Check your version
catalina.sh versionAffected version lines
- 11.0 72 CVEs KEV 3
- 10.1 79 CVEs KEV 3
- 10.0 28 CVEs End of life
- 9.0 140 CVEs KEV 6
- 8.5 100 CVEs KEV 5 End of life
- 8.0 50 CVEs KEV 3 End of life
- 7.0 117 CVEs KEV 5
- 6.0 89 CVEs KEV 2
- 5.5 70 CVEs KEV 2
- 5.0 36 CVEs KEV 2
- 4.1 55 CVEs KEV 2
- 4.0 47 CVEs KEV 2
- 3.3 38 CVEs KEV 2
- 3.2 38 CVEs KEV 2
- 3.1 38 CVEs KEV 2
- 3.0 38 CVEs KEV 2
- 1.1 28 CVEs KEV 2
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-34486 | Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor | = 9.0.116 = 10.1.53 = 11.0.20 | 7.5 | KEV | 98.5% | 2026-04-10 |
| CVE-2025-24813 | Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT | < 9.0.99 ≥ 10.1.1 < 10.1.35 ≥ 11.0.1 < 11.0.3 | 10.0 | KEV | 99.9% | 2025-03-11 |
| CVE-2023-44487 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can... | ≥ 8.5.0 ≤ 8.5.93 ≥ 9.0.0 ≤ 9.0.80 ≥ 10.1.0 ≤ 10.1.13 | 7.5 | KEV | 100.0% | 2023-10-10 |
| CVE-2020-1938 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache To... | ≥ 7.0.0 < 7.0.100 ≥ 8.5.0 < 8.5.51 ≥ 9.0.0 < 9.0.31 | 9.8 | KEV | 99.3% | 2020-02-25 |
| CVE-2017-12617 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.8... | ≥ 7.0.0 < 7.0.82 ≥ 8.0 < 8.0.47 ≥ 8.5.0 < 8.5.23 | 8.1 | KEV | 100.0% | 2017-10-04 |
| CVE-2017-12615 | When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly in... | ≥ 7.0.0 ≤ 7.0.79 | 8.1 | KEV | 99.7% | 2017-09-19 |
| CVE-2016-8735 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.... | < 6.0.48 ≥ 7.0.0 < 7.0.73 ≥ 8.0 < 8.0.39 | 9.8 | KEV | 90.3% | 2017-04-07 |
| CVE-2026-73180 | Apache Tomcat: Authenticated WebSocket session survives end of HTTP session | ≥ 7.0.43 ≤ 7.0.109 ≥ 8.5.0 < 9.0.121 ≥ 10.1.0 < 10.1.58 | 6.8 | — | 2026-08-26 | |
| CVE-2026-68763 | Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset | ≥ 8.5.59 < 9.0.121 ≥ 10.1.0 < 10.1.58 ≥ 11.0.0 < 11.0.25 | 7.5 | — | 2026-08-26 | |
| CVE-2026-68569 | Apache Tomcat: Principal lookup can fail open in some cases | ≥ 7.0.0 ≤ 7.0.109 ≥ 8.5.0 < 9.0.121 ≥ 10.1.0 < 10.1.58 | 8.1 | — | 2026-08-26 | |
| CVE-2026-68525 | Apache Tomcat: Redirect after FORM auth may bypass method specific constraints | ≥ 7.0.0 ≤ 7.0.109 ≥ 8.5.0 < 9.0.121 ≥ 10.1.0 < 10.1.58 | 9.1 | — | 2026-08-26 | |
| CVE-2026-66422 | Apache Tomcat: Servlet role references can bypass declarative role constraints | ≥ 7.0.97 ≤ 7.0.109 ≥ 8.5.46 < 9.0.121 ≥ 10.1.0 < 10.1.58 | 8.1 | — | 2026-08-26 | |
| CVE-2026-65927 | Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control | ≥ 8.5.0 < 9.0.121 ≥ 10.1.0 < 10.1.58 ≥ 11.0.0 < 11.0.25 | 7.5 | — | 2026-08-26 | |
