What’s Vulnerable › Products
Apache Tomcat vulnerabilities
294 known vulnerabilities, 7 confirmed exploited in the wild (CISA KEV), 71 published in the last 12 months.
Check whether your Apache Tomcat version is affected
Exploited Apache Tomcat vulnerabilities
- CVE-2026-34486 — Apache Tomcat Missing Encryption of Sensitive Data Vulnerability
- CVE-2025-24813 — Apache Tomcat Path Equivalence Vulnerability
- CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability
- CVE-2016-8735 — Apache Tomcat Remote Code Execution Vulnerability
- CVE-2017-12617 — Apache Tomcat Remote Code Execution Vulnerability
- CVE-2017-12615 — Apache Tomcat on Windows Remote Code Execution Vulnerability
- CVE-2020-1938 — Apache Tomcat Improper Privilege Management Vulnerability
Latest Apache Tomcat vulnerabilities
- CVE-2026-93446 — Apache Tomcat: Possible TLS 1.3 connection failures
- CVE-2026-88041 — Apache Tomcat: HTTP/2 trailer header cross-contamination
- CVE-2026-80353 — Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
- CVE-2026-74049 — Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
- CVE-2026-74048 — Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
- CVE-2026-103119 — Apache Tomcat: AJP response mix-up (CVSS 9.1)
- CVE-2026-101356 — Apache Tomcat: HTTP/2 request/response mix-up after error during async processing (CVSS 9.1)
- CVE-2026-101296 — Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms (CVSS 9.1)
- CVE-2026-87022 — Apache Tomcat: WebSocket message smuggling with per-message-deflate (CVSS 7.5)
- CVE-2026-86350 — Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up (CVSS 9.1)
- CVE-2026-86248 — Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled (CVSS 9.8)
- CVE-2026-79677 — Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout (CVSS 7.5)
- CVE-2026-78437 — Apache Tomcat: HTTP/2 DoS via malformed request (CVSS 7.3)
- CVE-2026-78383 — Apache Tomcat: AJP DoS via missing request body (CVSS 7.5)
- CVE-2026-77791 — Apache Tomcat: DoS via busy wait during WebSocket close (CVSS 7.5)
- CVE-2026-77762 — Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request (CVSS 8.1)
- CVE-2026-77756 — Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests (CVSS 3.7)
- CVE-2026-76183 — Apache Tomcat: Bypass of security constraints for WebSocket endpoints (CVSS 9.8)
- CVE-2026-75973 — Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured (CVSS 7.3)
- CVE-2026-73581 — Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore (CVSS 6.5)
- CVE-2026-73180 — Apache Tomcat: Authenticated WebSocket session survives end of HTTP session (CVSS 6.8)
- CVE-2026-68763 — Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset (CVSS 7.5)
- CVE-2026-68569 — Apache Tomcat: Principal lookup can fail open in some cases (CVSS 8.1)
- CVE-2026-68525 — Apache Tomcat: Redirect after FORM auth may bypass method specific constraints (CVSS 9.1)
- CVE-2026-66422 — Apache Tomcat: Servlet role references can bypass declarative role constraints (CVSS 8.1)