct 2, 2025, 25 days before disclosure) and 11.0.12 (released Oct 1, 2025, 26 days before disclosure).

    The latest release, 11.0.27, is not affected.

Show all 44 advisoriesShow fewer advisories

  • Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

    Affected: from 11.0.0-M1, fixed in 11.0.11; from 10.1.0-M1, fixed in 10.1.45; from 9.0.0-M11, fixed in 9.0.109; from 8.5.6, through 8.5.100.

    Fixed in 9.0.109 (released Sep 1, 2025, 56 days before disclosure), 10.1.45 (released Sep 2, 2025, 55 days before disclosure) and 11.0.11 (released Sep 1, 2025, 56 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2025-55754Critical 9.6

    Apache Tomcat: console manipulation via escape sequences in log messages

    Affected: from 11.0.0-M1, fixed in 11.0.11; from 10.1.0-M1, fixed in 10.1.45; from 9.0.40, fixed in 9.0.109; from 8.5.60, through 8.5.100.

    Fixed in 9.0.109 (released Sep 1, 2025, 56 days before disclosure), 10.1.45 (released Sep 2, 2025, 55 days before disclosure) and 11.0.11 (released Sep 1, 2025, 56 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2025-55668Medium 6.5

    Apache Tomcat: session fixation via rewrite valve

    Affected: from 11.0.0-M1, fixed in 11.0.8; from 10.1.0-M1, fixed in 10.1.42; from 9.0.0.M1, fixed in 9.0.106.

    Fixed in 9.0.106 (released Jun 5, 2025, 69 days before disclosure), 10.1.42 (released Jun 5, 2025, 69 days before disclosure) and 11.0.8 (released Jun 5, 2025, 69 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: DoS via integer overflow in multipart file upload

    Affected: from 11.0.0-M1, fixed in 11.0.9; from 10.1.0-M1, fixed in 10.1.43; from 9.0.0.M1, fixed in 9.0.107; from 8.5.0, through 8.5.100.

    Fixed in 9.0.107 (released Jul 2, 2025, 8 days before disclosure), 10.1.43 (released Jul 1, 2025, 9 days before disclosure) and 11.0.9 (released Jul 1, 2025, 9 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows

    Affected: from 11.0.0-M1, fixed in 11.0.8; from 10.1.0, fixed in 10.1.42; from 9.0.23, fixed in 9.0.106.

    Fixed in 9.0.106 (released Jun 5, 2025, 11 days before disclosure), 10.1.42 (released Jun 5, 2025, 11 days before disclosure) and 11.0.8 (released Jun 5, 2025, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Security constraint bypass for pre/post-resources

    Affected: from 11.0.0-M1, fixed in 11.0.8; from 10.1.0-M1, fixed in 10.1.42; from 9.0.0.M1, fixed in 9.0.106; from 8.5.0, through 8.5.100.

    Fixed in 9.0.106 (released Jun 5, 2025, 11 days before disclosure), 10.1.42 (released Jun 5, 2025, 11 days before disclosure) and 11.0.8 (released Jun 5, 2025, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: FileUpload large number of parts with headers DoS

    Affected: from 11.0.0-M1, fixed in 11.0.8; from 10.1.0-M1, fixed in 10.1.42; from 9.0.0.M1, fixed in 9.0.106; from 8.5.0, through 8.5.100.

    Fixed in 9.0.106 (released Jun 5, 2025, 11 days before disclosure), 10.1.42 (released Jun 5, 2025, 11 days before disclosure) and 11.0.8 (released Jun 5, 2025, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Security constraint bypass for CGI scripts

    Affected: from 9.0.0.M1, fixed in 9.0.105; from 10.1.0-M1, fixed in 10.1.41; from 11.0.0-M1, fixed in 11.0.7; from 8.5.0, through 8.5.100.

    Fixed in 9.0.105 (released May 7, 2025, 22 days before disclosure), 10.1.41 (released May 8, 2025, 21 days before disclosure) and 11.0.7 (released May 7, 2025, 22 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2025-31651Critical 9.8

    Apache Tomcat: Bypass of rules in Rewrite Valve

    Affected: from 9.0.76, fixed in 9.0.104; from 10.1.10, fixed in 10.1.40; from 11.0.0-M2, fixed in 11.0.6; from 8.5.0, through 8.5.100.

