Skip to main content

Apache Tomcat CVE-2026-41293

| EUVDEUVD-2026-29514 CRITICAL
Improper Input Validation (CWE-20)
2026-05-12 apache GHSA-r29c-68gh-xp6x
Tomcat Information Disclosure Apache Apache Tomcat
Critical
Disputed · 9.8 NVD
Share

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.6 HIGH

Network-reachable, low-complexity, no-auth per vendor vector, but the 'Information Disclosure' tag and CWE-20 point to confidentiality as the primary impact, so I:H/A:H are reduced pending confirmation.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
7.3 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 23, 2026 - 22:28 vuln.today
CVSS changed
May 14, 2026 - 20:22 NVD
9.8 (CRITICAL)
CVE Published
May 12, 2026 - 15:19 nvd
CRITICAL 9.8
CVE Published
May 12, 2026 - 15:19 nvd
UNKNOWN (no severity yet)

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 4 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (4 direct, 0 indirect)
  • 2 maven packages depend on org.apache.tomcat:tomcat-catalina (2 direct, 0 indirect)
  • 6 maven packages depend on org.apache.tomcat:tomcat-coyote (3 direct, 3 indirect)

Ecosystem-wide dependent count for version 8.5.0 and other introduced versions.

DescriptionCVE.org

Improper Input Validation vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected.

Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

AnalysisAI

Improper input validation in Apache Tomcat (CWE-20) affects a broad range of releases across the 8.5, 9.0, 10.0, 10.1, and 11.0 branches, with the NVD assigning a critical CVSS 9.8 and a network/no-auth vector. No public exploit has been identified at time of analysis and the EPSS probability is only 0.04% (11th percentile), and CISA SSVC records exploitation status as none. Note a signal conflict: the intelligence tags label this 'Information Disclosure' while the official CVSS claims full confidentiality, integrity, and availability impact - the terse advisory does not resolve which is correct.

Technical ContextAI

Apache Tomcat is the Apache Software Foundation's open-source implementation of the Jakarta Servlet, WebSocket, and JSP specifications, serving as one of the most widely deployed Java application/servlet containers in enterprise environments. The CPE 'cpe:2.3:a:apache_software_foundation:apache_tomcat:*' confirms the affected component is the Tomcat server itself rather than a bundled dependency. The root cause is classified as CWE-20 (Improper Input Validation), a broad weakness class in which the software fails to correctly validate the properties of input data before processing it; the published advisory does not specify which component (request parser, header handling, or a specific connector/feature) performs the deficient validation, so the exact trigger surface is not disclosed in the available data.

RemediationAI

Patch available per vendor advisory: upgrade to the fixed release on your branch as directed by the Apache advisory at https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r. The upstream description references a specific fixed version but the exact fixed build was supplied only as a placeholder ([FIXED_VERSION]) in the available data, so consult the Apache advisory or your distribution's notice for the precise patched version on your branch (11.0.x, 10.1.x, 10.0.x, 9.0.x, or 8.5.x) rather than relying on an inferred number. Distribution users should apply vendor packages directly - Ubuntu via USN-8417-1 (https://ubuntu.com/security/notices/USN-8417-1), and equivalent Red Hat and SUSE updates. Because the deficient input-validation surface is not publicly detailed, no reliable configuration-level workaround can be named; as compensating controls pending patching, restrict network exposure of Tomcat connectors to trusted networks or place the server behind a hardened reverse proxy/WAF that normalizes and validates inbound requests, accepting that a WAF cannot reliably block an undisclosed parsing flaw and may add latency.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2020-13935 HIGH POC
7.5 Jul 14

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2020-9484 HIGH POC
7.0 May 20

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
CVE-2014-0227 MEDIUM
6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and
CVE-2026-34486 HIGH POC
7.5 Apr 09

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed

Share

CVE-2026-41293 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy