| Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerabilityCVE-2026-53404 · GHSA-H792-V28V-PPGR |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerabilityCVE-2026-55276 · GHSA-MQG3-R7H5-24X4 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-util-scan |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat has an Improper Authorization vulnerabilityCVE-2026-55956 · GHSA-5V3H-FJV2-54FG |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat has a Missing Critical Step in Authentication vulnerabilityCVE-2026-55957 · GHSA-7895-GFFQ-W6JQ |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat has an Improper Input Validation vulnerabilityCVE-2026-24734 · GHSA-MGP5-RV84-W37Q |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote-ffm |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validationCVE-2026-65637 · GHSA-F525-44XV-F2QJ |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat Improper Input Validation vulnerabilityCVE-2023-46589 · GHSA-FCCV-JMMP-QG76 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerabilityCVE-2026-68525 · GHSA-H3X4-894J-XPX5 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerabilityCVE-2026-65905 · GHSA-9XV2-5V5Q-P794 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerabilityCVE-2026-65182 · GHSA-GCX9-497G-6CP6 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat - Client certificate verification bypassCVE-2025-66614 · GHSA-FPJ8-GQ4V-P354 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat - HTTP/2 request headers not validatedCVE-2026-41293 · GHSA-R29C-68GH-XP6X |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
Critical
|
Fix reported |
|
| Potential remote code execution in Apache TomcatCVE-2020-9484 · GHSA-344F-F5VG-2JFJ |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
High
|
Fix reported |
|
| Exposure of Sensitive Information to an Unauthorized Actor in Apache TomcatCVE-2021-25122 · GHSA-J39C-C8HJ-X4J3 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat vulnerable to Insertion of Sensitive Information into Log FileCVE-2026-34487 · GHSA-X4M4-345F-5H5G |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-tribes |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Commons FileUpload denial of service vulnerabilityCVE-2023-24998 · GHSA-HFRX-6QGJ-FP6C |
commons-fileupload:commons-fileuploadorg.apache.tomcat.embed:tomcat-embed-core |
MavenRed Hat |
High
|
Fix reported |
|
| In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attackCVE-2019-17563 · GHSA-9XCJ-C8CR-8C3C |
org.apache.tomcat.embed:tomcat-embed-coreRed Hat BPM Suite 6/tomcat |
MavenRed Hat |
High
|
Fix reported |
|
| Insufficiently Protected Credentials in Apache TomcatCVE-2019-12418 · GHSA-HH3J-X4MC-G48R |
org.apache.tomcat.embed:tomcat-embed-coreRed Hat BPM Suite 6/tomcat |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerabilityCVE-2024-38286 · GHSA-7JQF-V358-P8G7 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat Session Fixation vulnerabilityCVE-2025-55668 · GHSA-23HV-MWM6-G8JF |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
Medium
|
Fix reported |
|
