CLEANSTART-2026-MR27796 Security fixes for CVE-2022-23181, CVE-2022-29885, CVE-2022-34305, CVE-2022-42252, CVE-2022-45143, CVE-2023-24998, CVE-2023-28708, CVE-2025-31650, CVE-2025-31651 applied in versions: 10.1.53-r0, 9.0.58-r0, 9.0.63-r0, 9.0.64-r0, 9.0.68-r0, 9.0.70-r0, 9.0.71-r0, 9.0.73-r0, 9.0.80-r0

🗓️ 18 May 2026 13:35:17Reported by GoogleType

osv🔗 osv.dev👁 27 Views

Security fixes for multiple CVEs in tomcat10; patched in later releases.

Reporter	Title	Published	Views	Family All 1459
zdt	Apache Tomcat 10.1 - Denial Of Service Exploit	5 Apr 202300:00	–	zdt
OSV	CLEANSTART-2026-SO05837 Security fixes in tomcat10 9.0.73-r0	30 Jul 202607:10	–	osv
OSV	CLEANSTART-2026-SV10547 Security fixes in tomcat10 10.1.53-r0	30 Jul 202607:10	–	osv
OSV	CLEANSTART-2026-TN71701 Security fixes for CVE-2022-23181, CVE-2022-29885, CVE-2022-34305, CVE-2022-42252, CVE-2022-45143, CVE-2023-24998, CVE-2023-28708, CVE-2026-24515, CVE-2026-25210 applied in versions: 11.0.18-r0, 9.0.58-r0, 9.0.63-r0, 9.0.64-r0, 9.0.68-r0, 9.0.70-r0, 9.0.71-r0, 9.0.73-r0, 9.0.80-r0	1 Apr 202609:44	–	osv
OSV	CLEANSTART-2026-UZ56639 Security fixes for CVE-2022-23181, CVE-2022-29885, CVE-2022-34305, CVE-2022-42252, CVE-2022-45143, CVE-2023-24998, CVE-2023-28708 applied in versions: 9.0.58-r0, 9.0.63-r0, 9.0.64-r0, 9.0.68-r0, 9.0.70-r0, 9.0.71-r0, 9.0.73-r0, 9.0.80-r0	18 May 202613:47	–	osv
OSV	CLEANSTART-2026-VG23186 Security fixes in tomcat10 9.0.63-r0	30 Jul 202607:10	–	osv
OSV	CLEANSTART-2026-XI02879 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11	30 Jan 202616:18	–	osv
OSV	CLEANSTART-2026-XP03839 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11	30 Jan 202616:14	–	osv
OSV	CLEANSTART-2026-XP58111 When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11	30 Jan 202616:18	–	osv
OSV	CLEANSTART-2026-YI96456 Security fixes in tomcat10 9.0.64-r0	30 Jul 202607:10	–	osv

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-MR27796.json
osv	www.osv.dev/vulnerability/CVE-2022-23181
osv	www.osv.dev/vulnerability/CVE-2022-29885
osv	www.osv.dev/vulnerability/CVE-2022-34305
osv	www.osv.dev/vulnerability/CVE-2022-42252
osv	www.osv.dev/vulnerability/CVE-2022-45143
osv	www.osv.dev/vulnerability/CVE-2023-24998
osv	www.osv.dev/vulnerability/CVE-2023-28708
osv	www.osv.dev/vulnerability/CVE-2025-31650
osv	www.osv.dev/vulnerability/CVE-2025-31651

28 May 2026 22:15Current

7.5High risk

Vulners AI Score7.5

CVSS 25

CVSS 3.19.8

EPSS0.73474

SSVC

tomcat ten security fixes cve-2022-23181 cve-2022-29885 cve-2022-34305 cve-2022-42252 cve-2022-45143 cve-2023-24998 cve-2023-28708 cve-2025-31650 cve-2025-31651