    Fixed in 9.0.104 (released Apr 4, 2025, 24 days before disclosure), 10.1.40 (released Apr 1, 2025, 27 days before disclosure) and 11.0.6 (released Apr 1, 2025, 27 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2025-24813Critical 10.0 · KEV

    Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

    Affected: from 11.0.0-M1, fixed in 11.0.3; from 10.1.0-M1, fixed in 10.1.35; from 9.0.0.M1, fixed in 9.0.99; from 8.5.0, through 8.5.100.

    Fixed in 9.0.99 (released Feb 4, 2025, 34 days before disclosure), 10.1.35 (released Feb 4, 2025, 34 days before disclosure) and 11.0.3 (released Feb 4, 2025, 34 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2024-56337Critical 9.8

    Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

    Affected: from 11.0.0-M1, fixed in 11.0.2; from 10.1.0-M1, fixed in 10.1.34.

    Fixed in 10.1.34 (released Dec 5, 2024, 15 days before disclosure) and 11.0.2 (released Dec 5, 2024, 15 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2024-50379Critical 9.8

    Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

    Affected: from 11.0.0-M1, fixed in 11.0.2; from 10.1.0-M1, fixed in 10.1.34; from 9.0.0.M1, fixed in 9.0.98; from 8.5.0, through 8.5.100.

    Fixed in 9.0.98 (released Dec 5, 2024, 12 days before disclosure), 10.1.34 (released Dec 5, 2024, 12 days before disclosure) and 11.0.2 (released Dec 5, 2024, 12 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2024-52316Critical 9.8

    Apache Tomcat: Authentication bypass when using Jakarta Authentication API

    Affected: fixed in 9.0.96; from 10.1.0-M1, fixed in 10.1.30; from 11.0.0-M1, fixed in 11.0.1.

    Fixed in 9.0.96 (released Oct 3, 2024, 46 days before disclosure), 10.1.30 (released Sep 14, 2024, 65 days before disclosure) and 11.0.1 (released Nov 6, 2024, 12 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: HTTP request smuggling via malformed trailer headers

    Affected: from 11.0.0-M1, fixed in 11.0.0-M11; from 10.1.0-M1, fixed in 10.1.16; from 9.0.0-M1, fixed in 9.0.83; from 8.5.0, fixed in 8.5.96.

    Fixed in 8.5.96 (released Nov 10, 2023, 18 days before disclosure), 9.0.83 (released Nov 9, 2023, 19 days before disclosure), 10.1.16 (released Nov 10, 2023, 18 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • CVE-2023-42795Medium 5.3

    Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

    Affected: from 11.0.0-M1, fixed in 11.0.0-M12; from 10.1.0-M1, fixed in 10.1.14; from 9.0.0-M1, fixed in 9.0.81; from 8.5.0, fixed in 8.5.94.

    Fixed in 8.5.94 (released Oct 9, 2023, 1 day before disclosure), 9.0.81 (released Oct 9, 2023, 1 day before disclosure), 10.1.14 (released Oct 9, 2023, 1 day before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Open redirect with FORM authentication

    Affected: from 10.1.0-M1, fixed in 10.1.13; from 9.0.0-M1, fixed in 9.0.80; from 8.5.0, fixed in 8.5.93.

    Fixed in 8.5.93 (released Aug 23, 2023, 2 days before disclosure), 9.0.80 (released Aug 23, 2023, 2 days before disclosure) and 10.1.13 (released Aug 23, 2023, 2 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2023-28708Medium 4.3

    Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations

    Affected: from 11.0.0-M1, fixed in 11.0.0-M3; from 10.1.0-M1, fixed in 10.1.6; from 9.0.0-M1, fixed in 9.0.72; from 8.5.0, fixed in 8.5.86.

    Fixed in 8.5.86 (released Feb 18, 2023, 32 days before disclosure), 9.0.72 (released Feb 18, 2023, 32 days before disclosure), 10.1.6 (released Feb 19, 2023, 31 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

    Affected: from 10.1.0-M1, fixed in 10.1.5; from 11.0.0-M2, fixed in 11.0.0-M5; from 8.5.85, fixed in 8.5.88; from 9.0.0-M1, fixed in 9.0.71.