| CVE-2026-65905 | Apache Tomcat: Limited replay attack possible with DIGEST authentication | ≥ 7.0.30 ≤ 7.0.109 ≥ 8.5.0 < 9.0.121 ≥ 10.1.0 < 10.1.58 | 9.8 | — | 2026-08-26 | |
| CVE-2026-65637 | Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete | ≥ 9.0.115 < 9.0.121 ≥ 10.1.53 < 10.1.58 ≥ 11.0.20 < 11.0.25 | 9.8 | — | 2026-08-26 | |
| CVE-2026-65183 | Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets | ≥ 9.0.42 < 9.0.121 ≥ 10.1.0 < 10.1.58 ≥ 11.0.0 < 11.0.25 | 8.1 | — | 2026-08-26 | |
| CVE-2026-65182 | Apache Tomcat: Bypass longest prefix security constraint | ≥ 7.0.0 ≤ 7.0.109 ≥ 8.5.0 < 9.0.121 ≥ 10.1.0 < 10.1.58 | 9.1 | — | 2026-08-26 | |
| CVE-2026-66299 | Apache Tomcat: DoS via WebSocket chat example | ≥ 9.0.89 < 9.0.121 ≥ 10.1.24 < 10.1.58 ≥ 11.0.1 < 11.0.25 | 7.5 | — | 2026-07-28 | |
| CVE-2026-59084 | Apache Tomcat: EncryptInterceptor requirements not clearly documented | ≥ 7.0.100 ≤ 7.0.109 ≥ 8.5.38 ≤ 8.5.100 ≥ 9.0.13 ≤ 9.0.119 | 9.1 | — | 2026-07-14 | |
| CVE-2026-59083 | Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass | ≤ 8.0.0 ≥ 8.5.0 ≤ 8.5.100 ≥ 9.0.0 ≤ 9.0.119 | 9.1 | — | 2026-07-14 | |
| CVE-2026-55957 | Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind | < 9.0.101 ≥ 10.1.0 < 10.1.37 ≥ 11.0.0 < 11.0.5 | 7.3 | — | 2026-06-30 | |
| CVE-2026-55956 | Apache Tomcat: Security constraints for default servlet ignored method | < 9.0.119 ≥ 10.1.0 < 10.1.56 ≥ 11.0.0 < 11.0.23 | 6.5 | — | 2026-06-30 | |
| CVE-2026-55955 | Apache Tomcat: EncryptInterceptor not protected against replay attacks | < 9.0.119 ≥ 10.1.0 < 10.1.56 ≥ 11.0.0 < 11.0.23 | 6.5 | — | 2026-06-30 | |
| CVE-2026-55276 | Apache Tomcat: Logged effective web.xml is incomplete | < 9.0.119 ≥ 10.1.0 < 10.1.56 ≥ 11.0.0 < 11.0.23 | 9.1 | — | 2026-06-30 | |
| CVE-2026-53434 | Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector | ≥ 9.0.83 < 9.0.119 ≥ 10.1.0 < 10.1.56 ≥ 11.0.0 < 11.0.23 | 9.1 | — | 2026-06-30 | |
| CVE-2026-53404 | Apache Tomcat: Bad ornext processing in RewriteValve | ≥ 8.5.0 ≤ 8.5.100 ≥ 9.0.0 < 9.0.119 ≥ 10.1.0 < 10.1.56 | 7.3 | — | 2026-06-30 | |
| CVE-2026-50229 | Apache Tomcat: XSS in number guess example | ≤ 7.0.109 ≥ 8.5.0 ≤ 8.5.100 ≥ 9.0.0 < 9.0.119 | 6.1 | — | 2026-06-30 | |
| CVE-2026-43515 | Apache Tomcat: Security constraints not correctly applied | ≥ 7.0.0 ≤ 7.0.109 ≥ 8.5.0 ≤ 8.5.100 ≥ 9.0.0 < 9.0.118 | 9.1 | — | 2026-05-13 | |
| CVE-2026-43514 | Apache Tomcat: AJP secret compared in non-constant time | ≥ 7.0.0 ≤ 7.0.109 ≥ 8.5.0 ≤ 8.5.100 ≥ 9.0.0 < 9.0.118 | 3.7 | — | 2026-05-13 | |
