CVE-2026-68569

Apache Tomcat contains an Improper Authentication vulnerability (CVE-2026-68569 ) where users may be authenticated even if they do not exist in the DataSourceRealm under certain circumstances, such as when using CLIENT-CERT or SPNEGO . This issue impacts versions 11.0.0-M1 through 11.0.24 , 10.1....

CVE-2026-43514

Apache Tomcat is vulnerable to an Observable Timing Discrepancy when comparing AJP secrets . This flaw allows a remote attacker to potentially gain unauthorized access to protected information by exploiting timing mismatches during the secret comparison process. Affected versions include 11.0.0-M...

CVE-2008-1947

CVE-2008-1947 is an XSS vulnerability in Apache Tomcat, affecting 5.5.9–5.5.26 and 6.0.0–6.0.16. It allows remote attackers to inject arbitrary web script or HTML via the name parameter (the hostname attribute) to host-manager/html/add. The connected documents confirm the affected product/version...

CVE-2008-5519

The CVE refers to the mod_jk (JK Connector) for Apache Tomcat, affected in the 1.2.0–1.2.26 range. The root cause is an error in handling certain HTTP requests, enabling an attacker to obtain sensitive information via Content-Length-related scenarios (e.g., a request with Content-Length but no PO...

CVE-2014-0033

CVE-2014-0033 affects Apache Tomcat 6.0.33–6.0.37, where the disableURLRewriting setting is not honored when a session ID is in a URL. This could allow remote attackers to hijack a valid user’s session via a crafted link. The vulnerability is documented in IBM advisories and the GHSA entry, which...

CVE-2026-29129

The Apache Tomcat application server is vulnerable to a flaw where the configured cipher preference order is not preserved . This issue is specifically linked to the addition of the ability to configure TLS 1.3 cipher suites , which fails to maintain the user-defined order of ciphers and cipher s...

CVE-2007-5342

CVE-2007-5342 affects Apache Tomcat versions 5.5.9–5.5.25 and 6.0.0–6.0.15 where the default catalina.policy for the JULI logging component fails to restrict permissions for web applications. The underly­ing issue is that untrusted web apps can modify logging configuration options and overwrite a...

CVE-2007-2450

CVE-2007-2450 refers to multiple cross-site scripting (XSS) vulnerabilities in the Manager and Host Manager web applications of Apache Tomcat. The description in the initial document states that remote authenticated users can inject arbitrary web script or HTML via a parameter name to /manager/ht...

CVE-2012-5885

Affected software: Apache Tomcat (5.5.x up to 5.5.36, 6.x up to 6.0.36, 7.x up to 7.0.30) using the HTTP Digest Access Authentication replay-countermeasure. Root cause: replay-countermeasure tracks cnonce values instead of server nonce and nonce-count, enabling bypass of access restrictions when ...

CVE-2011-0534

CVE-2011-0534 affects Apache Tomcat 7.0.0–7.0.6 and 6.0.0–6.0.30. The issue arises because maxHttpHeaderSize is not enforced for NIO HTTP connector requests, enabling remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request. Affected products are Tomcat 7/6 family as...

CVE-2012-2733

CVE-2012-2733 involves Apache Tomcat’s HTTP NIO connector (java/org/apache/coyote/http11/InternalNioInputBuffer.java). The flaw does not properly restrict the request-header size in Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, allowing remote attackers to trigger memory consumption and cause a...

CVE-2012-5886

CVE-2012-5886 (Apache Tomcat) is an authentication bypass issue in the Digest Access Authentication implementation. It occurs because the HTTP Digest Auth stores information about the authenticated user in the session state, enabling remote attackers to bypass authentication by exploiting session...

CVE-2005-4838

CVE-2005-4838 corresponds to cross-site scripting vulnerabilities in Apache Tomcat 5.5.6 and earlier, manifested in the JSP2 example pages (el/functions.jsp, el/implicit-objects.jsp, jspx/textRotate.jspx under examples/jsp2/), exploitable via a crafted request to snp/snoop.jsp. The issue is trigg...

