BIT-TOMCAT-2026-50229 Apache Tomcat: XSS in number guess example

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.22, from 10.1.0 through 10.1.55, from 9.0.0 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0...

BIT-TOMCAT-2026-43515 Apache Tomcat: Security constraints not correctly applied

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 throu...

BIT-TOMCAT-2026-43514 Apache Tomcat: AJP secret compared in non-constant time

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may al...

BIT-TOMCAT-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive

Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also...

BIT-TOMCAT-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any...

BIT-TOMCAT-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended to upgrade to versio...

BIT-TOMCAT-2026-34487 Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0 through 11.0.20, from 10.1.0 through 10.1.53, from 9.0.13 through 9.0.116. Users are...

BIT-TOMCAT-2026-34483 Apache Tomcat: Incomplete escaping of JSON access logs

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.20, from 10.1.0 through 10.1.53, from 9.0.40 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or...

BIT-TOMCAT-2026-25854 Apache Tomcat: Occasionally open redirect

Occasional URL redirection to untrusted Site 'Open Redirect' vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0 through 11.0.18, from 10.1.0 through 10.1.52, from 9.0.0 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported...

BIT-TOMCAT-2026-24880 Apache Tomcat: Request smuggling via invalid chunk extension

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0 through 11.0.18, from 10.1.0 through 10.1.52, from 9.0.0 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0...

BIT-TOMCAT-2026-24733 Apache Tomcat: Security constraint bypass with HTTP/0.9

Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a specification inval...

BIT-TOMCAT-2025-66614 Apache Tomcat: Client certificate verification bypass due to virtual host mapping

Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0 through 11.0.14, from 10.1.0 through 10.1.49, from 9.0.0 through 9.0.112. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions...

Apache Tomcat EncryptInterceptor Data Compromise

The vulnerability of the EncryptInterceptor component in the Apache Tomcat application server is related to insufficient technical documentation. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...

Security update for tomcat10

This update for tomcat10 fixes the following issues: CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority...

SUSE-SU-2026:4119-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: Apache Tomcat: HTTP/2...

ROOT-APP-MAVEN-CVE-2023-34981 CVE-2023-34981 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2023-34981 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

Security update for tomcat11

This update for tomcat11 fixes the following issues: CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. CVE-2026-65637: Apache Tomcat: HTTP/2 no-authority...

SUSE-SU-2026:4114-1 Security update for tomcat11

This update for tomcat11 fixes the following issues: - CVE-2026-65182: Apache Tomcat: Bypass longest prefix security constraint bsc1276893. - CVE-2026-65183: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets bsc1276894. - CVE-2026-65637: Apache Tomcat: HTTP/2...

K000163240: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2026-65183 Time-of-check Time-of-use TOCTOU Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from...

K000163239: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2026-65182 Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache...