Skip to main content

Apache Tomcat CVE-2026-41284

| EUVDEUVD-2026-29513 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-05-12 apache GHSA-gx5v-xp9w-j4cg
Denial Of Service Apache Red Hat Tomcat Apache Tomcat Apache Software Foundation
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jun 08, 2026 - 09:06 vuln.today
CVSS changed
May 13, 2026 - 16:22 NVD
7.5 (HIGH)
CVE Published
May 12, 2026 - 15:14 nvd
UNKNOWN (no severity yet)
CVE Published
May 12, 2026 - 15:14 nvd
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 2 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (2 direct, 0 indirect)
  • 2 maven packages depend on org.apache.tomcat:tomcat-catalina (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 10.1.0-M1 and other introduced versions.

DescriptionCVE.org

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

AnalysisAI

Denial of service in Apache Tomcat 9.x, 10.1.x, and 11.0.x allows remote unauthenticated attackers to exhaust server resources due to missing limits or throttling on a resource allocation path (CWE-770). Affected versions span 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, and 9.0.0.M1 through 9.0.117, with older unsupported branches also implicated per the EUVD entry. No public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 5th percentile), but the SSVC framework flags the issue as automatable with partial technical impact.

Technical ContextAI

Apache Tomcat is the reference open-source implementation of the Jakarta Servlet, JSP, EL, WebSocket, and JASPIC specifications, widely deployed as a Java application server in front of or alongside enterprise applications. The root cause class CWE-770 (Allocation of Resources Without Limits or Throttling) means that some code path in the connector, request processing, or protocol handling pipeline accepts attacker-controlled input that triggers allocation of memory, threads, file descriptors, or similar resources without bounding the consumption. CPE coverage (cpe:2.3:a:apache_software_foundation:apache_tomcat) and the EUVD entry confirm three actively supported branches (9.x, 10.1.x, 11.0.x) plus legacy 8.5.x and 7.0.x lines as affected, indicating the unbounded allocation logic is long-standing rather than newly introduced.

RemediationAI

Patch available per vendor advisory - upgrade to the fixed Apache Tomcat release noted in the Apache dev list announcement at https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc (the description supplied to this analysis contains the literal placeholder [FIXED_VERSION], so confirm the precise patched build for your branch directly from the Apache advisory and from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-41284 before rollout); SUSE and HeroDevs (https://www.herodevs.com/vulnerability-directory/cve-2026-41284) also publish branch-specific guidance for distribution and legacy users. Until patches are deployed, place Tomcat behind a reverse proxy or WAF that enforces per-connection request size, header count, and request-rate limits, tighten Connector attributes such as maxConnections, maxThreads, connectionTimeout, maxHttpHeaderSize, and maxParameterCount to bounded values, and restrict exposure of management connectors to trusted networks; note that aggressive request-size or rate limits may break large legitimate uploads or chatty integrations, so size them against observed traffic.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2020-13935 HIGH POC
7.5 Jul 14

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
CVE-2022-29885 HIGH POC
7.5 May 12

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78

CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2020-9484 HIGH POC
7.0 May 20

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
CVE-2014-0227 MEDIUM
6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2023-24998 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed

Share

CVE-2026-41284 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy