The vulnerability of the Apache Tomcat application server, related to the disclosure of information due to timing mismatches, allows attackers to gain unauthorized access to protected information.

🗓️ 11 Jun 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

The Apache Tomcat timing vulnerability causes information disclosure enabling remote access.

Reporter	Title	Published	Views	Family All 127
IBM Security Bulletins	Security Bulletin: IBM Integration Bus for z/OS is vulnerable to multiple vulnerabilities due to Apache Tomcat	27 Jul 202613:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in tomcat-embed-core (CVE-2026-41284,CVE-2026-42498,CVE-2026-43514,CVE-2026-24880, CVE-2026-34483,CVE-2026-34487,CVE-2026-34500)	10 Aug 202613:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat [CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-43514, CVE-2026-43515]	28 Jul 202621:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in tomcat-embed-core-11.0.20.jar	17 Jun 202615:26	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring Security, Apache Tomcat, Netty, Lodash, Spring Framework and Node.js might affect IBM Storage Defender Copy Data Management	26 Jun 202617:03	–	ibm
IBM Security Bulletins	Security Bulletin: The Apache Tomcat application server that is shipped with IBM ApplinX is vulnerable to multiple vulnerabilities.	16 Jun 202617:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM DevOps Build.	29 Jun 202615:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	5 Aug 202612:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM DataStax Enterprise	29 Jun 202609:47	–	ibm
Tenable Nessus	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2026-1770)	8 Jun 202600:00	–	nessus

Vulners

Node

apache tomcatRange9.0.0.m1–9.0.17

apache tomcatRange11.0.0-m1–11.0.21

apache tomcatRange10.1.0-m1–10.1.54

canonical ubuntuMatch25.10

Source	Link
github	www.github.com/advisories/GHSA-9m89-8frq-c98c
tomcat	www.tomcat.apache.org/security-10.html
lists	www.lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m
github	www.github.com/apache/tomcat
github	www.github.com/apache/tomcat/commit/933dcdbf2515972280002929e7e597dead2e9ffa
tomcat	www.tomcat.apache.org/security-11.html
openwall	www.openwall.com/lists/oss-security/2026/05/12/10
tomcat	www.tomcat.apache.org/security-9.html
github	www.github.com/apache/tomcat/commit/d35d9d23263c8e4af561f615c960c91697ff200e
github	www.github.com/apache/tomcat/commit/a102a2a157868ca51d83eaf5a119ccd9976a113e

11 Jun 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 37.5

CVSS 27.8

EPSS0.00352