pkg:Maven/org.apache.tomcat:tomcat

All known vulnerabilities

• CRITICAL9.8CVE-2026-41293Apache Tomcat - HTTP/2 request headers not validated
  from 0, < 9.0.118
• CRITICAL9.8CVE-2026-43512Apache Tomcat - Digest authenticator will authenticate any unknown user
  from 0, < 9.0.118
• CRITICAL9.8CVE-2009-3555pound - security update
  >= 7.0.0, < 7.0.10
• CRITICAL9.6CVE-2025-55754Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences
  >= 11.0.0-M1, < 11.0.11
• CRITICAL9.1CVE-2026-43515Apache Tomcat - Security constraints not correctly applied
  from 0, < 9.0.118
• CRITICAL9.1CVE-2026-29145Apache Tomcat: CLIENT_CERT authentication does not fail as expected
  >= 9.0.83, < 9.0.116
• CRITICAL9.1CVE-2025-66614Apache Tomcat: Client certificate verification bypass due to virtual host mapping
  >= 11.0.0-M1, < 11.0.15
• HIGH8.8CVE-2015-5351Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token
  from 0, < 7.0.68
• HIGH8.8CVE-2016-0714Improper Access Control in Apache Tomcat
  >= 9.0.0.M1, < 9.0.0.M2
• HIGH8.6CVE-2022-25762Response mix-up with WebSocket concurrent send and close
  >= 8.5.0, < 8.5.75
• HIGH8.4CVE-2025-49124Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows
  >= 11.0.0-M1, < 11.0.8
• HIGH8.1CVE-2015-5346Improper Neutralization of Input During Web Page Generation in Apache Tomcat
  >= 9.0.0.M1, < 9.0.0.M2
• HIGH7.8CVE-2020-8022Incorrect Default Permissions in Apache Tomcat
  from 0, < 8.0.53
• HIGH7.5CVE-2026-43513Apache Tomcat: LockOutRealm treats user names as case-sensitive
  from 0, < 9.0.118
• HIGH7.5CVE-2026-41284Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
  from 0, < 9.0.118
• HIGH7.5CVE-2026-34483Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve
  >= 9.0.40, < 9.0.116
• HIGH7.5CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
  >= 11.0.20, < 11.0.21
• HIGH7.5CVE-2026-34487Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token
  >= 9.0.13, < 9.0.117
• HIGH7.5CVE-2026-29129Apache Tomcat: Configured cipher preference order not preserved
  >= 9.0.114, < 9.0.116
• HIGH7.5CVE-2026-29146Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor
  >= 9.0.13, < 9.0.116
• HIGH7.5CVE-2025-55752Apache Tomcat Vulnerable to Relative Path Traversal
  >= 11.0.0-M1, < 11.0.11
• HIGH7.5CVE-2011-0534Apache Tomcat does not enforce the maxHttpHeaderSize limit
  >= 6.0.0, < 6.0.32
• HIGH7.5CVE-2016-6817Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
  >= 9.0.0.M1, < 9.0.0.M12
• HIGH7.5CVE-2017-5647tomcat7 - security update
  >= 9.0.0.M1, < 9.0.0.M19
• HIGH7.5CVE-2016-8747Apache Tomcat allows remote attackers to read data that was intended to be associated with a different request
  >= 8.5.7, < 8.5.10
• HIGH7.5CVE-2017-7675Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
  >= 9.0.0.M1, < 9.0.0.M22
• HIGH7.5CVE-2017-5664tomcat7 - security update
  >= 9.0.0.M1, < 9.0.0.M21
