How many CVEs does Apache Software Foundation tomcat have?

Apache Software Foundation tomcat has 265 published CVE records since 2000.

How many Apache Software Foundation tomcat CVEs are in CISA KEV?

Yes — 6 of Apache Software Foundation tomcat's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for Apache Software Foundation tomcat vulnerabilities?

Yes — 74 of Apache Software Foundation tomcat's CVEs have a known public exploit.

Which versions of Apache Software Foundation tomcat are affected?

1,711 distinct Apache Software Foundation tomcat versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Apache Software Foundation tomcat CVEs?

Apache Software Foundation tomcat's CVEs most often map to these CWE weakness types: CWE-20 (Improper Input Validation), CWE-400 (Uncontrolled Resource Consumption), CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

How many critical Apache Software Foundation tomcat vulnerabilities are there?

Apache Software Foundation tomcat has 17 critical and 83 high-severity CVEs.

What is the average severity of Apache Software Foundation tomcat CVEs?

The average CVSS base score across Apache Software Foundation tomcat's scored CVEs is 6.1.

Apache Software Foundation tomcat Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every Apache Software Foundation tomcat version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

9.0.0-M942 CVEs
9.0.0-M141 CVEs
9.0.0-M1140 CVEs
9.0.0-M540 CVEs
9.0.0-M640 CVEs
9.0.0-M840 CVEs
9.0.0-M739 CVEs
9.0.0-M338 CVEs
9.0.0-M438 CVEs
9.0.0-M1037 CVEs
9.0.0-M1337 CVEs
9.0.0-M237 CVEs
9.0.0-M1236 CVEs
9.0.0-M1536 CVEs
9.0.0-M1435 CVEs
9.0.0-M1635 CVEs
9.0.0-M1735 CVEs
9.0.0-M1834 CVEs
9.0.0-M1931 CVEs
9.0.0-M2031 CVEs
9.0.0-M2130 CVEs
9.0.0-M2228 CVEs
9.0.0-M2528 CVEs
9.0.0-M2628 CVEs
9.0.0-M2327 CVEs
9.0.0-M2427 CVEs
9.0.0-M2727 CVEs
7.0.024 CVEs
9.0.024 CVEs
10.0.022 CVEs
8.5.417 CVEs
11.0.0-M215 CVEs
11.0.0-M314 CVEs
11.0.0-M414 CVEs
11.0.0-M514 CVEs
11.0.013 CVEs
11.0.0-M113 CVEs
11.0.0-M1013 CVEs
11.0.0-M613 CVEs
11.0.0-M713 CVEs
11.0.0-M813 CVEs
11.0.0-M913 CVEs
7.0.7013 CVEs
8.5.013 CVEs
7.0.6412 CVEs
10.1.0-M111 CVEs
10.1.0-M211 CVEs
10.1.0-M311 CVEs
10.1.0-M411 CVEs
10.1.0-M511 CVEs
11.0.0-M1111 CVEs
8.5.111 CVEs
8.5.211 CVEs
8.5.311 CVEs
8.5.511 CVEs
8.5.611 CVEs
10.0.0-M110 CVEs
10.0.0-M210 CVEs
10.0.0-M310 CVEs
10.0.0-M410 CVEs
10.0.0-M510 CVEs
10.1.0-M610 CVEs
10.1.0-M710 CVEs
10.1.0-M810 CVEs
7.0.4110 CVEs
7.0.4210 CVEs
7.0.4710 CVEs
7.0.5010 CVEs
7.0.5410 CVEs
7.0.5510 CVEs
7.0.5610 CVEs
7.0.5710 CVEs
7.0.5910 CVEs
7.0.610 CVEs
7.0.6110 CVEs
7.0.6210 CVEs
7.0.6310 CVEs
7.0.6510 CVEs
7.0.6710 CVEs
8.5.710 CVEs
8.5.810 CVEs
10.0.0-M69 CVEs
10.1.0-M109 CVEs
10.1.0-M119 CVEs
10.1.0-M129 CVEs
10.1.0-M99 CVEs
11.0.0-M129 CVEs
11.0.0-M139 CVEs
11.0.0-M149 CVEs
11.0.0-M159 CVEs
11.0.0-M169 CVEs
7.0.119 CVEs
7.0.129 CVEs
7.0.149 CVEs
7.0.169 CVEs
7.0.199 CVEs
7.0.209 CVEs
