Tomcat
Monthly
Apache Tomcat Native 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 can, under a narrow timing window, down-grade the client-certificate verification requirement for connections, weakening mutual-TLS authentication for deployments that enforce client-cert auth through the APR/OpenSSL-based connector. The flaw is a CWE-366 race condition within a thread (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), so an unauthenticated network attacker must win a non-deterministic race to succeed, making exploitation probabilistic rather than guaranteed. Only Tomcat instances that actually use Tomcat Native and are configured for client-certificate verification are exposed; no public exploit identified at time of analysis, and no CISA KEV confirmation of active exploitation. Vendor-released fixes are available in 2.0.16 and 1.3.9.
Insecure-by-default OpenSSL options in Apache Tomcat Native (versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8) silently weaken the TLS layer used by the APR/OpenSSL connector, enabling insecure client-initiated renegotiation, disabling the Extended Master Secret extension, ignoring unexpected EOF (truncation), and permitting key exchanges without (EC)DHE forward secrecy. The vendor scored this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N), but our independent assessment rates it substantially lower - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - because meaningful abuse requires an on-path/man-in-the-middle attacker who can actively position themselves between client and server, and because the four options are only applied when the deployment has not explicitly overridden them. Only Tomcat instances configured with the Apache Tomcat Native (APR) TLS connector at an affected version are exposed; JSSE/NIO-based connectors are unaffected, and no public exploit code or CISA KEV entry was identified at time of analysis. Vendors/users should upgrade to Tomcat Native 2.0.16 or 1.3.9.
Denial of service via JVM crash affects Apache Tomcat Native versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8, where a buffer over-read (CWE-126) during the TLS handshake lets a malicious client terminate the server process, rated CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The flaw is reachable remotely and unauthenticated with no user interaction, but only where the APR/OpenSSL-based native TLS connector is actually deployed and handling TLS connections; Tomcat instances using the pure-Java JSSE/NIO connector are not affected. Impact is confined to availability - no confidentiality or integrity loss, no data exposure and no code execution - and no public exploit was identified at time of analysis, with no CISA KEV entry.
WebSocket message smuggling in Apache Tomcat allows a remote, unauthenticated attacker to inject or reorder messages within a compressed WebSocket stream, corrupting application-level message boundaries and undermining integrity of data exchanged over the connection. The flaw affects the 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 release lines, plus the end-of-support 8.5.0-8.5.100 and 7.0.56-7.0.109 branches, but it only triggers when the per-message-deflate compression extension has been negotiated on the WebSocket connection; deployments that serve only standard HTTP or that run WebSocket endpoints without compression are not exposed. There is no confirmed active exploitation (CISA KEV does not list this issue), no public exploit code identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none', making this a genuine but conditionally-gated integrity flaw rather than a drop-everything emergency.
HTTP/2 request smuggling in Apache Tomcat can mix up request headers between concurrent streams, allowing unauthenticated remote attackers to potentially read or alter other users' request data when the connector has HTTP/2 explicitly enabled. The flaw is a regression from the fix for CVE-2026-41293 and affects only Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121; exploitation is rated high complexity (AC:H) with limited confidentiality and integrity impact (C:L/I:L). No public exploit code has been identified at time of analysis, and the independent assessment rates this as a moderate-priority, genuine protocol-layer flaw rather than a critical emergency.
Authentication can succeed when it should have been rejected in Apache Tomcat deployments that use CLIENT_CERT (mutual-TLS) authentication with soft fail disabled, allowing network attackers to reach resources that the mutual-TLS configuration was meant to protect. The affected range is broad - 9.0.92 through 9.0.121, 10.1.22 through 10.1.59, and 11.0.0-M14 through 11.0.25 - but the flaw is gated on two non-default conditions (the CLIENT_CERT authenticator in use and soft fail turned off) and, per the vendor, only manifests in some scenarios, so it is not universally reproducible even on correctly configured vulnerable instances. No public exploit code has been identified at time of analysis, and no evidence of active exploitation is present; the attacker needs network reachability to the mTLS-protected listener.
Denial of service in Apache Tomcat's asynchronous WebSocket write path allows remote, unauthenticated attackers to exhaust server resources by triggering lost write timeouts, so non-blocking WebSocket sends are never released after their effective lifetime. All maintained branches are affected - 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121, plus the end-of-life 8.5.0-8.5.100 and 7.0.43-7.0.109 lines - although exposure is bounded to instances whose deployed applications actually perform asynchronous (non-blocking) WebSocket writes; servers with no WebSocket endpoints or only synchronous writes are not exposed. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only) and CISA's SSVC assessment records no observed exploitation, with no public exploit code identified at time of analysis; the primary risk is sustained resource pressure that degrades or halts the affected connector rather than data compromise.
Apache Tomcat 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121 can cause an unrelated user's request to fail when a malformed request triggers incomplete cleanup of request-processing state on a reachable HTTP connector. No authentication or user interaction is required, but the effect is fundamentally gated by a race window - the advisory itself states the failure occurs only 'depending on timing' - so it is non-deterministic and cannot be reliably triggered on demand, and the realistic worst case is intermittent failure of another user's individual request rather than sustained denial of service, data disclosure, or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 7.3 base score reflects low impact across confidentiality, integrity, and availability, though our assessment rates attack complexity as High rather than Low.
