Apache Tomcat vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
82 matching records
- High8.2Important: tomcat security updateOpen the advisoryOct 31, 2026
- Critical9.1Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and th…Check if you run itEPSS 0.59%Oct 20, 2026
- Critical9.1Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users.Check if you run itEPSS 0.50%Oct 20, 2026
- Critical9.1A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers tCheck if you run itEPSS 0.63%Oct 20, 2026
- UnknownIncomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.Check if you run itEPSS 0.59%Oct 20, 2026
- UnknownIncomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request.Check if you run itEPSS 0.51%Oct 20, 2026
- High8.1Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connectorCheck if you run itEPSS 0.39%Oct 20, 2026
- UnknownExecution After Redirect (EAR) vulnerability in Apache Tomcat.Check if you run itEPSS 0.37%Oct 20, 2026
- UnknownNot Failing Securely ('Failing Open') vulnerability in Apache Tomcat.Check if you run itEPSS 0.45%Oct 20, 2026
- UnknownInternet Bug Bounty | Report #2327341 - CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444) | HackerOneCheck this weekEPSS 14.29%Sep 6, 2026
- CriticalApache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteCheck if you run itEPSS 0.75%Aug 28, 2026
- Critical9.1Apache Tomcat util accepted misconfigured CRLsCheck if you run itEPSS 0.59%Jun 29, 2026
- Critical9.3efw4.X is an Enterprise Framework for Web.Check if you run itEPSS 0.39%May 12, 2026
- Critical9.1Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.Check if you run itEPSS 1.22%May 12, 2026
- Low3.7Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.Check if you run itEPSS 0.35%May 12, 2026
- High7.5Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.Check if you run itEPSS 0.50%May 12, 2026
- Critical9.8DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.Check if you run itEPSS 1.33%May 12, 2026
- High7.3Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.Check if you run itEPSS 0.65%May 12, 2026
- Critical9.8Improper Input Validation vulnerability in Apache Tomcat.Check if you run itEPSS 1.70%May 12, 2026
- High7.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.Check if you run itEPSS 0.84%May 12, 2026
- High8.2OpenMRS Core is an open source electronic medical record system platform.Check if you run itEPSS 0.56%May 5, 2026
- Medium6.5CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.Check if you run itEPSS 0.45%Apr 9, 2026
- High7.5Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.Check if you run itEPSS 0.45%Apr 9, 2026
- High7.5Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.Check if you run itEPSS 0.46%Apr 9, 2026
- Medium5.3Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.Check if you run itEPSS 0.31%Apr 9, 2026