• HIGH7.5CVE-2017-5650Improper Resource Shutdown or Release in Apache Tomcat
  >= 9.0.0.M1, < 9.0.0.M19
• HIGH7.5CVE-2016-6796Apache Tomcat vulnerable to SecurityManager bypass
  >= 9.0.0.M1, < 9.0.0.M10
• HIGH7.5CVE-2016-6797Incorrect Authorization in Apache Tomcat
  >= 9.0.0.M1, < 9.0.0.M10
• HIGH7.5CVE-2022-29885EncryptInterceptor does not provide complete protection on insecure networks
  >= 10.1.0-M1, < 10.1.0-M15
• HIGH7.5CVE-2020-11996tomcat9 - security update
  >= 10.0.0-M1, < 10.0.0-M5
• HIGH7.5CVE-2020-13935Infinite Loop in Apache Tomcat
  >= 10.0.0-M1, < 10.0.0-M7
• HIGH7.5CVE-2020-13934Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
  >= 10.0.0-M1, < 10.0.0-M6
• HIGH7.5CVE-2021-42340DoS via memory leak with WebSocket connections
  >= 10.1.0-M1, < 10.1.0-M6
• HIGH7.5CVE-2021-41079Apache Tomcat DoS with unexpected TLS packet
  >= 10.0.0, < 10.0.4
• HIGH7.5CVE-2021-30639DoS after non-blocking IO error
  >= 10.0.3, < 10.0.5
• HIGH7.3CVE-2026-42498Apache Tomcat - WebSocket authentication header exposure
  from 0, < 9.0.118
• HIGH7.0CVE-2022-23181Local privilege escalation with FileStore
  >= 10.0.0, < 10.0.16
• MEDIUM6.5CVE-2021-30640Auth weakness in JNDIRealm
  >= 10.0.0-M1, < 10.0.5
• MEDIUM6.3CVE-2016-0763Improper Verification of Source of a Communication Channel in Apache Tomcat
  >= 7.0.0, < 7.0.68
• MEDIUM6.1CVE-2026-25854Apache Tomcat has an Open Redirect vulnerability
  >= 8.5.30, < 9.0.116
• MEDIUM6.1CVE-2023-41080Apache Tomcat: Open redirect with FORM authentication
  >= 11.0.0-M1, < 11.0.0-M11
• MEDIUM6.1CVE-2022-34305XSS in examples web application
  >= 10.1.0-M1, < 10.1.0-M17
• MEDIUM5.9CVE-2016-0762tomcat7 - security update
  >= 9.0.0M1, < 9.0.0.M10
• MEDIUM5.3CVE-2026-32990Apache Tomcat has an Improper Input Validation vulnerability
  >= 9.0.113, < 9.0.116
• MEDIUM5.3CVE-2025-61795Apache Tomcat Vulnerable to Improper Resource Shutdown or Release
  >= 11.0.0-M1, < 11.0.12
• MEDIUM5.3CVE-2024-54677Apache Tomcat Uncontrolled Resource Consumption vulnerability
  >= 11.0.0-M1, < 11.0.2
• MEDIUM5.3CVE-2023-45648Apache Tomcat: Trailer header parsing too lenient
  >= 11.0.0-M1, < 11.0.0-M12
• MEDIUM5.3CVE-2023-42795Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests
  >= 9.0.0-M1, < 9.0.81
• MEDIUM5.3CVE-2008-5515tomcat5.5 - several
  >= 4.1.0, < 4.1.40
• MEDIUM5.3CVE-2015-5345Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
  >= 9.0.0.M1, < 9.0.0.M2
• MEDIUM5.3CVE-2017-15706Inconsistent documentation in Apache Tomcat
  >= 9.0.0.M22, < 9.0.2
• MEDIUM5.3CVE-2016-6794System Property Disclosure in Apache Tomcat
  >= 6.0.0, < 6.0.47
• MEDIUM5.3CVE-2021-33037Incorrect Transfer-Encoding handling with HTTP/1.0
  >= 10.0.0-M1, < 10.0.7
• MEDIUM4.8CVE-2019-17569tomcat8 - security update
  >= 7.0.98, < 7.0.100
• MEDIUM4.8CVE-2020-1935Potential HTTP request smuggling in Apache Tomcat
  from 0, < 7.0.100
• MEDIUM4.3CVE-2016-0706Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
  >= 9.0.0.M1, < 9.0.0.M2
• MEDIUM4.3CVE-2015-5174tomcat6 - security update
  >= 8.0.0-RC1, < 8.0.27
• MEDIUM4.3CVE-2017-7674tomcat8 - security update
  >= 9.0.0.M1, < 9.0.0.M22
• MEDIUM4.2CVE-2009-0783Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
  >= 4.1.0, <= 4.1.39
• LOW3.7CVE-2026-43514Apache Tomcat - AJP secret compared in non-constant time
  from 0, < 9.0.118
• LOW3.7CVE-2026-24733Apache Tomcat: Security constraint bypass with HTTP/0.9
  >= 11.0.0-M1, < 11.0.15
• LOW3.7CVE-2021-43980Apache Tomcat: Information disclosure
  >= 8.5.0, < 8.5.78
• —CVE-2011-3375Apache Tomcat Exposes IP Addresses and HTTP Headers of Requests
  >= 6.0.30, < 6.0.35
• —CVE-2013-2185Deserialization of Untrusted Data in Apache Tomcat
  from 0, < 7.0.39
• —CVE-2013-2071Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
  >= 7.0.0, < 7.0.40
• —CVE-2011-2481Apache Tomcat Allows Replacing of XML Parser
  >= 7.0.0, < 7.0.17
• —CVE-2011-1419Apache Tomcat does not follow ServletSecurity annotations
  >= 7.0, < 7.0.11
• —CVE-2012-5887Improper Authentication in Apache Tomcat
  >= 5.5.0, < 5.5.36
• —CVE-2011-1475Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users
  >= 7.0.0, < 7.0.12
• —CVE-2012-3546Authentication Bypass in Apache Tomcat
  >= 6.0.0, < 6.0.36
• —CVE-2012-4431Cross-Site Request Forgery in Apache Tomcat
  >= 6.0.0, < 6.0.36
• —CVE-2012-5885Improper Access Control in Apache Tomcat
  >= 5.5.0, < 5.5.36
• —CVE-2011-4858Improper Input Validation in Apache Tomcat
  >= 5.5.0, < 5.5.35
• —CVE-2011-1088Apache Tomcat allows remote attackers to bypass intended access restrictions
  >= 7.0.0, < 7.0.10
• —CVE-2011-1183Access controll bypass in Apache Tomcat
  >= 7.0.11, < 7.0.12
• —CVE-2011-1582Access restriction bypass in Apache Tomcat
  >= 7.0.12, < 7.0.14
• —CVE-2010-4172Improper Neutralization of Input During Web Page Generation in Apache Tomcat
  >= 7.0.0, < 7.0.5
• —CVE-2010-4312Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header
  >= 6.0.0, < 6.0.35
• —CVE-2010-4476openjdk-6 - several
  >= 7.0.0, < 7.0.7
• —CVE-2011-5064Use of Hard-coded Cryptographic Key in Apache Tomcat
  >= 5.5.0, < 5.5.34
• —CVE-2011-5062Improper Authentication in Apache Tomcat
  >= 5.5.0, < 5.5.34
• —CVE-2011-2526Improper Input Validation in Apache Tomcat
  from 0, < 5.5.34
• —CVE-2011-2204Insertion of Sensitive Information into Log File in Apache Tomcat
  >= 5.5.0, < 5.5.34
• —CVE-2010-2227Apache Tomcat does not properly handle an invalid Transfer-Encoding header
  >= 7.0.0, < 7.0.2
• —CVE-2011-5063Improper Authentication in Apache Tomcat
  >= 5.5.0, < 5.5.34
• —CVE-2011-3190Apache Tomcat Allows Remote Attackers to Spoof AJP Requests
  >= 7.0.0, < 7.0.21
• —CVE-2011-1184tomcat6 - several
  >= 5.5.0, < 5.5.34
