CVE-2026-65182

Apache Tomcat is vulnerable to an Improper Access Control and Incorrect Authorization flaw where security constraints can be bypassed. This occurs if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. The vulnerability affects versions 11.0.0-...

CVE-2014-0230

CVE-2014-0230 affects Apache Tomcat: 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9. The issue occurs when an HTTP response is sent before the server finishes reading the entire request body, enabling remote attackers to trigger a denial-of-service via a series of aborted upload attem...

CVE-2015-5345

CVE-2015-5345 affects the Tomcat Mapper component: redirects are processed before security constraints/Filters, enabling a remote attacker to determine the existence of a directory via a URL that lacks a trailing slash. Affected upstream versions are Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8...

CVE-2016-6797

CVE-2016-6797 stems from Apache Tomcat’s ResourceLinkFactory not restricting web app access to global JNDI resources, allowing a web application to access any global JNDI resource regardless of explicit ResourceLink. Affects Tomcat 6.x/7.x/8.x/9.x releases listed in the entry (various 6.0–9.0 lin...

CVE-2024-52317

Apache Tomcat contains an incorrect object re-cycling and re-use vulnerability in its HTTP/2 implementation. The root cause is the improper recycling of request and response resources, which can lead to a request and/or response mix-up between different users. This vulnerability is particularly c...

CVE-2026-43515

Apache Tomcat is affected by an Improper Authorization vulnerability (CVE-2026-43515) occurring when multiple method constraints define an HTTP method for the same extension. This flaw allows for potential security bypasses. Affected versions include 11.0.0-M1 through 11.0.21 , 10.1.0-M1 through ...

CVE-2024-54677

An uncontrolled resource consumption vulnerability exists in the examples web application provided with Apache Tomcat , which can lead to a denial of service (DoS) . This issue affects versions 11.0.0-M1 through 11.0.1 , 10.1.0-M1 through 10.1.33 , and 9.0.0.M1 through 9.9.97 . End-of-life (EOL) ...

CVE-2016-0762

CVE-2016-0762 affects Apache Tomcat realms across multiple branches (Tomcat 9.0.x, 8.5.x, 8.0.x, 7.0.x, 6.0.x). The root cause: Realm implementations did not process the supplied password when the username did not exist, enabling a timing attack to determine valid usernames. The default LockOutRe...

CVE-2026-50229

A Basic XSS vulnerability exists in the number guess example of the Apache Tomcat application server due to the improper neutralization of script-related HTML tags in a web page. This flaw allows a malicious actor to execute arbitrary code remotely, as noted in specific technical documentation. A...

CVE-2026-24734

CVE-2026-24734 is an Improper Input Validation vulnerability affecting Apache Tomcat Native and Apache Tomcat itself. When using an OCSP responder, Tomcat Native (and the Tomcat Native FFM port) may not perform verification or freshness checks on OCSP responses, potentially allowing certificate r...

CVE-2026-43512

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.Older unsupported versio...

CVE-2014-7810

Summary: CVE-2014-7810 affects the EL implementation in Apache Tomcat. The vulnerability arises when the EL evaluator may evaluate against an interface that is accessible via an inaccessible class, allowing bypass of SecurityManager protections in a web application. Affected products/versions (pe...

CVE-2016-1240

This CVE (CVE-2016-1240) affects the Tomcat init scripts in Debian/Ubuntu packages, allowing local users with Tomcat access to gain root via a symlink attack on the Catalina log file (e.g., /var/log/tomcat7/catalina.out). Affected packages and versions include: tomcat7 before 7.0.56-3+deb8u4 and ...

CVE-2026-53404

Apache Tomcat's rewrite valve is vulnerable to an Always-Incorrect Control Flow Implementation (CWE-670) where matching the first condition in an OR chain causes subsequent non-OR conditions to be skipped. This flaw allows attackers to circumvent access control restrictions . The issue impacts ve...

CVE-2021-30639

Apache Tomcat CVE-2021-30639 describes a DoS vulnerability caused by improper error handling during non-blocking I/O, where the error flag on a Request object isn’t reset between requests. This can allow a remote attacker to trigger non-blocking I/O errors (e.g., by dropping connections) and caus...

CVE-2026-29145

The Apache Tomcat and Apache Tomcat Native application servers are vulnerable to a flaw where CLIENT_CERT authentication does not fail as expected in certain scenarios when soft fail is disabled. This authentication deficiency can allow attackers to bypass security controls or escalate privileges...

CVE-2016-6794

CVE-2016-6794 affects Apache Tomcat across multiple branches (7.x, 8.x, 9.x) and versions, where the system property replacement feature for configuration files can bypass a configured SecurityManager to read restricted system properties. Connected advisories show concrete impact and suggested fi...

CVE-2012-3544

CVE-2012-3544 detail (Tomcat): Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 fails to properly handle chunk extensions in chunked transfer coding, allowing remote attackers to trigger a denial-of-service by streaming data. Affected: Tomcat 6.x up to 6.0.36, Tomcat 7.x up to 7.0.29. Impact...