Denial of service in Apache Tomcat allows an attacker to pin an AJP processing thread through a single AJP request, exhausting the connector's limited thread pool (CWE-770, allocation of resources without limits or throttling). The affected range is broad: 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, plus the end-of-life branches 8.5.0-8.5.100 and 7.0.0-7.0.109, which remain affected even though they are no longer supported. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS score in the input; the independent assessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only impact), but exploitation requires the AJP connector to be enabled and network-reachable, which has not been the default configuration since Tomcat 9.0.31.
Uncontrolled resource consumption in Apache Tomcat's WebSocket close-message handling allows unauthenticated remote attackers to exhaust server resources and degrade availability on instances that expose WebSocket endpoints. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the impact is limited to availability (Low) with no confidentiality or integrity effect, and no user interaction is required. Affected releases are 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, 9.0.74 through 9.0.121, plus the end-of-life 8.5.88 through 8.5.100 line; fixes are available in 11.0.26, 10.1.60, and 9.0.122. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, but the low attack complexity and unauthenticated network reachability make prompt patching advisable for any deployment using WebSockets.
Apache Tomcat's HTTP/2 connector harbors a race condition (CWE-362) that allows unauthenticated remote attackers to inject trailer fields into another user's concurrent HTTP/2 request, resulting in high confidentiality and integrity impact without affecting availability. Affected versions are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.39 through 9.0.121, and the end-of-life 8.5.59 through 8.5.100; exploitation is conditional on winning a concurrency race and only applies when the HTTP/2 upgrade protocol is enabled and actively serving traffic. No public exploit code or active exploitation has been identified at time of analysis, and the overall threat is considered credible but conditional.
Authentication bypass in Apache Tomcat allows unauthenticated remote attackers to reach WebSocket endpoints that are supposed to be protected by container-managed security constraints, simply by referencing the endpoint under an alternate name so the constraint is never matched. Exploitation requires only that the application expose one or more WebSocket endpoints and rely on container-level (web.xml security-constraint) authentication or authorization rules to guard them; no credentials, no user interaction, and no non-default configuration beyond that are needed, and per the CVSS vector (PR:N) the attack is unauthenticated and network-reachable. Affected lines are Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, plus end-of-support 8.5.0-8.5.100 and 7.0.43-7.0.109; no public exploit code has been identified at time of analysis and Apache has released fixed versions 11.0.26, 10.1.60 and 9.0.122.
Cross-application authentication realm leakage in Apache Tomcat's Jakarta Authentication integration causes requests to be validated against the realm established by whichever co-hosted web application authenticated first, breaking per-application authentication boundaries. The flaw (CWE-287, improper authentication) affects Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M4 through 9.0.121, plus end-of-life 8.5.0 through 8.5.100. Exploitation is gated by a non-default deployment - SimpleAuthConfigProvider as the default Jakarta Authentication provider with two or more applications sharing it - and the independent assessment rates the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (unauthenticated, high attack complexity, low impact); no public exploit identified at time of analysis, the issue is not in CISA KEV, and the vulnerable configuration is not Tomcat's default.
Authorization bypass in Eclipse Arrowhead 5.0.0-5.2.1 allows any authenticated system - regardless of privilege level - to reach every protected management API endpoint by submitting percent-encoded paths that defeat the raw-URL substring check while still being routed by Spring MVC's decoded dispatcher. Exploiting the flaw is trivial: encoding a single character in '/mgmt/' (e.g. 'm' → '%6D') causes the filter to fall through without authorizing the request, yet Tomcat decodes and dispatches it normally. The highest-impact target is POST /authentication/mgmt/identities, which creates new sysop-level accounts, yielding full administrative takeover of the Arrowhead local cloud. No public exploit has been identified at time of analysis.
Authentication bypass in Eclipse Arrowhead 5.0.0 through 5.2.1 lets an unauthenticated attacker who can publish to the MQTT broker impersonate the cloud's system operator. When the MQTT API runs with the certificate authentication policy, CertificateMqttFilter reads an X.509 certificate straight from the MQTT message payload and trusts its Subject DN without ever verifying the signature or issuer chain, reducing authorization to two string comparisons on public, attacker-controlled values. By minting a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu and dnQualifier=op, the attacker gains isSysOp==true and full management access. No public exploit is identified at time of analysis, but the technique is described in full detail in the advisory.
Uncontrolled resource consumption in Apache Tomcat's HTTP/2 implementation allows remote unauthenticated attackers to exhaust server memory by repeatedly opening and resetting HTTP/2 streams, exploiting an allocation leak in the backlog tracking mechanism that fails to release memory on stream reset. Affected branches span Tomcat 9.0.39-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24, with EOL branch 8.5.59-8.5.100 also confirmed vulnerable but unpatchable. No public exploit has been identified at time of analysis; EPSS stands at a low 0.22%, but the unauthenticated network vector and high availability impact make this operationally significant for any HTTP/2-enabled Tomcat deployment.