| CVE-2026-43513 | Apache Tomcat: LockOutRealm treats user names as case-sensitive | ≥ 7.0.0 ≤ 7.0.109 ≥ 8.5.0 ≤ 8.5.100 ≥ 9.0.0 < 9.0.118 | 7.5 | — | 2026-05-13 | |
| CVE-2026-43512 | Apache Tomcat: Digest authenticator will authenticate any unknown user | ≥ 7.0.0 ≤ 7.0.109 ≥ 8.5.0 ≤ 8.5.100 ≥ 9.0.0 < 9.0.118 | 9.8 | — | 2026-05-13 | |
| CVE-2026-41293 | Apache Tomcat: HTTP/2 request headers not validated | ≥ 8.5.0 ≤ 8.5.100 ≥ 9.0.0 < 9.0.118 ≥ 10.0.0 ≤ 10.0.27 | 9.8 | — | 2026-05-13 | |
| CVE-2026-42498 | Apache Tomcat: WebSocket authentication header exposure | ≥ 7.0.0 ≤ 7.0.109 ≥ 8.5.0 ≤ 8.5.100 ≥ 9.0.0 < 9.0.118 | 7.3 | — | 2026-05-13 | |
| CVE-2026-41284 | Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling | ≥ 4.0.0 ≤ 7.0.109 ≥ 8.5.0 ≤ 8.5.100 ≥ 9.0.0 < 9.0.118 | 7.5 | — | 2026-05-13 | |
| CVE-2026-34500 | Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled | ≥ 9.0.92 < 9.0.117 ≥ 10.1.22 < 10.1.54 ≥ 11.0.1 < 11.0.21 | 6.5 | — | 2026-04-10 | |
| CVE-2026-34487 | Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token | ≥ 9.0.13 < 9.0.117 ≥ 10.1.0 < 10.1.54 ≥ 11.0.0 < 11.0.21 | 7.5 | — | 2026-04-10 | |
| CVE-2026-34483 | Apache Tomcat: Incomplete escaping of JSON access logs | ≥ 9.0.40 < 9.0.117 ≥ 10.1.0 < 10.1.54 ≥ 11.0.0 < 11.0.21 | 7.5 | — | 2026-04-10 | |
| CVE-2026-32990 | Apache Tomcat: Fix for CVE-2025-66614 is incomplete | ≥ 9.0.113 < 9.0.116 ≥ 10.1.50 < 10.1.53 ≥ 11.0.15 < 11.0.20 | 5.3 | — | 2026-04-10 | |
| CVE-2026-29146 | Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default | ≥ 7.0.100 ≤ 7.0.109 ≥ 8.5.38 ≤ 8.5.100 ≥ 9.0.13 < 9.0.116 | 7.5 | — | 2026-04-10 | |
| CVE-2026-29145 | Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled | ≥ 9.0.83 < 9.0.116 ≥ 10.1.1 < 10.1.53 ≥ 11.0.0 < 11.0.20 | 9.1 | — | 2026-04-10 | |
| CVE-2026-29129 | Apache Tomcat: TLS cipher order is not preserved | ≥ 9.0.114 < 9.0.116 ≥ 10.1.51 < 10.1.53 ≥ 11.0.16 < 11.0.20 | 7.5 | — | 2026-04-10 | |
| CVE-2026-25854 | Apache Tomcat: Occasionally open redirect | ≥ 9.0.1 < 9.0.116 ≥ 10.1.0 < 10.1.53 ≥ 11.0.0 < 11.0.20 | 6.1 | — | 2026-04-10 | |
| CVE-2026-24880 | Apache Tomcat: Request smuggling via invalid chunk extension | ≥ 9.0.0 < 9.0.116 ≥ 10.1.0 < 10.1.53 ≥ 11.0.0 < 11.0.20 | 7.5 | — | 2026-04-10 | |
| CVE-2026-24734 | Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass | ≥ 9.0.83 < 9.0.115 ≥ 10.1.1 < 10.1.52 ≥ 11.0.1 < 11.0.18 | 7.4 | — | 2026-02-18 | |