CVE-2005-4836

CVE-2005-4836 affects Apache Tomcat 4.1.15–4.1.40. The HTTP/1.1 connector may fail to reject NULL bytes in a URL when allowLinking is enabled, enabling a remote attacker to read JSP source files and obtain sensitive information. Multiple connected sources corroborate the same description and clas...

CVE-2011-1088

CVE-2011-1088 affects Apache Tomcat 7.x prior to 7.0.10 (and related entries reference 7.0.11 in follow‑ups). The issue: Tomcat does not follow ServletSecurity annotations when a web.xml has no security constraints, allowing remote attackers to bypass the intended access restrictions via HTTP req...

CVE-2011-5062

CVE-2011-5062 affects Apache Tomcat’s HTTP Digest Access Authentication. The vulnerability arises because Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 do not check qop values, enabling remote attackers to bypass intended integrity protections via a qop=auth value. This is ...

CVE-2008-0002

CVE-2008-0002 affects Apache Tomcat 6.0.0–6.0.15 and relates to parameter processing during an exception. The issue may disclose sensitive information when parameters are processed in the context of the wrong request, demonstrated by disconnecting during processing to trigger the exception. This ...

CVE-2026-34500

Apache Tomcat contains a vulnerability where CLIENT_CERT authentication fails to behave as expected in specific scenarios when soft fail is disabled and FFM is utilized. This issue affects versions 11.0.0-M14 through 11.0.20 , 10.1.22 through 10.1.53 , and 9.0.92 through 9.0.116 . The vulnerabili...

CVE-2026-65927

Apache Tomcat is vulnerable to an off-by-one error impacting the [N] flag on rewrite valves . This flaw causes rewrite processing to restart at the second rule rather than the first rule, which may lead to access control bypass . Affected versions include 11.0.0-M1 through 11.0.24, 10.1.0-M1 thro...

CVE-2006-7195

CVE-2006-7195 is an XSS vulnerability in Apache Tomcat’s implicit-objects.jsp. The initial description states it affects Tomcat 5.0.0–5.0.30 and 5.5.0–5.5.17, allowing remote attackers to inject arbitrary scripts/HTML via certain HTTP header values. The connected documents confirm a Tomcat XSS is...

CVE-2026-65183

A Time-of-check Time-of-use (TOCTOU) race condition exists in Apache Tomcat when creating unix domain sockets, potentially allowing an unauthorized local user to access the socket. Affected versions include 11.0.0-M1 through 11.0.24 , 10.1.0-M1 through 10.1.57 , and 9.0.42 through 9.0.120 . Remed...

CVE-2011-2729

CVE-2011-2729 affects the Jakarta Commons Daemon jsvc component in Tomcat runtimes (Tomcat 5.5.32–5.5.33, 6.0.30–6.0.32, and 7.0.x before 7.0.20) where jsvc did not properly drop capabilities. This allows a remote attacker to bypass read permissions for files via an application request. The root ...

CVE-2016-9774

The CVE-2016-9774 issue affects the postinst scripts of tomcat6, tomcat7, and tomcat8 across multiple Debian/Ubuntu releases (e.g., Debian wheezy, Ubuntu 12.04/14.04, Debian jessie, Ubuntu 16.04/16.10, and Ubuntu 17.04). The root cause is a symlink attack on the Catalina localhost directory durin...

CVE-2026-66422

Apache Tomcat is susceptible to an improper authorization vulnerability where security-role-ref definitions are incorrectly utilized as role aliases within the Realm, alongside their intended use with Request.isUserInRole() . This flaw affects versions 11.0.0-M1 through 11.0.24 , 10.1.0-M1 throug...

