CVE-2008-1232

CVE-2008-1232 is an XSS vulnerability in Apache Tomcat affecting versions 4.1.0–4.1.37, 5.5.0–5.5.26, and 6.0.0–6.0.16. The root cause is improper validation of user-supplied input used in the HttpServletResponse.sendError method, allowing remote attackers to inject arbitrary web script or HTML v...

CVE-2011-1184

The vulnerability CVE-2011-1184 affects Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12. The HTTP Digest Access Authentication implementation has insufficient replay-attack countermeasures due to lack of proper nonce and nc (nonce-count) checking, which can allow remot...

CVE-2025-49124

CVE-2025-49124 : Untrusted Search Path in Apache Tomcat Windows installer. Tomcat’s Windows installer runs icacls.exe without a full path. Affected: Tomcat 11.0.0-M1–11.0.7, 10.1.0–10.1.41, 9.0.23–9.0.105 (plus some EOL versions). Mitigation: upgrade to 11.0.8, 10.1.42 or 9.0.106. CVSSv3.1 base s...

CVE-2025-52520

The CVE-2025-52520 entry describes an Integer Overflow DoS in Apache Tomcat triggered by certain multipart upload configurations. Affected branches include Tomcat 11.0.x (11.0.0-M1 to 11.0.8) and older 10.1.x (10.1.0-M1 to 10.1.42) and 9.0.x (9.0.0.M1 to 9.0.106); EOL versions may also be affecte...

CVE-2012-5887

The CVE-2012-5887 entry concerns the HTTP Digest Access Authentication in Apache Tomcat (versions 5.5.x before 5.5.36, 6.x before 6.0.36, 7.x before 7.0.30). The vulnerability is a failure to properly check stale nonce values when enforcing credentials, enabling remote attackers to bypass access ...

CVE-2025-66614

CVE-2025-66614 is an improper input validation issue in Apache Tomcat. The vulnerability affects Tomcat versions 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.49, and 9.0.0-M1 through 9.0.112, with older EOL versions (8.5.0–8.5.100) also listed as affected. The root cause is failure to verify...

CVE-2008-2370

CVE-2008-2370 affects Apache Tomcat 4.1.0–4.1.37, 5.5.0–5.5.26, and 6.0.0–6.0.16. When a RequestDispatcher is used, Tomcat performs path normalization before removing the query string, enabling remote attackers to read arbitrary files via a .. sequence in a request parameter (directory traversal)...

CVE-2008-5515

The CVE-2008-5515 entry applies to Apache Tomcat 4.1.0–4.1.39, 5.5.0–5.5.27, and 6.0.0–6.0.18 (and possibly earlier) per the described vulnerability. Root cause: during RequestDispatcher usage, Tomcat normalizes the target pathname before filtering the query string, which can bypass access contro...

CVE-2012-0022

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 are affected by a denial-of-service vulnerability caused by an inefficient handling of HTTP parameters that can be exploited by sending requests with many parameters. The root cause is a hash-collision vulnerability in pa...

CVE-2010-3718

CVE-2010-3718 affects Apache Tomcat 7.0.0–7.0.3, 6.0.x, and 5.5.x when running under a SecurityManager. The vulnerability is that ServletContext attributes are not made read-only, allowing local web applications to read or write files outside the intended working directory via a directory travers...

CVE-2013-2071

CVE-2013-2071 affects Apache Tomcat 7.x prior to 7.0.40, where AsyncContextImpl.java may mishandle a RuntimeException thrown from an AsyncListener, potentially exposing elements of a previous request to a current one when a request is recorded by an application. The vulnerability is rooted in the...

CVE-2026-55955

CVE-2026-55955 describes an improper authentication flaw in Apache Tomcat’s EncryptionInterceptor for Tribes clustering, allowing a replay attack. Affected versions include Tomcat 11.0.0-M1–11.0.22, 10.1.0-M1–10.1.55, 9.0.13–9.0.18, 8.5.38–8.5.100, and 7.0.100–7.0.109. Remediation is to upgrade t...

