Advisories · Technology

Apache Software Foundation Apache Tomcat.

Every CVE that names Apache Software Foundation Apache Tomcat among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-103119 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Tomcat: AJP response mix-up
- Apache Software Foundation Apache Tomcat
- CWE-127
Not analysed yet 20 Oct 2026
CVE-2026-101356 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Tomcat: HTTP/2 request/response mix-up after error during async processing
- Apache Software Foundation Apache Tomcat
- Race condition
Not analysed yet 20 Oct 2026
CVE-2026-101296 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
- Apache Software Foundation Apache Tomcat
- Authentication bypass
Not analysed yet 20 Oct 2026
CVE-2026-93446 CVE record

CVSS 7.5 High

Apache Tomcat: Possible TLS 1.3 connection failures
- Apache Software Foundation Apache Tomcat
- CWE-459
Not analysed yet 20 Oct 2026
CVE-2026-88041 CVE record

CVSS 7.5 High

Apache Tomcat: HTTP/2 trailer header cross-contamination
- Apache Software Foundation Apache Tomcat
- CWE-459
Not analysed yet 20 Oct 2026
CVE-2026-80353 CVE record

CVSS 8.1 High

Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
- Apache Software Foundation Apache Tomcat
- Race condition
Not analysed yet 20 Oct 2026
CVE-2026-74049 CVE record

CVSS 6.1 Medium

Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
- Apache Software Foundation Apache Tomcat
- CWE-698
Not analysed yet 20 Oct 2026
CVE-2026-74048 CVE record

CVSS 6.5 Medium

Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
- Apache Software Foundation Apache Tomcat
- CWE-636
Not analysed yet 20 Oct 2026
CVE-2026-87022 CVE record

CVSS 7.5 High

Apache Tomcat: WebSocket message smuggling with per-message-deflate
- Apache Software Foundation Apache Tomcat
- CWE-130
Not analysed yet 23 Sept 2026
CVE-2026-86350 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
- Apache Software Foundation Apache Tomcat
- HTTP request smuggling
Not analysed yet 23 Sept 2026
CVE-2026-86248 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
- Apache Software Foundation Apache Tomcat
- Authentication bypass
Not analysed yet 23 Sept 2026
CVE-2026-79677 CVE record

CVSS 7.5 High

Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
- Apache Software Foundation Apache Tomcat
- Denial of service
- CWE-1025
Not analysed yet 23 Sept 2026
CVE-2026-78437 CVE record

CVSS 7.3 High

Apache Tomcat: HTTP/2 DoS via malformed request
- Apache Software Foundation Apache Tomcat
- CWE-459
Not analysed yet 23 Sept 2026
CVE-2026-78383 CVE record

CVSS 7.5 High

Apache Tomcat: AJP DoS via missing request body
- Apache Software Foundation Apache Tomcat
- Denial of service
Not analysed yet 23 Sept 2026
CVE-2026-77791 CVE record

CVSS 7.5 High

Apache Tomcat: DoS via busy wait during WebSocket close
- Apache Software Foundation Apache Tomcat
- Denial of service
Not analysed yet 23 Sept 2026
CVE-2026-77762 CVE record

CVSS 8.1 High

Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request
- Apache Software Foundation Apache Tomcat
- Race condition
Not analysed yet 23 Sept 2026
CVE-2026-77756 CVE record

CVSS 3.7 Low

Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
- Apache Software Foundation Apache Tomcat
- HTTP request smuggling
Not analysed yet 23 Sept 2026
CVE-2026-76183 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Tomcat: Bypass of security constraints for WebSocket endpoints
- Apache Software Foundation Apache Tomcat
- CWE-289
Not analysed yet 23 Sept 2026
CVE-2026-75973 CVE record

CVSS 7.3 High

Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured
- Apache Software Foundation Apache Tomcat
- Authentication bypass
Not analysed yet 23 Sept 2026
CVE-2026-73581 CVE record

CVSS 6.5 Medium

Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
- Apache Software Foundation Apache Tomcat
- CWE-299
Not analysed yet 23 Sept 2026
CVE-2026-73180 CVE record

CVSS 6.8 Medium

Apache Tomcat: Authenticated WebSocket session survives end of HTTP session
- Apache Software Foundation Apache Tomcat
- Authentication bypass
Not analysed yet 25 Aug 2026
CVE-2026-68763 CVE record

CVSS 7.5 High

Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
- Apache Software Foundation Apache Tomcat
- Denial of service
Not analysed yet 25 Aug 2026
CVE-2026-68569 CVE record

CVSS 8.1 High

Apache Tomcat: Principal lookup can fail open in some cases
- Apache Software Foundation Apache Tomcat
- Authentication bypass
Not analysed yet 25 Aug 2026
CVE-2026-66422 CVE record

CVSS 8.1 High

Apache Tomcat: Servlet role references can bypass declarative role constraints
- Apache Software Foundation Apache Tomcat
- Broken access control
Not analysed yet 25 Aug 2026
CVE-2026-65927 CVE record

CVSS 7.5 High

Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control
- Apache Software Foundation Apache Tomcat
- CWE-193
Not analysed yet 25 Aug 2026
CVE-2026-65183 CVE record

CVSS 8.1 High

Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets
- Apache Software Foundation Apache Tomcat
- Race condition
Not analysed yet 25 Aug 2026
CVE-2026-66299 CVE record

CVSS 7.5 High

Apache Tomcat: DoS via WebSocket chat example
- Apache Software Foundation Apache Tomcat
- Denial of service
Not analysed yet 28 Jul 2026
CVE-2026-59084 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Tomcat: EncryptInterceptor requirements not clearly documented
- Apache Software Foundation Apache Tomcat
- CWE-1059
Not analysed yet 14 Jul 2026
CVE-2026-59083 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
- Apache Software Foundation Apache Tomcat
- CWE-177
Not analysed yet 14 Jul 2026