How many CVEs have patched init?

9 published CVEs changed init in apache/tomcat, in 18 distinct patches totalling 71 changed lines, between 2011 and 2026.

What is the latest CVE that changed init?

CVE-2026-41284 (Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling), published 2026-05-12, changed lines 307 to 310 of java/org/apache/catalina/servlets/WebdavServlet.java.

How does init compare to the rest of apache/tomcat?

apache/tomcat has 135 CVEs with a located fix in total; 9 of them changed init.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

init in apache/tomcat: Patched by 9 CVEs

Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

CVE-2026-41284 · java/org/apache/catalina/servlets/WebdavServlet.java · lines 307–310 · +4 −0

High · CVSS 7.5

EPSS 0.9%2026-05-12

Apache Tomcat: Security constraint bypass for CGI scripts

CVE-2025-46701 · java/org/apache/catalina/servlets/CGIServlet.java · lines 387–393 · +7 −0

Low · CVSS 1.7

EPSS 2.9%2025-05-29

Missing Release of Resource after Effective Lifetime in Apache Tomcat

CVE-2021-42340 · java/org/apache/tomcat/websocket/server/WsHttpUpgradeHandler.java · line 103 · +1 −0

High · CVSS 7.5

EPSS 11.8%2021-10-14

Apache Tomcat vulnerable to SecurityManager bypass

CVE-2016-6796 · java/org/apache/jasper/servlet/JspServlet.java · lines 92–96 · +5 −0

High · CVSS 7.5

EPSS 8.3%2017-08-11

Improper Input Validation in Apache Tomcat

CVE-2016-6816 · java/org/apache/coyote/http11/InternalNioInputBuffer.java · line 777 · +1 −1

High · CVSS 7.1

EPSS 39.6%2017-03-20

Improper Access Control in Apache Tomcat

CVE-2016-5388 · java/org/apache/catalina/servlets/CGIServlet.java · lines 340–343 · +4 −0

High · CVSS 8.1

EPSS 50.9%2016-07-19

Missing XML Validation in Apache Tomcat

CVE-2014-0119 · java/org/apache/jasper/compiler/TagPluginManager.java · lines 77–104 · +28 −1

Medium · CVSS 4.3

EPSS 7.6%2014-05-31

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

CVE-2013-4590 · java/org/apache/catalina/startup/ContextConfig.java · line 733 · +1 −1

Medium · CVSS 4.3

EPSS 9.5%2014-02-26

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

CVE-2013-4590 · java/org/apache/catalina/startup/TldConfig.java · lines 571–572 · +2 −1

Medium · CVSS 4.3

EPSS 9.5%2014-02-26

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

CVE-2013-4590 · java/org/apache/jasper/compiler/TagPluginManager.java · lines 65–74 · +10 −1

Medium · CVSS 4.3

EPSS 9.5%2014-02-26

Apache Tomcat Allows Replacing of XML Parser

CVE-2011-2481 · java/org/apache/catalina/startup/ContextConfig.java · lines 853–855 · +3 −0

Medium · CVSS 4.6

EPSS 0.8%2011-08-15

init

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track apache/tomcat CVEs