7.0.219 CVEs
7.0.229 CVEs
7.0.239 CVEs
7.0.259 CVEs
7.0.269 CVEs
7.0.279 CVEs
7.0.289 CVEs
7.0.299 CVEs
7.0.309 CVEs
7.0.329 CVEs
7.0.339 CVEs
7.0.349 CVEs
7.0.359 CVEs
7.0.379 CVEs
7.0.399 CVEs
7.0.409 CVEs
8.5.99 CVEs
10.1.0-M138 CVEs
10.1.0-M148 CVEs
7.0.108 CVEs
7.0.528 CVEs
7.0.538 CVEs
8.5.108 CVEs
8.5.118 CVEs
10.0.0-M77 CVEs
10.1.0-M157 CVEs
10.1.0-M167 CVEs
11.0.0-M177 CVEs
11.0.0-M187 CVEs
11.0.0-M197 CVEs
11.0.0-M207 CVEs
7.0.437 CVEs
7.0.447 CVEs
7.0.457 CVEs
7.0.467 CVEs
7.0.487 CVEs
7.0.497 CVEs
7.0.587 CVEs
7.0.607 CVEs
7.0.667 CVEs
7.0.687 CVEs
7.0.697 CVEs
7.0.717 CVEs
7.0.727 CVEs
8.5.127 CVEs
10.0.0-M86 CVEs
10.0.0-M96 CVEs
10.1.0-M176 CVEs
11.0.0-M236 CVEs
11.0.0-M246 CVEs
11.0.0-M256 CVEs
7.0.16 CVEs
7.0.136 CVEs
7.0.156 CVEs
7.0.176 CVEs
7.0.186 CVEs
7.0.26 CVEs
7.0.246 CVEs
7.0.36 CVEs
7.0.316 CVEs
7.0.366 CVEs
7.0.386 CVEs
7.0.46 CVEs
7.0.56 CVEs
7.0.76 CVEs
7.0.736 CVEs
7.0.86 CVEs
7.0.96 CVEs
10.0.0-M105 CVEs
10.1.0-M185 CVEs
10.1.0-M195 CVEs
10.1.0-M205 CVEs
11.0.0-M215 CVEs
11.0.0-M225 CVEs
7.0.515 CVEs
7.0.745 CVEs
7.0.755 CVEs
11.0.0-M264 CVEs
7.0.764 CVEs
8.5.134 CVEs
8.5.144 CVEs
8.5.314 CVEs
9.0.364 CVEs
7.0.773 CVEs
8.5.153 CVEs
8.5.273 CVEs
8.5.393 CVEs
8.5.563 CVEs
9.0.13 CVEs
9.0.173 CVEs
9.0.353 CVEs
9.0.43 CVEs
9.0.93 CVEs
10.0.12 CVEs
10.1.0-milestone102 CVEs
10.1.0-milestone112 CVEs
10.1.0-milestone122 CVEs
10.1.0-milestone132 CVEs
10.1.0-milestone142 CVEs
10.1.0-milestone152 CVEs
10.1.0-milestone162 CVEs
10.1.0-milestone172 CVEs
10.1.0-milestone182 CVEs
10.1.0-milestone192 CVEs
10.1.0-milestone202 CVEs
10.1.0-milestone72 CVEs
10.1.0-milestone82 CVEs
10.1.0-milestone92 CVEs
11.0.0-milestone142 CVEs
11.0.0-milestone152 CVEs
11.0.0-milestone162 CVEs
11.0.0-milestone172 CVEs
11.0.0-milestone182 CVEs
11.0.0-milestone192 CVEs
11.0.0-milestone202 CVEs
11.0.0-milestone212 CVEs
11.0.0-milestone222 CVEs
11.0.0-milestone232 CVEs
11.0.0-milestone242 CVEs
11.0.0-milestone252 CVEs
11.0.0-milestone262 CVEs
7.0.792 CVEs
7.0.842 CVEs
7.0.882 CVEs
7.0.932 CVEs
8.0.0-TT.12 CVEs
8.5.232 CVEs
8.5.302 CVEs
8.5.332 CVEs
8.5.372 CVEs
8.5.402 CVEs
8.5.472 CVEs
8.5.492 CVEs
8.5.502 CVEs
8.5.552 CVEs
8.5.592 CVEs
8.5.612 CVEs
9.0.112 CVEs
9.0.142 CVEs
9.0.192 CVEs
9.0.22 CVEs
9.0.282 CVEs
9.0.292 CVEs
9.0.32 CVEs
9.0.302 CVEs
9.0.372 CVEs
9.0.392 CVEs
9.0.412 CVEs
9.0.72 CVEs
9.0.82 CVEs
tomee-8.0.12 CVEs
tomee-8.0.22 CVEs
tomee-8.0.52 CVEs
tomee-8.0.62 CVEs
tomee-project-8.0.32 CVEs
tomee-project-8.0.42 CVEs
tomee-project-8.0.72 CVEs
tomee-project-8.0.82 CVEs
tomee-project-8.0.92 CVEs
tomee-project-9.0.02 CVEs
tomee-project-9.0.0-M82 CVEs
tomee-project-9.0.0.RC12 CVEs
10.0.141 CVE
10.0.181 CVE
10.0.21 CVE
10.0.201 CVE
10.0.221 CVE
10.0.31 CVE
10.0.41 CVE
10.0.61 CVE
10.1.0-milestone11 CVE
10.1.0-milestone21 CVE
10.1.0-milestone31 CVE
10.1.0-milestone41 CVE
10.1.0-milestone51 CVE
10.1.0-milestone61 CVE
10.1.0-NA1 CVE
10.1.11 CVE
10.1.121 CVE