CVE-2011-1183

CVE-2011-1183 affects Apache Tomcat 7.0.11 and related 7.x releases where, if web.xml has no login configuration, security constraints are not followed. This allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. The issue is noted as a consequence ...

CVE-2005-3510

CVE-2005-3510 affects Apache Tomcat 5.5.0–5.5.11, allowing a DoS via a huge number of simultaneous directory-list requests, causing CPU exhaustion. The Red Hat advisory RHSA-2010:0602 notes remediation by upgrading the Tomcat component in Red Hat Certificate System to version 5.5.23. Other OSV en...

CVE-2000-0672

The CVE-2000-0672 issue concerns the default configuration of Jakarta Tomcat which does not restrict access to the /admin context, enabling a remote attacker to read arbitrary files by invoking administrative servlets to add a context for the root directory. The vulnerability affects the admin co...

CVE-2011-2481

CVE-2011-2481 affects Apache Tomcat 7.0.x prior to 7.0.17. A crafted application loaded earlier than the target can replace the XML parser used by other web applications, allowing local users to read or modify (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications. This vuln...

CVE-2016-8747

The CVE-2016-8747 issue affects Apache Tomcat 8.5.7–8.5.9 and 9.0.0.M11–9.0.0.M15 in reverse-proxy configurations, where Http11InputBuffer.java can let a remote attacker read data belonging to a different request. The underlying problem is an information-disclosure vulnerability in the Tomcat rev...

CVE-2026-73180

Apache Tomcat is affected by an Insufficient Session Expiration vulnerability (CWE-613) where a WebSocket session remains open even after the underlying authenticated HTTP session ends, specifically if the session ID is changed. This occurs because the server fails to close the WebSocket connecti...

CVE-2011-1475

CVE-2011-1475 affects Apache Tomcat 7.0.x prior to 7.0.12. The HTTP BIO connector mishandles HTTP pipelining, allowing remote attackers to read responses intended for other clients by examining HTTP packet data, due to a mix-up of responses for requests from different users. Impact is information...

CVE-2026-24733

Apache Tomcat is vulnerable to an improper input validation issue where the server fails to restrict HTTP/0.9 requests to the GET method. If a security constraint is configured to allow HEAD requests while denying GET requests on a specific URI, an attacker can bypass this restriction by sending ...

CVE-2026-34483

Apache Tomcat is vulnerable to an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component. The issue arises from incomplete escaping when non-default values are used for the Connector attributes relaxedPathChars and/or relaxedQueryChars , which can allow the inje...

CVE-2008-4308

CVE-2008-4308 affects Apache Tomcat 4.1.32–4.1.34 and 5.5.10–5.5.20. The root cause is improper handling in the doRead method, which does not return -1 to signal a certain error condition, allowing the possibility of POST data from one request being sent to another. The consequence is potential i...

CVE-2002-1394

Apache Tomcat 4.x: vulnerability allows remote disclosure of server source code when using both the invoker servlet and the default servlet (Tomcat 4.0.5 and earlier). Root cause is exposure of server files through misconfigured/default servlet handling; impact is read access to source code and p...

CVE-2016-9775

The CVE-2016-9775 entry concerns the postrm script in the tomcat6, tomcat7, and tomcat8 packages across Debian/Ubuntu releases, where a misconfigured setgid program in the Catalina directory could allow local users with tomcat access to gain root privileges. Specifically, vulnerable versions incl...

CVE-2002-0493

CVE-2002-0493 affects Apache Tomcat where the web.xml parsing could proceed with errors and allow Tomcat to start with improper security settings, bypassing intended access restrictions. Affected component: Tomcat startup/security settings during web.xml read. Root cause described across sources ...

CVE-2013-0346

The set of documents confirms CVE-2013-0346 affects Apache Tomcat 7.x, where the log directory and its files have world-readable permissions, potentially allowing local users to read sensitive information. The Solaris/Nessus plugin reiterates this claim and notes it as a reported vulnerability, w...

