| Apache Tomcat has a Cross-site Scripting vulnerabilityCVE-2026-50229 · GHSA-PG42-RG8C-J886 |
org.apache.tomcat:tomcatRed Hat Enterprise Linux 10/tomcat |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerabilityCVE-2026-53404 · GHSA-H792-V28V-PPGR |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerabilityCVE-2026-55276 · GHSA-MQG3-R7H5-24X4 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-util-scan |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat has an Improper Authentication vulnerabilityCVE-2026-55955 · GHSA-C5PH-RGHF-FJFJ |
org.apache.tomcat:tomcat-tribesorg.apache.tomcat:tomcat |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat has an Improper Authorization vulnerabilityCVE-2026-55956 · GHSA-5V3H-FJV2-54FG |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat util accepted misconfigured CRLsCVE-2026-53434 · GHSA-4X29-79GH-6V8Q |
org.apache.tomcat:tomcat-utilRed Hat Enterprise Linux 10/tomcat |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headersCVE-2025-48976 · GHSA-VV7R-C36W-3PRJ |
commons-fileupload:commons-fileuploadorg.apache.commons:commons-fileupload2-core |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerabilityCVE-2026-68525 · GHSA-H3X4-894J-XPX5 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerabilityCVE-2026-65905 · GHSA-9XV2-5V5Q-P794 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerabilityCVE-2026-65182 · GHSA-GCX9-497G-6CP6 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat - Client certificate verification bypassCVE-2025-66614 · GHSA-FPJ8-GQ4V-P354 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat - HTTP/2 request headers not validatedCVE-2026-41293 · GHSA-R29C-68GH-XP6X |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
Critical
|
Fix reported |
|
| Potential remote code execution in Apache TomcatCVE-2020-9484 · GHSA-344F-F5VG-2JFJ |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
High
|
Fix reported |
|
| Infinite Loop in Apache TomcatCVE-2020-13935 · GHSA-M7JV-HQ7H-MQ7C |
org.apache.tomcat.embed:tomcat-embed-websocketorg.apache.tomcat:tomcat-websocket |
MavenRed Hat |
High
|
Fix reported |
|
| Exposure of Sensitive Information to an Unauthorized Actor in Apache TomcatCVE-2021-25122 · GHSA-J39C-C8HJ-X4J3 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat vulnerable to Insertion of Sensitive Information into Log FileCVE-2026-34487 · GHSA-X4M4-345F-5H5G |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-tribes |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Commons FileUpload denial of service vulnerabilityCVE-2023-24998 · GHSA-HFRX-6QGJ-FP6C |
commons-fileupload:commons-fileuploadorg.apache.tomcat.embed:tomcat-embed-core |
MavenRed Hat |
High
|
Fix reported |
|
| In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attackCVE-2019-17563 · GHSA-9XCJ-C8CR-8C3C |
org.apache.tomcat.embed:tomcat-embed-coreRed Hat BPM Suite 6/tomcat |
MavenRed Hat |
High
|
Fix reported |
|
| Insufficiently Protected Credentials in Apache TomcatCVE-2019-12418 · GHSA-HH3J-X4MC-G48R |
org.apache.tomcat.embed:tomcat-embed-coreRed Hat BPM Suite 6/tomcat |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat Uncontrolled Resource Consumption vulnerabilityCVE-2024-54677 · GHSA-653P-VG55-5652 |
org.apache.tomcat:tomcatRed Hat Enterprise Linux 6/tomcat6 |
MavenRed Hat |
Medium
|
Fix reported |
|
