How many CVEs have patched invoke?

9 published CVEs changed invoke in apache/tomcat, in 21 distinct patches totalling 307 changed lines, between 2011 and 2026.

What is the latest CVE that changed invoke?

CVE-2026-68525 (Apache Tomcat: Redirect after FORM auth may bypass method specific constraints), published 2026-08-25, changed lines 539 to 613 of java/org/apache/catalina/authenticator/AuthenticatorBase.java.

How does invoke compare to the rest of apache/tomcat?

apache/tomcat has 135 CVEs with a located fix in total; 9 of them changed invoke.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

invoke in apache/tomcat: Patched by 9 CVEs

Apache Tomcat: Redirect after FORM auth may bypass method specific constraints

CVE-2026-68525 · java/org/apache/catalina/authenticator/AuthenticatorBase.java · lines 539–613 · +24 −30 in 2 hunks

Critical · CVSS 9.1

EPSS 0.5%2026-08-25

Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

CVE-2025-55752 · java/org/apache/catalina/valves/rewrite/RewriteValve.java · lines 329–581 · +19 −12 in 4 hunks

High · CVSS 7.7

EPSS 64.4%2025-10-27

Apache Tomcat: session fixation via rewrite valve

CVE-2025-55668 · java/org/apache/catalina/valves/rewrite/RewriteValve.java · lines 464–582 · +5 −2 in 2 hunks

Medium · CVSS 6.5

EPSS 0.9%2025-08-13

Apache Tomcat: Bypass of rules in Rewrite Valve

CVE-2025-31651 · java/org/apache/catalina/valves/rewrite/RewriteValve.java · lines 319–560 · +62 −28 in 6 hunks

Low · CVSS 2.7

EPSS 4.2%2025-04-28

Apache Tomcat: HTTP request smuggling via malformed trailer headers

CVE-2023-46589 · java/org/apache/catalina/core/StandardWrapperValve.java · lines 199–205 · +7 −0

High · CVSS 7.5

EPSS 2.7%2023-11-28

Apache Tomcat information exposure vulnerability

CVE-2018-1305 · java/org/apache/catalina/authenticator/AuthenticatorBase.java · line 483 · +0 −7

Medium · CVSS 6.5

EPSS 14.5%2018-02-23

Exposure of Resource to Wrong Sphere in Apache Tomcat

CVE-2017-5648 · java/org/apache/catalina/core/StandardHostValve.java · lines 149–225 · +6 −6 in 5 hunks

Critical · CVSS 9.1

EPSS 13.2%2017-04-17

Access controll bypass in Apache Tomcat

CVE-2011-1183 · java/org/apache/catalina/authenticator/AuthenticatorBase.java · lines 459–570 · +56 −36 in 4 hunks

Medium · CVSS 5.8

EPSS 6.2%2011-04-08

Apache Tomcat allows remote attackers to bypass intended access restrictions

CVE-2011-1088 · java/org/apache/catalina/authenticator/AuthenticatorBase.java · lines 482–488 · +7 −0

Medium · CVSS 5.8

EPSS 6.5%2011-03-14

invoke

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track apache/tomcat CVEs