• —CVE-2010-3718tomcat6 - several
  >= 7.0.0, < 7.0.4
• —CVE-2013-4286tomcat6 - security update
  from 0, < 6.0.39
• —CVE-2012-3544tomcat6 - several
  >= 6.0.0, < 6.0.37
• —CVE-2014-0033Improper Input Validation in Apache Tomcat
  >= 6.0.33, < 6.0.38
• —CVE-2013-4590Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
  from 0, < 6.0.39
• —CVE-2013-4322Apache Tomcat Denial of Service vulnerability
  from 0, < 6.0.39
• —CVE-2013-2067Improper Authentication in Apache Tomcat
  >= 6.0.21, < 6.0.37
• —CVE-2014-0075Integer Overflow or Wraparound in Apache Tomcat
  from 0, < 6.0.40
• —CVE-2014-0227tomcat6 - security update
  >= 6.0.0, < 6.0.42
• —CVE-2014-0230Uncontrolled Resource Consumption in Apache Tomcat
  >= 6.0.0, < 6.0.44
• —CVE-2014-0099Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat
  from 0, < 6.0.40
• —CVE-2014-0119Missing XML Validation in Apache Tomcat
  from 0, < 6.0.40
• —CVE-2014-0096Improper Input Validation in Apache Tomcat
  from 0, < 6.0.40
• —CVE-2014-7810tomcat7 - security update
  >= 6.0.0, < 6.0.44
• —CVE-2013-4444Apache Tomcat Unrestricted file upload vulnerability
  >= 7.0, < 7.0.40
• —CVE-2012-0022Denial of Service in Apache Tomcat
  >= 5.5.0, < 5.5.35
• —CVE-2011-0013Improper Neutralization of Input During Web Page Generation in Apache Tomcat
  >= 5.5.0, < 5.5.32
• —CVE-2010-1157Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
  >= 5.5.0, < 5.5.30
• —CVE-2009-2902Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Tomcat
  >= 5.5.0, < 5.5.29
• —CVE-2009-2901Improper Authentication in Apache Tomcat
  >= 5.5.0, < 5.5.29
• —CVE-2009-2693Apache Tomcat Directory Traversal vulnerability
  >= 5.5.0, < 5.5.29
• —CVE-2009-0781Cross-site scripting in Apache Tomcat
  >= 4.1.0, <= 4.1.39
• —CVE-2009-0580Exposure of Sensitive Information in Apache Tomcat
  >= 4.1.0, < 4.1.40
• —CVE-2009-0033Apache Tomcat Denial of Service via Malformed Request Headers
  >= 4.1.0, <= 4.1.39
• —CVE-2008-4308Apache Tomcat information disclosure vulnerability
  >= 4.1.32, < 4.1.35
• —CVE-2008-2938Apache Tomcat Directory Traversal vulnerability
  >= 4.1.0, < 4.1.39
• —CVE-2008-2370Apache Tomcat Path Traversal Vulnerability
  >= 4.1.0, < 4.1.38
• —CVE-2008-1947tomcat5.5
  >= 5.5.9, < 5.5.27
• —CVE-2008-1232Apache Tomcat Cross-site scripting (XSS) vulnerability
  >= 4.1.0, < 4.1.38
• —CVE-2008-0002Apache Tomcat Sensitive Information Disclosure
  >= 6.0.0, < 6.0.16
• —CVE-2007-6286Apache Tomcat Does Not Properly Handle Empty Requests
  >= 5.5.11, <= 5.5.25
• —CVE-2007-5461Apache Tomcat Path Traversal Vulnerability
  >= 4.0.0, <= 4.0.6
• —CVE-2007-5333Exposure of Sensitive Information in Apache Tomcat
  >= 6.0.0, < 6.0.15
• —CVE-2007-4724Apache Tomcat Example Application CSRF and XSS Vulnerabilities
  from 0, <= 4.1.31
• —CVE-2007-3384Apache Tomcat's CookieExample Vulnerable to XSS
  >= 3.3.0, <= 3.3.2
