Access Control Bypass

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Access Control Bypass in the HTTP/2 asynchronous servlet processing. An attacker can cause requests and responses to be mixed up between users by exploiting incorre...

Incomplete Cleanup

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Incomplete Cleanup via handshake-wrap state handling in the SecureNioChannel component. A TLS client can trigger intermittent TLS 1.3 connection failures by sending...

Incomplete Cleanup

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Incomplete Cleanup due to incomplete cleanup in the HTTP/2 trailer header process. An attacker can access sensitive information from previous requests by sending...

com.github.psi-probe:psi-probe-core (>=5.4.0, <=5.5.0), com.github.psi-probe:psi-probe-tomcat10 (>=5.4.0, <=5.5.0) +43 more potentially affected by CVE-2026-101356 via org.apache.tomcat:tomcat-coyote (>=10.1.55, <=10.1.60)

org.apache.tomcat:tomcat-coyote MAVEN version =10.1.55, =5.4.0, =5.4.0, =3.5.0, =10.1.55, =10.1.55, =10.1.55, =10.1.55, =10.1.60 - org.apache.tomee.bom:tomee-webprofile 10.2.0 - org.apache.tomee.maven:tomee-embedded-maven-plugin 10.2.0 - org.apache.tomee:apache-tomee 10.2.0 -...

com.github.jspxnet:jspx-framework (>=6.79, <=6.84), com.github.psi-probe:psi-probe-core (>=4.3.0, <=4.7.0) +41 more potentially affected by CVE-2026-93446 via org.apache.tomcat:tomcat-coyote (>=9.0.90, <=9.0.122)

org.apache.tomcat:tomcat-coyote MAVEN version =9.0.90, =6.79, =4.3.0, =4.3.0, =3.5.0, =10.0.0, =3.0.96, =3.0.96, =3.0.96, =0.1.2, =3.0.0-beta-2, =3.6.0 - it.bstz:jsf-autoreload-tomcat 1.0.0 - net.sf.michael-o.tomcat:tomcat90-authnz-spnego-ad 4.3.0 - net.thevpc.nuts:nuts-tomcat-classloader...

com.github.jspxnet:jspx-framework (>=6.79, <=6.84), com.github.psi-probe:psi-probe-core (>=4.3.1, <=4.7.0) +40 more potentially affected by CVE-2026-88041 via org.apache.tomcat:tomcat-coyote (>=9.0.93, <=9.0.122)

org.apache.tomcat:tomcat-coyote MAVEN version =9.0.93, =6.79, =4.3.1, =4.3.1, =3.5.0, =10.0.0, =3.0.96, =3.0.96, =3.0.96, =0.1.2, =3.0.0-rc-1, =1.7.1, =1.7.2 and more Source cves: CVE-2026-88041 Source advisory: MEND:CVE-2026-88041...

ch.qos.logback.access:logback-access-tomcat (>=2.0.7, <=2.0.15), com.atomgraph:linkeddatahub (>=5.5.0, <=5.5.2) +95 more potentially affected by CVE-2026-88041 via org.apache.tomcat:tomcat-coyote (>=10.1.28, <=10.1.60)

org.apache.tomcat:tomcat-coyote MAVEN version =10.1.28, =2.0.7, =5.5.0, =1.0.0, =5.1.1, =5.1.1, =3.5.0, =20260429, =20260429, =2.12.0, =0.2.2, =3.0.0-rc-1, =3.6.0 and more Source cves: CVE-2026-88041 Source advisory: MEND:CVE-2026-88041...

Rocky Linux 10.2 [CIQ] Security Update: tomcat9 / tomcat9-admin-webapps / tomcat9-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_68651)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202668651 advisory. Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication...

Rocky Linux 8 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_68677)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202668677 advisory. tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43512 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not...

Rocky Linux 10.2 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_69259)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202669259 advisory. Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix CVE-2026-32990 tomcat-coyote: Apache Tomcat: Authentication...

MiracleLinux 8 : tomcat-9.0.120-1.el8_10 (AXSA:2026-1899:08)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1899:08 advisory. tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43512 tomcat-coyote: Apache Tomcat: HTTP/2 request headers no...

HTTP Request Smuggling

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to HTTP Request Smuggling via inconsistent HTTP/2 header decoding in HpackDecoder and header processing in Stream. An attacker can trigger a request-header mix-up by...

Improper Check for Certificate Revocation

Overview Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the OpenSSLContext implementations in its OpenSSL and OpenSSL-FFM TLS components. When OpenSSL trust is used and the server key is held in a Java keystore, these implementations ignore...

Improper Check for Certificate Revocation

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the OpenSSLContext implementations in its OpenSSL and OpenSSL-FFM TLS components. When OpenSSL trust is used and the...

HTTP Request Smuggling

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to HTTP Request Smuggling via the Http11Processor in the HTTP/1.x request-processing component. An attacker can cause one request from another user to fail by sending ...

Incorrect Synchronization

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Incorrect Synchronization via the shared header emitter in the HTTP/2 HpackDecoder. An attacker can inject trailer fields into another HTTP/2 request by sending...

Allocation of Resources Without Limits or Throttling

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the AjpProcessor in the AJP connector. An unauthenticated attacker can pin an AJP processing thread and cau...

org.apache.tomee.bom:tomee-webprofile (11.0.0-m1) potentially affected by CVE-2026-86248 via org.apache.tomcat:tomcat-coyote-ffm (11.0.22)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version 11.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-coyote-ffm and may be impacted: - org.apache.tomee.bom:tomee-webprofile 11.0.0-m1 Source cves: CVE-2026-86248 Source...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-86248 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.57)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.2.0 Source cves: CVE-2026-86248 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-21246676...

Incomplete Cleanup

Overview org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Incomplete Cleanup via the StreamProcessor request-recycling path in the HTTP/2 connector. An attacker can cause one request from another user to fail by sending a...