CVE-2014-0075

Apache Tomcat exposes a vulnerability CVE-2014-0075: an integer overflow in parseChunkHeader() within ChunkedInputFilter.java allows remote attackers to trigger DoS via malformed chunk sizes in chunked transfer encoding. Affected products include Tomcat 6.x before 6.0.40, 7.x before 7.0.53, and 8...

CVE-2026-55957

Apache Tomcat is vulnerable to an authentication bypass in the JNDIRealm component. When configured to authenticate binds using GSSAPI , a missing critical step allows attackers to authenticate without providing the correct password. This affects versions 11.0.0-M1 through 11.0.4, 10.1.0-M1 throu...

CVE-2008-2938

CVE-2008-2938 is a directory-traversal vulnerability in Apache Tomcat (affected: 4.1.0–4.1.37, 5.5.0–5.5.26, 6.0.0–6.0.16) that occurs when allowLinking and URIEncoding="UTF-8" are enabled. Exploitation could allow a remote attacker to read arbitrary server files via encoded traversal sequences i...

CVE-2016-0706

CVE-2016-0706 affects Apache Tomcat. Root cause: StatusManagerServlet not on RestrictedServlets.properties, enabling remote authenticated users to bypass SecurityManager and read arbitrary HTTP requests, potentially exposing session IDs. Affected versions include Tomcat 6.x before 6.0.45, 7.x bef...

CVE-2011-3190

CVE-2011-3190 refers to Apache Tomcat AJP connector handling vulnerabilities where certain implementations could spoof AJP requests and cause a request body to be interpreted as a new request, enabling authentication bypass and potential leakage of sensitive information. The description covers af...

CVE-2007-5461

CVE-2007-5461 is an absolute path traversal vulnerability in the Apache Tomcat WebDAV servlet. Affected versions span Tomcat 4.x, 5.x (including 5.0.x, 5.5.x up to 5.5.25) and 6.0.x (up to 6.0.14) under certain configurations, enabling remote authenticated users to read arbitrary files via a WebD...

CVE-2015-5351

CVE-2015-5351 affects Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2. The issue lies in the Manager and Host Manager applications, which establish sessions and send CSRF tokens for arbitrary new requests, allowing remote attackers to bypass CSRF protections by using a...

CVE-2016-0763

CVE-2016-0763 affects Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3. The issue is in ResourceLinkFactory.setGlobalContext: callers are not checked for authorization, allowing remote authenticated users to bypass SecurityManager restrictions and read/write arbitrary a...

CVE-2013-2185

CVE-2013-2185 involves DiskFileItem in Apache Commons FileUpload used with Red Hat JBoss EAP 6.1.0 and JBoss Portal 6.0.0. The issue stems from deserialization of a serialized DiskFileItem where a NULL byte in a filename can let a remote attacker write to arbitrary files. The description notes a ...

CVE-2014-0119

CVE-2014-0119 (Tomcat XXE) – Concrete details from connected docs : The vulnerability affects Apache Tomcat versions before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6. It arises from improper constraining of the class loader that accesses the XML parser used with an XSLT stylesheet, enabling...

CVE-2025-48989

Apache Tomcat is vulnerable to an Improper Resource Shutdown or Release vulnerability, specifically an HTTP/2 "MadeYouReset" DoS attack through HTTP/2 control frames. This issue affects versions 11.0.0-M1 through 11.0.9 , 10.1.0-M1 through 10.1.43 , and 9.0.0.M1 through 9.0.107 , as well as older...

CVE-2007-2449

CVE-2007-2449 corresponds to cross-site scripting in Apache Tomcat's examples web application JSP files. Affected: Tomcat 4.0.0–4.0.6, 4.1.0–4.1.36, 5.0.0–5.0.30, 5.5.0–5.5.24, 6.0.0–6.0.13. Root cause: improper validation of user-supplied input in the JSP examples, allowing injected script via t...

CVE-2007-5333

Affected software: Apache Tomcat 4.1.0–4.1.36, 5.5.0–5.5.25, 6.0.0–6.0.14. The vulnerability (CVE-2007-5333) arises from improper handling of (1) double quote (" ) characters and (2) %5C-encoded backslash sequences in cookie values, which can leak session IDs and enable session hijacking. It exis...

CVE-2017-5651

CVE-2017-5651 concerns Apache Tomcat 9.0.0.M1–9.0.0.M18 and 8.5.0–8.5.12, where a refactoring of HTTP connectors caused a regression in the send-file processing. If processing completes quickly, the same Processor could be added to the processor cache twice, potentially using the same Processor f...

CVE-2016-6796

CVE-2016-6796 affects Apache Tomcat across multiple lines: a malicious web application could bypass the SecurityManager by manipulating the configuration parameters for the JSP Servlet. Affected versions include Tomcat 9.0.0.M1–9.0.0.M9, 8.5.0–8.5.4, 8.0.0.RC1–8.0.36, 7.0.0–7.0.70, and 6.0.0–6.0....

CVE-2026-55276

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from ...

