BIT-TOMCAT-2026-79677 Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.0 through 10.1.5...

BIT-TOMCAT-2026-78437 Apache Tomcat: HTTP/2 DoS via malformed request

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially depends on timing cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are...

BIT-TOMCAT-2026-78383 Apache Tomcat: AJP DoS via missing request body

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.0 through 10.1.59, from 9.0.0 through...

BIT-TOMCAT-2026-77791 Apache Tomcat: DoS via busy wait during WebSocket close

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121. The following versions were EOL at the time the...

BIT-TOMCAT-2026-77762 Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request

Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.0 through 10.1.59, from 9.0.39...

BIT-TOMCAT-2026-77756 Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

BIT-TOMCAT-2026-76183 Apache Tomcat: Bypass of security constraints for WebSocket endpoints

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.0 through 10.1.59, from 9.0.0 through 9.0.121. The following versions were EO...

BIT-TOMCAT-2026-75973 Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured

Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web...

BIT-TOMCAT-2026-73581 Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.0 through 10.1.59, from 9.0.0 through 9.0.121. The...

CLEANSTART-2026-RX54054 As mitigation for CVE-2020-1945 Apache Ant 1

Security vulnerability affects the gradle8 package. As mitigation for CVE-2020-1945 Apache Ant 1...

Denial-Of-Service (DoS)

Apache Qpid Proton-J is vulnerable to denial-of-service DoS. The vulnerability is due to improper handling of type size/count values, which allows a pre-authentication attacker to trigger excessive memory allocation and potentially cause a denial of service...

Rate Limiting Bypass

Apache Qpid Broker-J is vulnerable to Rate Limiting Bypass. The vulnerability is due to the broker's inability to govern the rate at which it responds to an echo flow, where the response handling lacks proper throttling and an authenticated attacker can trigger excessive resource usage leading to...

Path Traversal

Apache Ivy is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of module coordinates in the PackagerResolver, where the calculated subdirectory path based on coordinates such as organisation, name, or version is concatenated with the buildRoot directory and an...

Denial Of Service

Apache Neethi is vulnerable to Denial of Service. The vulnerability is due to remote policy references being manually retrieved via the API without size limits, where the library reads data from remote policy references without imposing a maximum size and an attacker can supply a huge policy...

thrift: thrift: Denial of Service via prototype pollution in Node.js bindings

A flaw was found in Apache Thrift's Node.js bindings. Due to improper input validation and prototype pollution—a condition where base JavaScript object properties can be modified—the application fails to safely process incoming data. A remote attacker can exploit this vulnerability by sending...

thrift: thrift: Denial of Service via improper exception handling in TNonblockingServer

A flaw was found in Apache Thrift's D language implementation within the TNonblockingServer component. Due to improper handling of exceptional conditions and improper resource shutdown, an uncaught exception can occur during server operations. A remote, unauthenticated attacker could exploit this...

thrift: thrift: Denial of Service via memory leak in C++ bindings

A flaw was found in Apache Thrift's C++ bindings. A remote attacker can cause a Denial of Service DoS by exploiting a memory leak where allocated system memory is not properly released after use. Over time, repeated requests can exhaust available memory and lead to service instability...

thrift: thrift: Denial of Service via improper message handling in language bindings

A flaw was found in Apache Thrift. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending specially crafted requests to applications utilizing affected language bindings. Flawed input parameter processing and resource allocation can trigger...

thrift: thrift: Denial of Service via TJSONProtocol in Node.js bindings

A flaw was found in Apache Thrift. A remote attacker can exploit this vulnerability by submitting specially crafted messages to applications using the Node.js bindings with TJSONProtocol. Successful exploitation can trigger an infinite loop or cause prototype pollution unintended modification of...

thrift: thrift: Denial of Service via NULL pointer dereference in c_glib bindings

A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service DoS by triggering an application crash due to improper memory handling in the C GLib bindings. This vulnerability stems from an uninitialized variable and a null pointer dereference during data processing...