How many CVEs have patched recycle?

9 published CVEs changed recycle in apache/tomcat, in 25 distinct patches totalling 65 changed lines, between 2010 and 2026.

What is the latest CVE that changed recycle?

CVE-2026-24880 (Apache Tomcat: Request smuggling via invalid chunk extension), published 2026-04-09, changed lines 256 of java/org/apache/coyote/http11/filters/ChunkedInputFilter.java.

How does recycle compare to the rest of apache/tomcat?

apache/tomcat has 135 CVEs with a located fix in total; 9 of them changed recycle.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

recycle in apache/tomcat: Patched by 9 CVEs

Apache Tomcat: Request smuggling via invalid chunk extension

CVE-2026-24880 · java/org/apache/coyote/http11/filters/ChunkedInputFilter.java · line 256 · +1 −1

High · CVSS 7.5

EPSS 0.7%2026-04-09

Apache Tomcat: HTTP request smuggling via malformed trailer headers

CVE-2023-46589 · java/org/apache/catalina/connector/Request.java · line 454 · +1 −0

High · CVSS 7.5

EPSS 2.7%2023-11-28

Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

CVE-2023-42795 · java/org/apache/catalina/connector/Request.java · lines 446–504 · +4 −3 in 2 hunks

Medium · CVSS 5.3

EPSS 2.5%2023-10-10

Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

CVE-2023-42795 · java/org/apache/catalina/core/ApplicationHttpRequest.java · lines 617–622 · +6 −1

Medium · CVSS 5.3

EPSS 2.5%2023-10-10

Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

CVE-2023-42795 · java/org/apache/tomcat/util/buf/B2CConverter.java · lines 129–134 · +6 −1

Medium · CVSS 5.3

EPSS 2.5%2023-10-10

Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

CVE-2023-42795 · java/org/apache/tomcat/util/buf/C2BConverter.java · lines 60–65 · +6 −1

Medium · CVSS 5.3

EPSS 2.5%2023-10-10

Improper Input Validation in Apache Tomcat

CVE-2016-6816 · java/org/apache/coyote/http11/InternalAprInputBuffer.java · lines 109–116 · +3 −3

High · CVSS 7.1

EPSS 39.6%2017-03-20

Improper Input Validation in Apache Tomcat

CVE-2016-6816 · java/org/apache/coyote/http11/InternalNioInputBuffer.java · line 182 · +1 −1

High · CVSS 7.1

EPSS 39.6%2017-03-20

Improper Neutralization of Input During Web Page Generation in Apache Tomcat

CVE-2015-5346 · java/org/apache/catalina/connector/Request.java · line 503 · +1 −12

High · CVSS 8.1

EPSS 10.6%2016-02-25

Improper Input Validation in Apache Tomcat

CVE-2014-0227 · java/org/apache/coyote/http11/filters/ChunkedInputFilter.java · line 280 · +1 −0

Medium · CVSS 6.4

EPSS 21.0%2015-02-16

Denial of service in Apache Tomcat

CVE-2014-0095 · java/org/apache/coyote/ajp/AbstractAjpProcessor.java · line 898 · +0 −1

Medium · CVSS 5.0

EPSS 8.5%2014-05-31

Apache Tomcat Denial of Service vulnerability

CVE-2013-4322 · java/org/apache/coyote/http11/filters/ChunkedInputFilter.java · line 267 · +1 −0

Medium · CVSS 4.3

EPSS 9.5%2014-02-26

Apache Tomcat does not properly handle an invalid Transfer-Encoding header

CVE-2010-2227 · java/org/apache/coyote/http11/filters/BufferedInputFilter.java · lines 105–110 · +6 −4

Medium · CVSS 6.4

EPSS 54.8%2010-07-13

recycle

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track apache/tomcat CVEs