CVE-2014-0095

CVE-2014-0095 affects Apache Tomcat 8.x, where AbstractAjpProcessor.java improperly handles a Content-Length: 0 AJP request, allowing remote attackers to trigger a denial of service by hanging request processing and consuming threads. Affected version range is Tomcat 8.x prior to 8.0.4. Mitigatio...

CVE-2002-1148

CVE-2002-1148 refers to a vulnerability in Apache Tomcat where the default servlet (org.apache.catalina.servlets.DefaultServlet) on Tomcat 4.0.4, 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet. Connected sources (GHSA and OSS/ID...

CVE-2007-3383

CVE-2007-3383 is an XSS flaw in Apache Tomcat’s SendMailServlet (examples/jsp/mail/sendmail.jsp) affecting Tomcat 4.0.0–4.0.6 and 4.1.0–4.1.36. The vulnerability allows remote attackers to inject arbitrary script/HTML via the From field (and possibly other fields) during error-message generation....

CVE-2008-3271

CVE-2008-3271 affects Apache Tomcat 5.5.0 and Tomcat 4.1.0 through 4.1.31. The issue is a synchronization-related defect that allows a remote attacker to bypass IP address restrictions and obtain sensitive information when a request is processed concurrently with another in a different thread, re...

CVE-2006-7197

CVE-2006-7197 : The AJP connector in Apache Tomcat 5.5.15 (via mod_jk) has an incorrect chunk length that can cause a buffer over-read in ajp_process_callback, enabling a remote attacker to read memory portions. The linked records (e.g., GHSA-JPQR-VH55-XQXF and RHSA entries) confirm this vulnerab...

CVE-2007-6286

Apache Tomcat 5.5.11–5.5.25 and 6.0.0–6.0.15, when using the native APR connector, fail to properly handle an empty SSL-port request, allowing remote attackers to trigger a duplicate of a recent request (e.g., via netcat). See CVE-2007-6286. NT: Affected versions are confirmed in Nessus/OpenVAS e...

CVE-2010-4312

CVE-2010-4312 affects Apache Tomcat 6.x; the default configuration omits the HTTPOnly flag in Set-Cookie headers, enabling remote session hijacking via script access to cookies. This vulnerability is tied to the standard Tomcat 6.x deployment and is described as a cookie security flag omission th...

CVE-2001-0590

CVE-2001-0590 affects Apache Tomcat Servlet prior to 3.2.2. A malformed URL request that does not end with a protocol (e.g., HTTP/1.0) can cause a remote attacker to read the source code of arbitrary JSP files, constituting information disclosure. The issue is confirmed in multiple sources tying ...

CVE-2002-2007

The CVE-2002-2007 vulnerability affects Apache Tomcat 3.2.3 and 3.2.4, where remote attackers could obtain sensitive information (directory listings and web root path) via erroneous HTTP requests to JSP-related paths (test/jsp, samples/jsp, examples/jsp) or the test/realPath.jsp servlet, leaking ...

CVE-2011-1582

CVE-2011-1582 affects Apache Tomcat 7.0.12 and 7.0.13, where the first request to a servlet is processed without enforcing security constraints configured via annotations, allowing bypass of access restrictions via HTTP requests. The issue is a consequence of an incomplete fix for CVE-2011-1088, ...

CVE-2002-0682

Apache Tomcat - CVE-2002-0682: a cross-site scripting (XSS) flaw in the /servlet/ mapping allows remote attackers to execute script as other users by injecting script into a URL, triggered when an exception is thrown by the servlet. Affected version in the public record is Tomcat 4.0.3; vulnerabi...

CVE-2011-1419

Affected software: Apache Tomcat 7.x before 7.0.11. Component/behavior: ServletSecurity handling; when web.xml has no security constraints, Tomcat does not follow ServletSecurity annotations, enabling a remote bypass of access controls via HTTP requests. Root cause: incomplete fix for CVE-2011-10...