| Apache Tomcat has an Improper Input Validation vulnerabilityCVE-2026-24734 · GHSA-MGP5-RV84-W37Q |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote-ffm |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validationCVE-2026-65637 · GHSA-F525-44XV-F2QJ |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
Critical
|
Fix reported |
|
| Apache Tomcat Improper Input Validation vulnerabilityCVE-2023-46589 · GHSA-FCCV-JMMP-QG76 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-catalina |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat - Client certificate verification bypassCVE-2025-66614 · GHSA-FPJ8-GQ4V-P354 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat - HTTP/2 request headers not validatedCVE-2026-41293 · GHSA-R29C-68GH-XP6X |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
Critical
|
Fix reported |
|
| Exposure of Sensitive Information to an Unauthorized Actor in Apache TomcatCVE-2021-25122 · GHSA-J39C-C8HJ-X4J3 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Commons FileUpload denial of service vulnerabilityCVE-2023-24998 · GHSA-HFRX-6QGJ-FP6C |
commons-fileupload:commons-fileuploadorg.apache.tomcat.embed:tomcat-embed-core |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerabilityCVE-2024-38286 · GHSA-7JQF-V358-P8G7 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connectorCVE-2025-52434 · GHSA-4J3C-42XV-3F84 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat - Security constraint bypass with HTTP/0.9CVE-2026-24733 · GHSA-QQ5R-98HH-RXC9 |
org.apache.tomcat:tomcat-coyoteRed Hat Enterprise Linux 10/tomcat |
MavenRed Hat |
Low
|
Fix reported |
|
| Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive InformationCVE-2024-21733 · GHSA-F4QF-M5GF-8JM8 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat.experimental:tomcat-embed-programmatic |
Maven |
Medium
|
Fix reported |
|
| Apache Tomcat Improper Input Validation vulnerabilityCVE-2023-45648 · GHSA-R6J3-PX5G-CQ3X |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat: Configured cipher preference order not preservedCVE-2026-29129 · GHSA-69CC-CV78-QC8G |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
Maven |
High
|
Fix reported |
|
| Apache Tomcat has an HTTP Request/Response Smuggling vulnerabilityCVE-2026-24880 · GHSA-563X-Q5RQ-57QP |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat Denial of Service vulnerabilityCVE-2019-0199 · GHSA-QCXH-W3J9-58QR |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
High
|
Fix reported |
|
| Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache TomcatCVE-2020-13934 · GHSA-VF77-8H7G-GGHP |
org.apache.tomcat:tomcat-coyoteorg.apache.tomcat:tomcat |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Tomcat Improper Resource Shutdown or Release vulnerabilityCVE-2025-48989 · GHSA-GQP3-2CVR-X8M3 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
High
|
Fix reported |
|
| HTTP/2 Stream Cancellation AttackCVE-2023-44487 · GHSA-QPPJ-FM5R-HXR3 |
golang.org/x/netcom.typesafe.akka:akka-http-core |
GoMavenRed HatSwift |
Medium
|
Fix reported |
|
| Apache Tomcat has an Improper Input Validation vulnerabilityCVE-2026-32990 · GHSA-8MC5-53M5-3QJ2 |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
Medium
|
Fix reported |
|
| Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streamsCVE-2025-53506 · GHSA-25XR-QJ8W-C4VF |
org.apache.tomcat.embed:tomcat-embed-coreorg.apache.tomcat:tomcat-coyote |
MavenRed Hat |
High
|
Fix reported |
|