    Fixed in 8.5.88 (released Apr 14, 2023, 53 days after disclosure), 9.0.71 (released Jan 9, 2023, 42 days before disclosure), 10.1.5 (released Jan 9, 2023, 42 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: JsonErrorReportValve escaping

    Affected: from 10.1.0, fixed in 10.1.2.

    Fixed in 10.1.2 (released Nov 9, 2022, 55 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able

    Affected: from 10.0.0-M1, fixed in 10.0.0-M5; from 9.0.0, fixed in 9.0.35; from 8.0.0, fixed in 8.5.55; from 7.0.0, fixed in 7.0.104.

    Fixed in 7.0.104 (released May 7, 2020, 13 days before disclosure), 8.5.55 (released May 5, 2020, 15 days before disclosure), 9.0.35 (released May 5, 2020, 15 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without…

    Affected: from 9.0.0, fixed in 9.0.17; from 8.5.0, fixed in 8.5.40; from 7.0.0, fixed in 7.0.94.

    Fixed in 7.0.94 (released Apr 10, 2019, 48 days before disclosure), 8.5.40 (released Apr 10, 2019, 48 days before disclosure) and 9.0.17 (released Mar 13, 2019, 76 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2017-12617High 8.1 · KEV

    When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.

    Affected: from 9.0.0.M1, fixed in 9.0.1; from 8.5.0, fixed in 8.5.23; from 8.0.0-RC1, fixed in 8.0.47; from 7.0.0, fixed in 7.0.82.

    Fixed in 7.0.82 (released Sep 29, 2017, 4 days before disclosure), 8.0.47 (released Sep 29, 2017, 4 days before disclosure), 8.5.23 (released Sep 28, 2017, 5 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code

    Affected: from 7.0.0, fixed in 7.0.81.

    Fixed in 7.0.81 (released Aug 11, 2017, 39 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.

    Affected: from 9.0.0.M1, fixed in 9.0.0.M18; from 8.5.0, fixed in 8.5.13; from 8.0.0, fixed in 8.0.42; from 7.0.0, fixed in 7.0.76.

    Fixed in 7.0.76 (released Mar 9, 2017, 39 days before disclosure), 8.0.42 (released Mar 8, 2017, 40 days before disclosure), 8.5.13 (released Mar 27, 2017, 21 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • CVE-2016-8735Critical 9.8 · KEV

    Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before

    Affected: fixed in 6.0.48; from 7.0.0, fixed in 7.0.73; from 8.0.0, fixed in 8.0.39; from 8.5.0, fixed in 8.5.7; from 9.0.0.M1, fixed in 9.0.0.M12.

    Fixed in 7.0.73 (released Nov 7, 2016, 150 days before disclosure, the advisory names 6.0.48, which was never published), 8.0.39 (released Nov 9, 2016, 148 days before disclosure), 8.5.8 (released Nov 3, 2016, 154 days before disclosure, the advisory names 8.5.7, which was never published) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does

    Affected: from 7.0.0, fixed in 7.0.72; from 8.0.0, fixed in 8.5.5.

    Fixed in 7.0.72 (released Sep 14, 2016, 57 days after disclosure) and 8.5.5 (released Aug 31, 2016, 43 days after disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML pars

    Affected: fixed in 6.0.40; from 7.0.0, fixed in 7.0.54; from 8.0.0, fixed in 8.0.6.

    Fixed in 7.0.54 (released May 20, 2014, 11 days before disclosure, the advisory names 6.0.40, which was never published) and 8.0.8 (released May 16, 2014, 15 days before disclosure, the advisory names 8.0.6, which was never published).

    The latest release, 11.0.27, is not affected.

  • java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x befo

    Affected: fixed in 6.0.40; from 7.0.0, fixed in 7.0.54; from 8.0.0, fixed in 8.0.6.

    Fixed in 7.0.54 (released May 20, 2014, 11 days before disclosure, the advisory names 6.0.40, which was never published) and 8.0.8 (released May 16, 2014, 15 days before disclosure, the advisory names 8.0.6, which was never published).

    The latest release, 11.0.27, is not affected.

  • The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches i

    Affected: from 5.5.0, fixed in 5.5.36; from 6.0.0, fixed in 6.0.36; from 7.0.0, fixed in 7.0.30.

    Fixed in 7.0.30 (released Sep 2, 2012, 76 days before disclosure, the advisory names 5.5.36, which was never published).

    The latest release, 11.0.27, is not affected.