Apache Tomcat
- Software type
- Application server
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/11/2026, Apache Tomcat recorded 25 security vulnerabilities in the last 90 days, of which 22 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Apache Tomcat and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-87022Apache Tomcat: WebSocket message smuggling with per-message-deflateCVE-2026-86350Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-upCVE-2026-86248Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabledCVE-2026-79677Apache Tomcat: WebSocket DoS due to lost asynchronous write timeoutCVE-2026-78437Apache Tomcat: HTTP/2 DoS via malformed request| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-87022Apache Tomcat: WebSocket message smuggling with per-message-deflate | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-86350Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-86248Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-79677Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityHigh |
|---|
CVE-2026-78437Apache Tomcat: HTTP/2 DoS via malformed request | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityHigh |
|---|
CVE-2026-78383Apache Tomcat: AJP DoS via missing request body | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityHigh |
|---|
CVE-2026-77791Apache Tomcat: DoS via busy wait during WebSocket close | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityHigh |
|---|
CVE-2026-77762Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityHigh |
|---|
CVE-2026-77756Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityLow |
|---|
CVE-2026-76183Apache Tomcat: Bypass of security constraints for WebSocket endpoints | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityCritical |
|---|
133 Results | Page 1 of 14