10.1.311 CVE
10.1.531 CVE
10.1.71 CVE
10.1.81 CVE
11.0.0-milestone11 CVE
11.0.0-milestone101 CVE
11.0.0-milestone111 CVE
11.0.0-milestone121 CVE
11.0.0-milestone131 CVE
11.0.0-milestone21 CVE
11.0.0-milestone31 CVE
11.0.0-milestone41 CVE
11.0.0-milestone51 CVE
11.0.0-milestone61 CVE
11.0.0-milestone71 CVE
11.0.0-milestone81 CVE
11.0.0-milestone91 CVE
11.0.201 CVE
7.0.0 to 7.0.931 CVE
7.0.1041 CVE
7.0.1061 CVE
7.0.1071 CVE
7.0.781 CVE
7.0.801 CVE
7.0.821 CVE
7.0.861 CVE
7.0.901 CVE
7.0.971 CVE
7.0.981 CVE
7.0.991 CVE
8.5.0 to 8.5.391 CVE
8.5.1001 CVE
8.5.161 CVE
8.5.171 CVE
8.5.181 CVE
8.5.191 CVE
8.5.201 CVE
8.5.211 CVE
8.5.221 CVE
8.5.241 CVE
8.5.251 CVE
8.5.261 CVE
8.5.281 CVE
8.5.291 CVE
8.5.321 CVE
8.5.341 CVE
8.5.351 CVE
8.5.361 CVE
8.5.381 CVE
8.5.411 CVE
8.5.421 CVE
8.5.431 CVE
8.5.441 CVE
8.5.451 CVE
8.5.461 CVE
8.5.481 CVE
8.5.511 CVE
8.5.521 CVE
8.5.531 CVE
8.5.541 CVE
8.5.571 CVE
8.5.641 CVE
8.5.661 CVE
8.5.731 CVE
8.5.771 CVE
8.5.781 CVE
8.5.811 CVE
8.5.831 CVE
8.5.871 CVE
8.5.881 CVE
8.5.921 CVE
9.0.0-milestone231 CVE
9.0.0-milestone241 CVE
9.0.0-milestone251 CVE
9.0.0-milestone261 CVE
9.0.0-milestone271 CVE
9.0.0.M1 to 9.0.171 CVE
9.0.101 CVE
9.0.1161 CVE
9.0.121 CVE
9.0.131 CVE
9.0.151 CVE
9.0.161 CVE
9.0.181 CVE
9.0.201 CVE
9.0.211 CVE
9.0.221 CVE
9.0.231 CVE
9.0.241 CVE
9.0.251 CVE
9.0.261 CVE
9.0.271 CVE
9.0.311 CVE
9.0.321 CVE
9.0.331 CVE
9.0.341 CVE
9.0.381 CVE
9.0.441 CVE
9.0.461 CVE
9.0.51 CVE
9.0.561 CVE
9.0.61 CVE
9.0.601 CVE
9.0.621 CVE
9.0.641 CVE
9.0.731 CVE
9.0.741 CVE
9.0.791 CVE
9.0.961 CVE
before_interruptible1 CVE
debian_version_0_95-11 CVE
debian_version_1_0-11 CVE
fuse_0_91 CVE
fuse_0_951 CVE
fuse_1_11 CVE
fuse_1_1_pre21 CVE
fuse_1_91 CVE
fuse_2_0_pre01 CVE
fuse_2_21 CVE
fuse_2_2_pre11 CVE
fuse_2_2_pre41 CVE
fuse_2_2_pre51 CVE
fuse_2_2_pre61 CVE
fuse_2_3_01 CVE
fuse_2_3_pre11 CVE
fuse_2_3_pre21 CVE
fuse_2_3_pre31 CVE
fuse_2_3_pre41 CVE
fuse_2_3_pre51 CVE
fuse_2_3_pre61 CVE
fuse_2_3_pre71 CVE
fuse_2_3_rc11 CVE
fuse_2_4_01 CVE
fuse_2_4_0_pre21 CVE
fuse_2_4_0_rc11 CVE
fuse_2_4_11 CVE
fuse_2_5_01 CVE
fuse_2_5_0_pre11 CVE
fuse_2_5_0_pre21 CVE
fuse_2_6_01 CVE
fuse_2_6_0_pre11 CVE
fuse_2_6_0_pre21 CVE
fuse_2_6_0_pre31 CVE
fuse_2_6_0_rc11 CVE
fuse_2_6_0_rc21 CVE
fuse_2_6_0_rc31 CVE
fuse_2_6_11 CVE
fuse_2_7_01 CVE
fuse_2_7_0_rc11 CVE
fuse_2_7_11 CVE
fuse_2_7_21 CVE
fuse_2_7_2_before_indent1 CVE
fuse_2_8_01 CVE
fuse_2_8_0_pre21 CVE
fuse_2_8_11 CVE
fuse_2_8_21 CVE
fuse_2_8_31 CVE
fuse_2_8_41 CVE
fuse_2_8_start1 CVE
fuse_2_9_01 CVE
fuse_2_9_11 CVE
fuse_2_9_21 CVE
fuse_2_9_31 CVE
fuse_2_9_41 CVE
fuse_2_9_51 CVE
fuse_2_9_start1 CVE
fuse_3_0_start1 CVE
fuse-3.0.01 CVE
fuse-3.0.0pre01 CVE
fuse-3.0.0rc11 CVE
fuse-3.0.0rc21 CVE
fuse-3.0.0rc31 CVE
fuse-3.0.11 CVE
fuse-3.0.21 CVE
fuse-3.1.01 CVE
fuse-3.1.11 CVE
fuse-3.2.01 CVE
start1 CVE
tomee-7.0.51 CVE
tomee-7.0.61 CVE
tomee-7.0.71 CVE
tomee-project-10.0.01 CVE
tomee-project-9.1.01 CVE

Version ranges

6.0.10 <= v <= 6.0.1057 CVEs
6.0.13 <= v <= 6.0.1357 CVEs
7.0.0 <= v <= 7.0.057 CVEs
6.0.1 <= v <= 6.0.156 CVEs
6.0.2 <= v <= 6.0.256 CVEs
7.0.2 <= v <= 7.0.256 CVEs
9.0.0 <= v <= 9.0.056 CVEs
6.0.0 <= v <= 6.0.055 CVEs
6.0.11 <= v <= 6.0.1155 CVEs
7.0.4 <= v <= 7.0.455 CVEs
6.0.12 <= v <= 6.0.1253 CVEs
6.0.4 <= v <= 6.0.453 CVEs
6.0.14 <= v <= 6.0.1452 CVEs

Fixed in

10.1.557 CVEs
11.0.227 CVEs
9.0.1187 CVEs
b4aab5184c1cf1acc0e845e0fd7306dee578e16b7 CVEs
c70966726754f8b3ab63b5ac846a7e7cf6eb255a7 CVEs
ccdf7a8c736bde0f4875a10667b21cddbd4be21f7 CVEs
10.1.536 CVEs
10.1.566 CVEs
11.0.206 CVEs
11.0.236 CVEs
1c65de6f27a3bac481514e56e3637785b65a4f2c6 CVEs
59f3f1ab4f905f94c9c99cad579d6afb3a935b666 CVEs
9.0.116

Find a version

265 CVEs

Sort

Apache Tomcat: EncryptInterceptor requirements not clearly documented
CVE-2026-59084
Patch
CWE-1059
Critical · CVSS 9.1
EPSS 0.5% (40th pct)2026-07-14
Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
CVE-2026-59083
Patch
CWE-177
Critical · CVSS 9.1
EPSS 0.4% (30th pct)2026-07-14
Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
CVE-2026-55957
Patch
CWE-304
High · CVSS 7.3
EPSS 2.7% (84th pct)2026-06-29
Apache Tomcat: Security constraints for default servlet ignored method
CVE-2026-55956
Patch
CWE-285
Medium · CVSS 6.5
EPSS 1.4% (70th pct)2026-06-29
Apache Tomcat: EncryptInterceptor not protected against replay attacks
CVE-2026-55955
Patch
CWE-287
Medium · CVSS 6.5
EPSS 0.5% (38th pct)2026-06-29
Apache Tomcat: Logged effective web.xml is incomplete
CVE-2026-55276
Patch
CWE-670
Critical · CVSS 9.1
EPSS 0.5% (42th pct)2026-06-29
Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector
CVE-2026-53434
Patch
CWE-390
Critical · CVSS 9.1
EPSS 0.5% (41th pct)2026-06-29
Apache Tomcat: Bad ornext processing in RewriteValve
CVE-2026-53404
Patch
CWE-670
High · CVSS 7.3
EPSS 0.6% (44th pct)2026-06-29
Apache Tomcat: XSS in number guess example
CVE-2026-50229
Public exploit
Patch
CWE-80
Medium · CVSS 6.1
EPSS 4.2% (90th pct)2026-06-29
Apache Tomcat: Security constraints not correctly applied
CVE-2026-43515
Patch
CWE-285
Critical · CVSS 9.1
EPSS 1.1% (63th pct)2026-05-12
Apache Tomcat: AJP secret compared in non-constant time
CVE-2026-43514
Patch
CWE-208
Low · CVSS 3.7
EPSS 0.4% (28th pct)2026-05-12
Apache Tomcat: LockOutRealm treats user names as case-sensitive
CVE-2026-43513
Patch
CWE-178
High · CVSS 7.5
EPSS 0.5% (38th pct)2026-05-12
Apache Tomcat: Digest authenticator will authenticate any unknown user
CVE-2026-43512
Patch
CWE-592
Critical · CVSS 9.8
EPSS 1.2% (66th pct)2026-05-12
Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-41293
Patch
CWE-20
Critical · CVSS 9.8
EPSS 1.3% (68th pct)2026-05-12
Apache Tomcat: WebSocket authentication header exposure
CVE-2026-42498
Patch
CWE-200
High · CVSS 7.3
EPSS 0.5% (43th pct)2026-05-12
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
CVE-2026-41284
Patch
CWE-770
High · CVSS 7.5
EPSS 0.8% (52th pct)2026-05-12
Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
CVE-2026-34500
Patch
CWE-287
Medium · CVSS 6.5
EPSS 0.5% (38th pct)2026-04-09
Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token
CVE-2026-34487
Patch
CWE-532
High · CVSS 7.5
EPSS 0.4% (37th pct)2026-04-09
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
CVE-2026-34486
Public exploit
Patch
CWE-311
High · CVSS 7.5
EPSS 42.6% (99th pct)2026-04-09
Apache Tomcat: Incomplete escaping of JSON access logs
CVE-2026-34483
Patch
CWE-116
High · CVSS 7.5
EPSS 0.5% (38th pct)2026-04-09
Apache Tomcat: Fix for CVE-2025-66614 is incomplete
CVE-2026-32990
Patch
CWE-20
Medium · CVSS 6.9
EPSS 0.3% (23th pct)2026-04-09
Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default
CVE-2026-29146
Patch
Workaround
CWE-209
High · CVSS 8.7
EPSS 6.3% (93th pct)2026-04-09
Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled
CVE-2026-29145
Patch
CWE-287
Critical · CVSS 9.1
EPSS 0.7% (50th pct)2026-04-09
Apache Tomcat: TLS cipher order is not preserved
CVE-2026-29129
Patch
CWE-327
High · CVSS 7.5
EPSS 0.3% (17th pct)2026-04-09
Apache Tomcat: Occasionally open redirect
CVE-2026-25854
Patch
CWE-601
Medium · CVSS 6.9
EPSS 0.5% (41th pct)2026-04-09
Apache Tomcat: Request smuggling via invalid chunk extension
CVE-2026-24880
Patch
CWE-444
High · CVSS 7.5
EPSS 0.5% (41th pct)2026-04-09
Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass
CVE-2026-24734
Patch
CWE-20
High · CVSS 7.5
EPSS 0.5% (40th pct)2026-02-17
Apache Tomcat: Security constraint bypass with HTTP/0.9
CVE-2026-24733
Patch
CWE-20
Low · CVSS 2.7
EPSS 0.5% (40th pct)2026-02-17
Apache Tomcat: Client certificate verification bypass due to virtual host mapping
CVE-2025-66614
Patch
CWE-20
Medium · CVSS 6.3
EPSS 0.2% (15th pct)2026-02-17
Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS
CVE-2025-61795
Patch
CWE-404
Low · CVSS 2.3
EPSS 1.2% (64th pct)2025-10-27

Showing 30 of 265

Apache Software Foundation tomcat Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other Apache Software Foundation products

Frequently asked questions

References

Track Apache Software Foundation tomcat vulnerabilities