CLEANSTART-2026-CD66042 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11

🗓️ 30 Jan 2026 16:16:25Reported by GoogleType

osv🔗 osv.dev👁 3 Views

Tomcat nine has multiple vulnerabilities; RemoteIpFilter with reverse proxy and X-Forwarded-Proto https may affect session cookies.

Reporter	Title	Published	Views	Family All 1025
0day.today	Apache Tomcat 10.1 - Denial Of Service Exploit	5 Apr 202300:00	–	zdt
UbuntuCve	CVE-2022-23181	27 Jan 202213:15	–	ubuntucve
UbuntuCve	CVE-2022-29885	12 May 202208:15	–	ubuntucve
UbuntuCve	CVE-2022-34305	23 Jun 202211:15	–	ubuntucve
UbuntuCve	CVE-2022-42252	1 Nov 202209:15	–	ubuntucve
UbuntuCve	CVE-2022-45143	3 Jan 202319:15	–	ubuntucve
UbuntuCve	CVE-2023-24998	20 Feb 202316:15	–	ubuntucve
UbuntuCve	CVE-2023-28708	22 Mar 202311:15	–	ubuntucve
Ubuntu	USN-7106-1: Tomcat vulnerabilities	13 Nov 202407:19	–	ubuntu
Ubuntu	USN-7562-1: Tomcat vulnerabilities	9 Jun 202514:59	–	ubuntu

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CD66042
osv	www.osv.dev/vulnerability/CVE-2022-23181
osv	www.osv.dev/vulnerability/CVE-2022-29885
osv	www.osv.dev/vulnerability/CVE-2022-34305
osv	www.osv.dev/vulnerability/CVE-2022-42252
osv	www.osv.dev/vulnerability/CVE-2022-45143
osv	www.osv.dev/vulnerability/CVE-2023-24998
osv	www.osv.dev/vulnerability/CVE-2023-28708
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-23181
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-29885

02 Apr 2026 08:52Current

7.3High risk

Vulners AI Score7.3

CVSS 3.19.8

EPSS0.73139