• —CVE-2007-3383Apache Tomcat SendMailServlet XSS
  >= 4.0.0, <= 4.0.6
• —CVE-2007-3382tomcat5 - several vulnerabilities
  >= 6.0.0, <= 6.0.13
• —CVE-2007-3385Apache Tomcat Mishandles Character Sequence in Cookies
  >= 6.0.0, <= 6.0.13
• —CVE-2007-2450tomcat5.5
  >= 4.0.0, <= 4.0.6
• —CVE-2007-2449Apache Tomcat XSS Vulnerabilities in Examples Web Application
  >= 4.0.0, <= 4.0.6
• —CVE-2007-1358Apache Tomcat XSS In Accept-Language Headers
  >= 4.0.0, <= 4.0.6
• —CVE-2007-0450Apache Tomcat Directory Traversal
  >= 5.0, < 5.5.22
• —CVE-2006-7196Cross-site scripting in Apache Tomcat
  >= 4.0.0, < 4.0.7
• —CVE-2006-7197Apache Tomcat Buffer Over-Read
  from 0, <= 5.5.15
• —CVE-2006-7195Apache Tomcat XSS Vulnerability
  >= 5.0.0, <= 5.0.30
• —CVE-2006-3835Apache Tomcat Reveals Directories
  >= 5.0.0, < 5.5.17
• —CVE-2005-4836Apache Tomcat allows remote attackers to read JSP source files
  >= 4.1.15, <= 4.1.40
• —CVE-2005-4703Apache Tomcat Discloses MS-DOS Pathname
  from 0, <= 4.0.3
• —CVE-2005-3510Apache Tomcat Vulnerable to Denial of Service (DoS) via Simultaneous Requests
  >= 5.5.0, < 5.5.12
• —CVE-2005-3164Apache Tomcat AJP Connector Information Leak
  >= 4.0.1, <= 4.0.6
• —CVE-2005-2090Tomcat Vulnerable to Web Cache Poisoning
  >= 5.0.0, <= 5.0.19
• —CVE-2002-2272Apache Tomcat DoS via Malicious Get Request
  >= 4.0.0, <= 4.1.12
• —CVE-2002-2008Apache Tomcat Leaks Information via Error Message
  from 0, < 4.1.3
• —CVE-2002-2009Apache Tomcat Leaks Pathname Information via Error Message
  >= 4.0.0, <= 4.0.1
• —CVE-2002-2006Apache Tomcat Default Installation Reveals Sensitive Information
  >= 4.0.0, < 4.1.0
• —CVE-2002-1567Apache Tomcat XSS Vulnerability
  >= 4.1.0, < 4.1.29
• —CVE-2002-1394tomcat4 - source disclosure
  from 0, < 4.0.6
• —CVE-2002-1148tomcat4 - source code disclosure
  >= 4.0.0, < 4.0.5
• —CVE-2002-0935Apache Tomcat DoS Via Requests Including Null Characters
  from 0, < 4.1.3-beta
• —CVE-2002-0493Apache Tomcat may be started without proper security settings
  from 0, < 4.0b7
• —CVE-2001-0917Apache Tomcat Reveals Path through Long URL
  from 0, < 4.0.2
• —CVE-2001-0829Apache Tomcat allows webmasters to insert xss into error messages
  from 0, <= 3.2.1
• —CVE-2000-1210Apache Tomcat Directory Traversal
  from 0, <= 3.1
• —CVE-2000-0759Jakarta Apache Tomcat Reveals Physical Paths
  from 0, <= 3.1
• —CVE-2003-0866tomcat4 - incorrect input handling
  >= 4.0, < 4.1.0
• —CVE-2003-0044Jakarta Tomcat cross-site scripting (XSS) vulnerability
  >= 3.0, < 3.3.2
• —CVE-2003-0043Tomcat uses trusted privileges when processing web.xml file
  from 0, < 3.3.1a
• —CVE-2003-0042tomcat - information exposure, cross site scripting
  from 0, < 3.3.1a
• —CVE-2003-0045Jakarta Tomcat Denial of Service vulnerability
  from 0, < 3.3.1a
• —CVE-2014-0050libcommons-fileupload-java - security update
  >= 8.0.0-RC1, < 8.0.3