| CVE-2026-24733 | Apache Tomcat: Security constraint bypass with HTTP/0.9 | ≥ 9.0.1 < 9.0.113 ≥ 10.1.1 < 10.1.50 ≥ 11.0.1 < 11.0.15 | 6.5 | — | 2026-02-18 | |
| CVE-2025-66614 | Apache Tomcat: Client certificate verification bypass due to virtual host mapping | ≥ 9.0.1 < 9.0.113 ≥ 10.1.1 < 10.1.50 ≥ 11.0.1 < 11.0.15 | 7.6 | — | 2026-02-18 | |
| CVE-2025-61795 | Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS | ≥ 8.5.0 ≤ 8.5.100 ≥ 9.0.0 < 9.0.110 ≥ 10.0.0 < 10.0.27 | 5.3 | — | 2025-10-28 | |
| CVE-2025-55752 | Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled | ≥ 8.5.6 ≤ 8.5.100 ≥ 9.0.1 < 9.0.109 ≥ 10.0.0 < 10.0.27 | 7.5 | — | 2025-10-28 | |
| CVE-2025-55754 | Apache Tomcat: console manipulation via escape sequences in log messages | ≥ 8.5.60 ≤ 8.5.100 ≥ 9.0.40 < 9.0.109 ≥ 10.0.0 < 10.0.27 | 9.6 | — | 2025-10-28 | |
| CVE-2025-55668 | Apache Tomcat: session fixation via rewrite valve | ≥ 9.0.1 < 9.0.106 ≥ 10.0.0 < 10.1.42 ≥ 11.0.0 < 11.0.8 | 6.5 | — | 2025-08-13 | |
| CVE-2025-48989 | Apache Tomcat: h2 DoS - Made You Reset | ≥ 9.0.1 < 9.0.108 ≥ 10.0.0 < 10.1.44 ≥ 11.0.0 < 11.0.10 | 7.5 | — | 2025-08-13 | |
| CVE-2025-53506 | Apache Tomcat: DoS via excessive h2 streams at connection start | ≥ 9.0.0 ≤ 9.0.106 ≥ 10.1.0 ≤ 10.1.42 ≥ 11.0.0 ≤ 11.0.8 | 7.5 | — | 2025-07-11 | |
| CVE-2025-52520 | Apache Tomcat: DoS via integer overflow in multipart file upload | ≥ 9.0.0 < 9.0.107 ≥ 10.1.0 < 10.1.43 ≥ 11.0.0 < 11.0.9 | 7.5 | — | 2025-07-11 | |
| CVE-2025-52434 | Apache Tomcat: APR/Native Connector crash leading to DoS | ≥ 9.0.0 < 9.0.107 | 7.5 | — | 2025-07-11 | |
| CVE-2025-49124 | Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows | ≥ 9.0.23 < 9.0.106 ≥ 10.1.0 < 10.1.42 ≥ 11.0.0 < 11.0.8 | 8.4 | — | 2025-06-16 | |
| CVE-2025-49125 | Apache Tomcat: Security constraint bypass for pre/post-resources | ≥ 9.0.0 < 9.0.106 ≥ 10.1.0 < 10.1.42 ≥ 11.0.0 < 11.0.8 | 7.5 | — | 2025-06-16 | |
| CVE-2025-48988 | Apache Tomcat: FileUpload large number of parts with headers DoS | ≥ 9.0.0 < 9.0.106 ≥ 10.1.0 < 10.1.42 ≥ 11.0.0 < 11.0.8 | 7.5 | — | 2025-06-16 | |
| CVE-2025-46701 | Apache Tomcat: Security constraint bypass for CGI scripts | ≥ 9.0.0 < 9.0.105 ≥ 10.1.0 < 10.1.41 ≥ 11.0.0 < 11.0.7 | 7.3 | — | 2025-05-30 | |
| CVE-2025-31651 | Apache Tomcat: Bypass of rules in Rewrite Valve | ≥ 9.0.0 < 9.0.104 ≥ 10.1.0 < 10.1.40 ≥ 11.0.0 < 11.0.6 | 9.8 | — | 2025-04-29 | |
| CVE-2025-31650 | Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame | ≥ 9.0.76 < 9.0.104 ≥ 10.1.10 < 10.1.40 ≥ 11.0.1 < 11.0.6 | 7.5 | — | 2025-04-29 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).