The vulnerability of the pathInfo URI component of the Apache Tomcat application server allows attackers to circumvent existing security restrictions.

The vulnerability of the pathInfo URI component of the Apache Tomcat application server is related to improper handling of registrations. Exploiting this vulnerability allows an attacker to bypass existing security restrictions remotely...

Linux Distros Unpatched Vulnerability : CVE-2016-3092

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x...

The vulnerability of the Apache Tomcat application server arises from bypassing the authentication process by using an alternative path or channel, allowing attackers to compromise the confidentiality of the protected information.

The vulnerability of the Apache Tomcat application server arises from bypassing authentication procedures by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality of the protected information...

Linux Distros Unpatched Vulnerability : CVE-2017-5664

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the...

Important: tomcat9

Issue Overview: Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from...

Linux Distros Unpatched Vulnerability : CVE-2022-42252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting...

Linux Distros Unpatched Vulnerability : CVE-2018-1305

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only...

K000152908: Apache Tomcat vulnerabilities CVE-2025-52434 and CVE-2025-53506

Security Advisory Description CVE-2025-52434 Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issu...

DoS (Denial of Service) Third-Party Dependency in Bamboo Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 9.6.0, 10.2.0, and 11.0.0 of Bamboo Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

DoS (Denial of Service) Third-Party Dependency in Bamboo Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 9.6.0, 10.2.0, and 11.0.0 of Bamboo Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

Linux Distros Unpatched Vulnerability : CVE-2025-52520

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This...

Linux Distros Unpatched Vulnerability : CVE-2024-52318

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade...

Linux Distros Unpatched Vulnerability : CVE-2018-8034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0....

Linux Distros Unpatched Vulnerability : CVE-2020-1938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher...

Fixed in Apache Tomcat 10.1.44

Important: DoS in HTTP/2 due to client triggered stream reset CVE-2025-48989 Tomcat's HTTP/2 implementation was vulnerable to the made you reset attack. The denial of service typically manifested as an OutOfMemoryError. This was fixed with commit 73c04a10. This issue was reported to the ASF...

Advisory ROSA-SA-2025-2944

software: tomcat 9.0.37 WASP: ROSA-CHROME unaffected versions = tomcat-9.0.37-10 affected versions tomcat-9.0.37-10 CVE-ID: CVE-2024-24549 BDU-ID: 2024-02608 CVE-Crit: HIGH CVE-DESC.: An Apache Tomcat application server vulnerability is related to insufficient input validation. Exploitation of th...

Exploit for Deserialization of Untrusted Data in Apache Tomcat

CVE-2025-24813 Exploit Toolkit This is an advanced and automa...

KLA86659 DoS vulnerability in Apache Tomcat

Denial of service vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to cause denial of service. Original advisories Fixed in Apache Tomcat 9.0.108 Related products Apache-Tomcat CVE list CVE-2025-48989 critical Solution Update to the latest version Tomcat 9....

Fixed in Apache Tomcat 9.0.108

Important: DoS in HTTP/2 due to client triggered stream reset CVE-2025-48989 Tomcat's HTTP/2 implementation was vulnerable to the made you reset attack. The denial of service typically manifested as an OutOfMemoryError. This was fixed with commit f36b8a4e. This issue was reported to the ASF...

Linux Distros Unpatched Vulnerability : CVE-2021-30639

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling...