Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 3 total.
Improper input validation of HTTP/2 request headers in Apache Tomcat (CVE-2026-41293)
Apache Tomcat failed to validate HTTP/2 request headers, potentially exposing header values through the Servlet API that were not compliant with the HTTP specification. This could trigger unexpected application behavi...
Fixed in Apache Tomcat 11.0.22; Apache Tomcat 10.1.55; Apache Tomcat 9.0.118
Authentication bypass in Apache Tomcat digest authenticator (CVE-2026-43512)
When DIGEST authentication is configured in Apache Tomcat, any user not known to the configured Realm is authenticated if they present the password "null". This allows unauthorized users to bypass authentication contr...
Fixed in 11.0.22; 10.1.55; 9.0.118
Improper authorization in Apache Tomcat security constraints (CVE-2026-43515)
When multiple security constraints define an HTTP method constraint for the same extension pattern, only the first method constraint is applied. This incorrect application of security constraints constitutes an improp...
Fixed in 11.0.22; 10.1.55; 9.0.118