Apache Tomcat security vulnerabilities
Application server. Public CVE monitoring for Apache Tomcat. Vendor security advisories are linked on this page.
Built for Application and platform teams.
82 public records · 0 security-fix timeline events. 1 published in the last 7 days. 58 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 4
- High 2
- Medium 0
- Low 0
2026-08-056 issues2026-11-02
Known exploited
View all known exploited- Critical9.8Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race ConditionPatch nowKEVEPSS 8.97%Dec 20, 2024
- High7.5Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityPatch nowKEVEPSS 98.50%Apr 9, 2026
- Critical9.8Apache Tomcat Path Equivalence VulnerabilityPatch nowKEVEPSS 99.94%Mar 10, 2025
- Critical9.8SysAid Server Path Traversal VulnerabilityPatch nowKEVEPSS 98.85%Nov 8, 2023
- Critical9.8Apache Tomcat Remote Code Execution VulnerabilityPatch nowKEVEPSS 90.34%Apr 6, 2017
- Critical9.8Apache Tomcat Improper Privilege Management VulnerabilityPatch nowKEVEPSS 99.27%Feb 24, 2020
- High8.1Apache Tomcat Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.97%Oct 3, 2017
- High8.1Apache Tomcat on Windows Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.71%Sep 19, 2017
Recently published
Browse catalog- High8.2Important: tomcat security updateOpen the advisoryOct 31, 2026
- Critical9.1Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.Check if you run itEPSS 0.50%Oct 20, 2026
- Critical9.1A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers tCheck if you run itEPSS 0.63%Oct 20, 2026
- High8.1Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connectorCheck if you run itEPSS 0.39%Oct 20, 2026
- CriticalApache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteCheck if you run itEPSS 0.75%Aug 28, 2026
- Critical9.1Apache Tomcat util accepted misconfigured CRLsCheck if you run itEPSS 0.59%Jun 29, 2026
- Critical9.3efw4.X is an Enterprise Framework for Web.Check if you run itEPSS 0.39%May 12, 2026
- Critical9.1Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.Check if you run itEPSS 1.22%May 12, 2026
- High7.5Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.Check if you run itEPSS 0.50%May 12, 2026
- Critical9.8DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.Check if you run itEPSS 1.33%May 12, 2026