# Apache Software Foundation Apache Tomcat.

Every CVE that names Apache Software Foundation Apache Tomcat among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Apache Tomcat: AJP response mix-up](https://agentprime.io/advisories/CVE-2026-103119.md)
  `CVE-2026-103119` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-127
- [Apache Tomcat: HTTP/2 request/response mix-up after error during async processing](https://agentprime.io/advisories/CVE-2026-101356.md)
  `CVE-2026-101356` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Race condition
- [Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms](https://agentprime.io/advisories/CVE-2026-101296.md)
  `CVE-2026-101296` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Apache Tomcat: Possible TLS 1.3 connection failures](https://agentprime.io/advisories/CVE-2026-93446.md)
  `CVE-2026-93446` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-459
- [Apache Tomcat: HTTP/2 trailer header cross-contamination](https://agentprime.io/advisories/CVE-2026-88041.md)
  `CVE-2026-88041` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-459
- [Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector](https://agentprime.io/advisories/CVE-2026-80353.md)
  `CVE-2026-80353` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Race condition
- [Apache Tomcat: Jasper JSTL \<c:redirect> plug-in implementation omits page abort (SKIP_PAGE)](https://agentprime.io/advisories/CVE-2026-74049.md)
  `CVE-2026-74049` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-698
- [Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up](https://agentprime.io/advisories/CVE-2026-74048.md)
  `CVE-2026-74048` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-636
- [Apache Tomcat: WebSocket message smuggling with per-message-deflate](https://agentprime.io/advisories/CVE-2026-87022.md)
  `CVE-2026-87022` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-130
- [Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up](https://agentprime.io/advisories/CVE-2026-86350.md)
  `CVE-2026-86350` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: HTTP request smuggling
- [Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled](https://agentprime.io/advisories/CVE-2026-86248.md)
  `CVE-2026-86248` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Authentication bypass
- [Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout](https://agentprime.io/advisories/CVE-2026-79677.md)
  `CVE-2026-79677` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: Denial of service, CWE-1025
- [Apache Tomcat: HTTP/2 DoS via malformed request](https://agentprime.io/advisories/CVE-2026-78437.md)
  `CVE-2026-78437` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.3 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-459
- [Apache Tomcat: AJP DoS via missing request body](https://agentprime.io/advisories/CVE-2026-78383.md)
  `CVE-2026-78383` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: Denial of service
- [Apache Tomcat: DoS via busy wait during WebSocket close](https://agentprime.io/advisories/CVE-2026-77791.md)
  `CVE-2026-77791` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: Denial of service
- [Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request](https://agentprime.io/advisories/CVE-2026-77762.md)
  `CVE-2026-77762` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 8.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: Race condition
- [Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests](https://agentprime.io/advisories/CVE-2026-77756.md)
  `CVE-2026-77756` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 3.7 Low · Not analysed yet · Published 23 Sept 2026 · Tags: HTTP request smuggling
- [Apache Tomcat: Bypass of security constraints for WebSocket endpoints](https://agentprime.io/advisories/CVE-2026-76183.md)
  `CVE-2026-76183` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-289
- [Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured](https://agentprime.io/advisories/CVE-2026-75973.md)
  `CVE-2026-75973` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.3 High · Not analysed yet · Published 23 Sept 2026 · Tags: Authentication bypass
- [Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore](https://agentprime.io/advisories/CVE-2026-73581.md)
  `CVE-2026-73581` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 6.5 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-299
- [Apache Tomcat: Authenticated WebSocket session survives end of HTTP session](https://agentprime.io/advisories/CVE-2026-73180.md)
  `CVE-2026-73180` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 6.8 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset](https://agentprime.io/advisories/CVE-2026-68763.md)
  `CVE-2026-68763` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service
- [Apache Tomcat: Principal lookup can fail open in some cases](https://agentprime.io/advisories/CVE-2026-68569.md)
  `CVE-2026-68569` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 8.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Apache Tomcat: Servlet role references can bypass declarative role constraints](https://agentprime.io/advisories/CVE-2026-66422.md)
  `CVE-2026-66422` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 8.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control
- [Apache Tomcat: RewriteValve \[N\] restarts at the second rule and may bypass access control](https://agentprime.io/advisories/CVE-2026-65927.md)
  `CVE-2026-65927` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-193
- [Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets](https://agentprime.io/advisories/CVE-2026-65183.md)
  `CVE-2026-65183` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 8.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: Race condition
- [Apache Tomcat: DoS via WebSocket chat example](https://agentprime.io/advisories/CVE-2026-66299.md)
  `CVE-2026-66299` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Denial of service
- [Apache Tomcat: EncryptInterceptor requirements not clearly documented](https://agentprime.io/advisories/CVE-2026-59084.md)
  `CVE-2026-59084` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-1059
- [Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass](https://agentprime.io/advisories/CVE-2026-59083.md)
  `CVE-2026-59083` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-177

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=apache-software-foundation-apache-tomcat>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/apache-software-foundation-apache-tomcat/>. Everything for agents: <https://agentprime.io/llms.txt>.