CVE-2006-3835

CVE-2006-3835 affects Apache Tomcat 5 before 5.5.17. The vulnerability allows remote attackers to list directories by using a semicolon before a filename with a mapped extension, as shown by URLs like /;index.jsp or /;help.do. The initial description confirms the condition; related advisories (GH...

CVE-2007-3385

CVE-2007-3385 affects Apache Tomcat: multiple branches (6.0.x, 5.5.x, 4.1.x, 3.3.x) fail to sanitize the " character sequence and similar encoded sequences in cookie values, potentially leaking session IDs and enabling session hijacking. Affected versions include 6.0.0–6.0.14 (and 5.5.0–5.5.25, 4...

CVE-2009-2693

Apache Tomcat contains a directory-traversal flaw (CVE-2009-2693) affecting Tomcat 5.5.0–5.5.28 and 6.0.0–6.0.20. An attacker can cause creation or overwrite of arbitrary files by including a .. path in a WAR entry, for example ../../bin/catalina.bat. The connected documents reiterate this exact ...

CVE-2012-3546

CVE-2012-3546 affects Apache Tomcat 6.x (before 6.0.36) and 7.x (before 7.0.30). The flaw, in RealmBase/FormAuthenticator when FORM authentication is used, lets remote attackers bypass security-constraint checks by leveraging a prior setUserPrincipal() and appending /j_security_check to the URL. ...

CVE-2010-2227

CVE-2010-2227 : Apache Tomcat versions 5.5.0–5.5.29, 6.0.0–6.0.27, and 7.0.0 beta are affected by improper handling of an invalid Transfer-Encoding header, which can cause a denial of service (outage) or information leakage via a crafted header that interferes with recycling of a buffer. The conn...

CVE-2011-3375

CVE-2011-3375 affects Apache Tomcat 6.0.30–6.0.33 and 7.x before 7.0.22. The root cause is improper caching/recycling of request objects, which can allow remote attackers to read IP addresses and HTTP header information by reading TCP data. The impact is information disclosure of request metadata...

CVE-2025-61795

CVE-2025-61795 is an Apache Tomcat DoS due to improper resource shutdown: when processing multipart uploads, temporary parts on disk may not be cleaned promptly, allowing resource exhaustion. Affects Tomcat 11.x (11.0.0-M1–11.0.11), 10.x (10.1.0-M1–10.1.46), and 9.x (9.0.0.M1–9.0.109); EOL 8.5.x ...

CVE-2026-55276

Apache Tomcat vulnerability CVE-2026-55276 is a logging-only issue caused by an always-incorrect control flow in the effective web.xml, leading to special roles and empty authorization constraints not being shown. Affected products include Tomcat 8.5.0–8.5.100, 9.0.0.M1–9.0.118, 10.1.0-M1–10.1.55...

CVE-2009-2901

The CVE-2009-2901 entry describes an authentication bypass in Apache Tomcat when the autodeployment (autoDeploy) feature is enabled. Affected versions are Tomcat 5.5.0–5.5.28 and 6.0.0–6.0.20, where appBase files left from a failed undeploy can be deployed and used to bypass intended authenticati...

CVE-2010-4172

CVE-2010-4172 affects Apache Tomcat 6.0.12–6.0.29 and 7.0.0–7.0.4, with multiple XSS vulnerabilities in the Tomcat Manager app (sessionsList.jsp via orderBy/sort, and input to sessionDetail.jsp or JspHelper.java) exploitable by remote attackers, related to untrusted web applications. The connecte...

CVE-2011-2204

CVE-2011-2204 affects Apache Tomcat when MemoryUserDatabase logs password data on JMX user creation errors. Affected: Tomcat 5.5.x < 5.5.34, 6.x < 6.0.33, 7.x

CVE-2017-5650

CVE-2017-5650 affects Apache Tomcat 9.0.0.M1–M18 and 8.5.0–8.5.12. The HTTP/2 GOAWAY handling could fail to close streams waiting for a WINDOW_UPDATE, causing those streams to consume threads and enabling a malicious client to exhaust processing threads (DoS). There is no exploitation status in t...