CVE-2017-15706

CVE-2017-15706 concerns Apache Tomcat: the CGI Servlet documentation for the CGI search algorithm was incorrect, causing some scripts to fail or be executed unexpectedly, while the servlet’s runtime behavior remained unchanged. Public sources in the connected docs confirm this is tied to the CGI ...

CVE-2009-3548

CVE-2009-3548 affects the Windows installer for Apache Tomcat (versions 6.0.0–6.0.20 and 5.5.0–5.5.28, possibly earlier). The underlying issue is a blank default password for the administrative user, which can be exploited remotely to gain administrative privileges. The linked connected documents...

CVE-2014-0099

Apache Tomcat contains an integer overflow in Ascii.java that, when behind a reverse proxy, enables HTTP request smuggling via a crafted Content-Length header. Affected versions are Tomcat 6.0.x before 6.0.40, Tomcat 7.x before 7.0.53, and Tomcat 8.x before 8.0.4. The provided documents do not sp...

CVE-2014-0227

CVE-2014-0227 affects Apache Tomcat: ChunkedInputFilter mishandles reads after an error, enabling HTTP request smuggling or DoS via malformed chunked data. Affected: Tomcat 6.x before 6.0.42, 7.x before 7.0.55, 8.x before 8.0.9. Remediation: upgrade to fixed releases (6.0.42+, 7.0.55+, 8.0.9+). E...

CVE-2025-66614

CVE-2025-66614 is an improper input validation issue in Apache Tomcat. The vulnerability affects Tomcat versions 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.49, and 9.0.0-M1 through 9.0.112, with older EOL versions (8.5.0–8.5.100) also listed as affected. The root cause is failure to verify...

CVE-2025-53506

Apache Tomcat is vulnerable to an uncontrolled resource consumption vulnerability when an HTTP/2 client fails to acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects versions 11.0.0-M1 through 11.0.8 , 10.1.0-M1 through 10.1.42 , and 9.0...

CVE-2025-52434

Apache Tomcat is vulnerable to a race condition caused by concurrent execution using shared resources with improper synchronization when using the APR/Native connector . This issue is specifically observable during client-initiated closures of HTTP/2 connections . The vulnerability affects versio...

CVE-2014-0096

CVE-2014-0096 affects Apache Tomcat: DefaultServlet.jspXXE via XML External Entity in XSLT; tracked in Tomcat 6/7/8 lines (older than 6.0.40, 7.x < 7.0.53, 8.x

CVE-2009-0580

CVE-2009-0580 affects Apache Tomcat 4.1.0–4.1.39, 5.5.0–5.5.27, and 6.0.0–6.0.18 when FORM authentication is used. A remote attacker can enumerate valid usernames by sending requests to /j_security_check with malformed URL encoding of the password, due to improper error checking in the MemoryReal...

CVE-2009-0783

CVE-2009-0783 affects multiple Apache Tomcat lines (4.1.0–4.1.39, 5.5.0–5.5.27, 6.0.0–6.0.18). The issue allows a local attacker to replace the XML parser used by web applications, enabling reading or modification of other applications’ files such as (1) web.xml, (2) context.xml, or (3) tld files...

CVE-2017-7675

The CVE-2017-7675 entry concerns Apache Tomcat, where the HTTP/2 implementation in Tomcat 9.0.0.M1–9.0.0.M21 and 8.5.0–8.5.15 bypassed security checks that prevented directory traversal via a specially crafted URL. This could bypass security constraints. The provided documents identify affected T...

CVE-2025-49124

The Apache Tomcat installer for Windows is vulnerable to an untrusted search path (CWE-426) because it executes icacls.exe without specifying its full path. This flaw allows for potential arbitrary code execution via executable side-loading. Affected versions include 11.0.0-M1 through 11.0.7 , 10...

CVE-2010-1157

CVE-2010-1157 affects Apache Tomcat 5.5.0–5.5.29 and 6.0.0–6.0.26. The vulnerability allows an attacker to disclose the server’s hostname or IP by sending a request for a resource that requires BASIC or DIGEST authentication and then reading the realm field in the WWW-Authenticate header. The pro...

CVE-2011-4858

CVE-2011-4858 affects Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23. The issue arises from the Java hashCode() implementation allowing predictable hash collisions, enabling a remote attacker to exhaust CPU by sending many crafted parameters in a request (hash collisi...

CVE-2016-6817

CVE-2016-6817 affects the HTTP/2 header parser in Apache Tomcat 9.0.0.M1–M11 and 8.5.0–8.5.6, which can enter an infinite loop when a header exceeds the available buffer, enabling a denial-of-service. The connected documents specify remediation by upgrading to fixed releases: Tomcat 9.0.0.M13 or ...

CVE-2009-0781

CVE-2009-0781 is an XSS vulnerability in Apache Tomcat’s calendar example (jsp/cal/cal2.jsp). The issue affects Tomcat 4.1.0–4.1.39, 5.5.0–5.5.27, and 6.0.0–6.0.18, allowing remote attackers to inject arbitrary script or HTML via the time parameter in the URL (described as related to invalid HTML...