Apache Tomcat
- Software type
- Application server
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/13/2026, Apache Tomcat recorded 30 security vulnerabilities in the last 90 days, of which 25 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Apache Tomcat and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-93446Apache Tomcat: Possible TLS 1.3 connection failuresCVE-2026-88041Apache Tomcat: HTTP/2 trailer header cross-contaminationCVE-2026-80353Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connectorCVE-2026-74049Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)CVE-2026-74048Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-93446Apache Tomcat: Possible TLS 1.3 connection failures | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-88041Apache Tomcat: HTTP/2 trailer header cross-contamination | Exploitation statusNot exploited | FixYes | Published10/20/2026 | SeverityHigh |
|---|
CVE-2026-80353Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector | Exploitation statusNot exploited | FixYes | Published10/20/2026 | SeverityHigh |
|---|
CVE-2026-74049Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) | Exploitation statusNot exploited | FixYes | Published10/20/2026 | SeverityMedium |
|---|
CVE-2026-74048Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up | Exploitation statusNot exploited | FixYes | Published10/20/2026 | SeverityMedium |
|---|
CVE-2026-103119Apache Software Foundation Apache Tomcat buffer under-read can mix responses and expose prior data | Exploitation statusNot exploited | FixYes | Published10/20/2026 | SeverityCritical |
|---|
CVE-2026-101356Apache Tomcat: HTTP/2 request/response mix-up after error during async processing | Exploitation statusNot exploited | FixYes | Published10/20/2026 | SeverityCritical |
|---|
CVE-2026-101296Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms | Exploitation statusNot exploited | FixYes | Published10/20/2026 | SeverityCritical |
|---|
CVE-2026-87022Apache Tomcat: WebSocket message smuggling with per-message-deflate | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityHigh |
|---|
CVE-2026-86350Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-86248Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-79677Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityHigh |
|---|
CVE-2026-78437Apache Tomcat: HTTP/2 DoS via malformed request | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityHigh |
|---|
CVE-2026-78383Apache Tomcat: AJP DoS via missing request body | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityHigh |
|---|
CVE-2026-77791Apache Tomcat: DoS via busy wait during WebSocket close | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityHigh |
|---|
CVE-2026-77762Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityHigh |
|---|
CVE-2026-77756Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityLow |
|---|
CVE-2026-76183Apache Tomcat: Bypass of security constraints for WebSocket endpoints | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-75973Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityHigh |
|---|
CVE-2026-73581Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityMedium |
|---|
CVE-2026-73180Apache Tomcat: Authenticated WebSocket session survives end of HTTP session | Exploitation statusNot exploited | FixYes | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-68763Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset | Exploitation statusNot exploited | FixYes | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-68569Apache Tomcat: Principal lookup can fail open in some cases | Exploitation statusNot exploited | FixYes | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-68525Apache Tomcat: Redirect after FORM auth may bypass method specific constraints | Exploitation statusNot exploited | FixYes | Published08/25/2026 | SeverityCritical |
|---|
CVE-2026-66422Apache Tomcat: Servlet role references can bypass declarative role constraints | Exploitation statusNot exploited | FixYes | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-65927Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control | Exploitation statusNot exploited | FixYes | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-65905Apache Tomcat: Limited replay attack possible with DIGEST authentication | Exploitation statusNot exploited | FixYes | Published08/25/2026 | SeverityCritical |
|---|
CVE-2026-65637Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete | Exploitation statusNot exploited | FixYes | Published08/25/2026 | SeverityCritical |
|---|
CVE-2026-65183Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets | Exploitation statusNot exploited | FixYes | Published08/25/2026 | SeverityHigh |
|---|
CVE-2026-65182Apache Tomcat: Bypass longest prefix security constraint | Exploitation statusNot exploited | FixYes | Published08/25/2026 | SeverityCritical |
|---|
CVE-2026-66299Apache Tomcat: DoS via WebSocket chat example | Exploitation statusNot exploited | FixYes | Published07/28/2026 | SeverityHigh |
|---|
CVE-2026-59084Apache Tomcat: EncryptInterceptor requirements not clearly documented | Exploitation statusNot exploited | FixYes | Published07/14/2026 | SeverityCritical |
|---|
CVE-2026-59083Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass | Exploitation statusNot exploited | FixYes | Published07/14/2026 | SeverityCritical |
|---|
CVE-2026-55957Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind | Exploitation statusNot exploited | FixYes | Published06/29/2026 | SeverityHigh |
|---|
CVE-2026-55956Apache Tomcat: Security constraints for default servlet ignored method | Exploitation statusNot exploited | FixYes | Published06/29/2026 | SeverityMedium |
|---|
CVE-2026-55955Apache Tomcat: EncryptInterceptor not protected against replay attacks | Exploitation statusNot exploited | FixYes | Published06/29/2026 | SeverityMedium |
|---|
CVE-2026-55276Apache Tomcat: Logged effective web.xml is incomplete | Exploitation statusNot exploited | FixYes | Published06/29/2026 | SeverityCritical |
|---|
CVE-2026-53434Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector | Exploitation statusNot exploited | FixYes | Published06/29/2026 | SeverityCritical |
|---|
CVE-2026-53404Apache Tomcat: Bad ornext processing in RewriteValve | Exploitation statusNot exploited | FixYes | Published06/29/2026 | SeverityHigh |
|---|
CVE-2026-50229Apache Tomcat: XSS in number guess example | Exploitation statusNot exploited | FixYes | Published06/29/2026 | SeverityMedium |
|---|
CVE-2026-43515Apache Tomcat: Security constraints not correctly applied | Exploitation statusNot exploited | FixYes | Published05/12/2026 | SeverityCritical |
|---|
CVE-2026-43514Apache Tomcat: AJP secret compared in non-constant time | Exploitation statusNot exploited | FixYes | Published05/12/2026 | SeverityLow |
|---|
CVE-2026-43513Apache Tomcat: LockOutRealm treats user names as case-sensitive | Exploitation statusNot exploited | FixYes | Published05/12/2026 | SeverityHigh |
|---|
CVE-2026-43512Apache Tomcat: Digest authenticator will authenticate any unknown user | Exploitation statusNot exploited | FixYes | Published05/12/2026 | SeverityCritical |
|---|
CVE-2026-42498Apache Tomcat: WebSocket authentication header exposure | Exploitation statusNot exploited | FixYes | Published05/12/2026 | SeverityHigh |
|---|
CVE-2026-41293Apache Tomcat: HTTP/2 request headers not validated | Exploitation statusNot exploited | FixYes | Published05/12/2026 | SeverityCritical |
|---|
CVE-2026-41284Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling | Exploitation statusNot exploited | FixYes | Published05/12/2026 | SeverityHigh |
|---|
CVE-2026-34500Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled | Exploitation statusNot exploited | FixYes | Published04/09/2026 | SeverityMedium |
|---|
CVE-2026-34487Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token | Exploitation statusNot exploited | FixYes | Published04/09/2026 | SeverityHigh |
|---|
CVE-2026-34486Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor | Exploitation statusKEV | FixNo | Published04/09/2026 | SeverityHigh |
|---|
124 Results | Page 1 of 3