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar example (cal2.jsp) of Apache Tomcat affects 4.0.0–4.0.6, 4.1.0–4.1.31, 5.0.0–5.0.30, and 5.5.0–5.5.15. An attacker can inject arbitrary script via the time parameter to cal2.jsp (and possibly other vectors). This enables script execution in...

CVE-2008-1947

CVE-2008-1947 is an XSS vulnerability in Apache Tomcat, affecting 5.5.9–5.5.26 and 6.0.0–6.0.16. It allows remote attackers to inject arbitrary web script or HTML via the name parameter (the hostname attribute) to host-manager/html/add. The connected documents confirm the affected product/version...

CVE-2013-4444

CVE-2013-4444 is an Unrestricted file upload vulnerability in Apache Tomcat 7.x, prior to 7.0.40, where outdated java.io.File handling and a custom JMX config allow remote attackers to upload and access a JSP file, enabling arbitrary code execution on the vulnerable Tomcat instance. Public detail...

CVE-2007-1358

CVE-2007-1358 is an XSS vulnerability affecting Apache Tomcat 4.x. It allows remote attackers to inject arbitrary script or HTML via crafted Accept-Language headers that do not conform to RFC 2616. Affected product ranges include Tomcat 4.0.0–4.0.6 and 4.1.0–4.1.34. The issue is triggered by impr...

CVE-2009-2902

CVE-2009-2902 is a directory traversal vulnerability in Apache Tomcat, affecting 5.5.0–5.5.28 and 6.0.0–6.0.20. The issue allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename (e.g., a crafted entry like ../../... in a WAR). The connected Nessu...

CVE-2007-3382

The CVE-2007-3382 issue affects multiple Apache Tomcat releases (Tomcat 6.0.0–6.0.13, 5.5.0–5.5.24, 5.0.0–5.0.30, 4.1.0–4.1.36, 3.3–3.3.2). The root cause is that Tomcat treats the single quote (') as a delimiter in cookies, which can lead to leakage of sensitive data such as session IDs and enab...

CVE-2011-0013

CVE-2011-0013 describes XSS in the HTML Manager Interface of Apache Tomcat: affected are Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the display-name tag. Mitigation is upgrading to the fix...

CVE-2012-4534

The CVE-2012-4534 issue affects Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28. When using the NIO connector with sendfile over HTTPS, the NioEndpoint can enter an infinite loop if the client terminates the connection while reading a response, causing a denial of service. The root cause is...

CVE-2026-59084

CVE-2026-59084 affects Apache Tomcat across multiple branches (11.x, 10.x, 9.x, 8.x, 7.x) where EncryptInterceptor configuration requirements were not clearly documented, per NVD and related sources. Root cause: insufficient technical documentation for EncryptInterceptor configuration. Impact sta...

CVE-2014-0033

CVE-2014-0033 affects Apache Tomcat 6.0.33–6.0.37, where the disableURLRewriting setting is not honored when a session ID is in a URL. This could allow remote attackers to hijack a valid user’s session via a crafted link. The vulnerability is documented in IBM advisories and the GHSA entry, which...

CVE-2008-0128

Apache Tomcat 5.x before 5.5.21 is affected by CVE-2008-0128: when the SingleSignOn valve is used over HTTPS, the JSESSIONIDSSO cookie is not marked secure, allowing it to be sent over HTTP and potentially captured by an attacker via a crafted HTTP request. This information is supported by multip...

CVE-2012-5885

Affected software: Apache Tomcat (5.5.x up to 5.5.36, 6.x up to 6.0.36, 7.x up to 7.0.30) using the HTTP Digest Access Authentication replay-countermeasure. Root cause: replay-countermeasure tracks cnonce values instead of server nonce and nonce-count, enabling bypass of access restrictions when ...

CVE-2007-1355

CVE-2007-1355 corresponds to multiple cross-site scripting (XSS) vulnerabilities in the Tomcat sample web app (appdev/sample/web/hello.jsp). Affected are Tomcat versions 4.0.0–4.0.6, 4.1.0–4.1.36, 5.0.0–5.0.30, 5.5.0–5.5.23, and 6.0.0–6.0.10. The issue allows remote attackers to inject arbitrary ...

CVE-2007-3386

CVE-2007-3386 is a cross-site scripting (XSS) vulnerability in the Host Manager Servlet of Apache Tomcat, affected in Tomcat 6.0.0–6.0.13 and 5.5.0–5.5.24. An attacker can inject arbitrary HTML/script by sending crafted requests, demonstrated via the aliases parameter to an html/add action. Conne...

CVE-2008-5519

The CVE refers to the mod_jk (JK Connector) for Apache Tomcat, affected in the 1.2.0–1.2.26 range. The root cause is an error in handling certain HTTP requests, enabling an attacker to obtain sensitive information via Content-Length-related scenarios (e.g., a request with Content-Length but no PO...

CVE-2025-55754

CVE-2025-55754 affects Apache Tomcat: improper neutralization of ANSI escape sequences in log messages could enable console/clipboard manipulation via crafted URLs. Affected: Tomcat 11.x (11.0.0-M1 to 11.0.10), 10.x (10.1.0-M1 to 10.1.44), 9.x (9.0.40 to 9.0.108), plus some EOL versions. Remediat...

CVE-2007-2450

CVE-2007-2450 refers to multiple cross-site scripting (XSS) vulnerabilities in the Manager and Host Manager web applications of Apache Tomcat. The description in the initial document states that remote authenticated users can inject arbitrary web script or HTML via a parameter name to /manager/ht...

CVE-2007-5342

CVE-2007-5342 affects Apache Tomcat versions 5.5.9–5.5.25 and 6.0.0–6.0.15 where the default catalina.policy for the JULI logging component fails to restrict permissions for web applications. The underly­ing issue is that untrusted web apps can modify logging configuration options and overwrite a...

CVE-2011-5064

The vulnerability CVE-2011-5064 affects Apache Tomcat’s HTTP Digest Access Authentication (DigestAuthenticator.java) where Catalina is used as the hard-coded server secret (private key). Affected are Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12. This weakness enables remot...

CVE-2005-4836

CVE-2005-4836 affects Apache Tomcat 4.1.15–4.1.40. The HTTP/1.1 connector may fail to reject NULL bytes in a URL when allowLinking is enabled, enabling a remote attacker to read JSP source files and obtain sensitive information. Multiple connected sources corroborate the same description and clas...

CVE-2011-0534

CVE-2011-0534 affects Apache Tomcat 7.0.0–7.0.6 and 6.0.0–6.0.30. The issue arises because maxHttpHeaderSize is not enforced for NIO HTTP connector requests, enabling remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request. Affected products are Tomcat 7/6 family as...

CVE-2011-2526

CVE-2011-2526 affects Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19. When sendfile is enabled for the HTTP APR or HTTP NIO connector, Tomcat may not validate certain request attributes, allowing a local attacker to bypass file access restrictions or trigger a denial ...

CVE-2012-5886

CVE-2012-5886 (Apache Tomcat) is an authentication bypass issue in the Digest Access Authentication implementation. It occurs because the HTTP Digest Auth stores information about the authenticated user in the session state, enabling remote attackers to bypass authentication by exploiting session...

CVE-2012-2733

CVE-2012-2733 involves Apache Tomcat’s HTTP NIO connector (java/org/apache/coyote/http11/InternalNioInputBuffer.java). The flaw does not properly restrict the request-header size in Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, allowing remote attackers to trigger memory consumption and cause a...

CVE-2005-4838

CVE-2005-4838 corresponds to cross-site scripting vulnerabilities in Apache Tomcat 5.5.6 and earlier, manifested in the JSP2 example pages (el/functions.jsp, el/implicit-objects.jsp, jspx/textRotate.jspx under examples/jsp2/), exploitable via a crafted request to snp/snoop.jsp. The issue is trigg...

CVE-2011-5063

CVE-2011-5063 describes an issue in Apache Tomcat’s HTTP Digest Access Authentication where the realm values are not checked, enabling bypass of access controls by exploiting a protection space with weaker requirements (distinct from CVE-2011-1184). Related documents (CVE-2011-1184, CVE-2012-5885...