Improper Authentication in Apache Tomcat allows a remote, low-privileged attacker to gain authenticated access to applications even when the presented identity does not exist in the configured DataSourceRealm. The flaw is triggered specifically under CLIENT-CERT or SPNEGO authentication schemes, causing Tomcat to grant a session to a non-existent user. No public exploit or CISA KEV listing is present at time of analysis, but the CVSS C:H/I:H impact rating reflects the potential to fully compromise protected application resources if exploited in matching deployments.
Authorization bypass in Apache Tomcat's FORM-based authentication lets attackers reach protected resources that a security constraint was meant to restrict, defeating rules that grant a role POST access but withhold GET (or vice versa) on the same URL. It affects Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, plus EOL 8.5.0-8.5.100 and 7.0.0-7.0.109. There is no public exploit identified at time of analysis, and EPSS is low (0.28%), but CISA SSVC rates the technical impact as total and the attack as automatable.
Improper Authorization in Apache Tomcat causes security-role-ref mappings - intended only for servlet-level isUserInRole() checks - to be incorrectly applied as role aliases within the Realm's authorization logic, allowing authenticated low-privileged users to access resources protected by higher-privileged roles. Supported branches 9.0.25-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24 are confirmed affected, along with EOL branches 7.0.97-7.0.109 and 8.5.46-8.5.100. No public exploit identified at time of analysis, and EPSS probability stands at 0.20% (10th percentile), though the CVSS 8.1 score reflects meaningful integrity and availability exposure in deployments relying on Realm-enforced role separation.
Rewrite valve processing in Apache Tomcat contains an off-by-one error (CWE-193) in the handling of the [N] (Next) flag, causing rule iteration to restart from the second rewrite rule instead of the first, which can produce unintended looping behavior and result in a denial-of-service condition. Affected supported versions span Tomcat 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, and 11.0.0-M1 through 11.0.24; the EOL 8.5.x branch is also affected but will not receive a fix. No active exploitation is confirmed (not in CISA KEV), EPSS stands at 0.20% (10th percentile), and no public exploit code has been identified at time of analysis.
Authentication bypass in Apache Tomcat's DIGEST authenticator lets a network attacker who has captured a valid DIGEST-authenticated request replay it once when its nonceCount sits on the upper boundary of the replay window and fewer than windowSize requests have since been made. It affects Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, plus EOL 8.5.x and 7.0.x branches, but only where DIGEST authentication is actually enabled. No public exploit identified at time of analysis; EPSS is low at 0.28% (20th percentile), so the assigned 9.8 overstates practical risk.
Improper input validation in Apache Tomcat 9.0.115-9.0.120, 10.1.53-10.1.57, and 11.0.20-11.0.24 stems from an incomplete fix for CVE-2026-32990 and, per its CVSS:3.1 vector, permits remote unauthenticated attackers to compromise confidentiality, integrity, and availability of the servlet container. Reported by the Apache security team, it carries a critical 9.8 base score, though vendor tagging labels the impact as Information Disclosure, which is narrower than the vector implies. No public exploit identified at time of analysis, and EPSS estimates exploitation probability at just 0.21% (11th percentile).
Apache Tomcat's Unix domain socket creation path exposes a TOCTOU race condition across versions 9.0.42-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24, enabling an unauthorized local OS user to seize the socket before Tomcat finalizes access permissions. The vendor-assigned CVSS 8.1 with AV:N directly conflicts with the description's explicit 'local user' constraint and the inherently host-local nature of Unix domain sockets - the effective attack surface is limited to users with OS-level access on Tomcat hosts. No public exploit code or active exploitation has been identified; EPSS sits at 0.16% (5th percentile), indicating negligible real-world exploitation pressure at time of analysis.
Security constraint bypass in Apache Tomcat (7.0.x through 11.0.x) lets remote unauthenticated attackers reach protected resources when a broader security constraint for a longer path is declared ahead of a more restrictive constraint for a shorter sub-path, causing the wrong constraint to be applied. The flaw (CVSS 9.1, CWE-284) exposes access-controlled application paths without valid credentials. No public exploit identified at time of analysis, and EPSS is low (0.23%), but the network-reachable, no-interaction profile makes it a meaningful patch priority.
Unauthenticated SQL injection in Metacat 2.0.0 through 3.4.0 lets remote attackers read, modify, and delete the entire backing PostgreSQL database via the nodeId parameter of the /cn/v1/object and /cn/v2/object REST endpoints. Because SQL errors are mirrored back inside Metacat's XML error responses, an attacker can use error-based extraction (e.g. PostgreSQL CAST) to exfiltrate arbitrary data with no credentials. Full working proof-of-concept exploits have been developed and verified by the reporter, though there is no public exploit identified and no CISA KEV listing at time of analysis.
Unauthenticated arbitrary file read in NCEAS Metacat (all 1.x and 2.x through 2.19.1) lets a remote attacker retrieve any file readable by the Tomcat process via a path-traversal in the archiveEntryName parameter of the legacy 1.x action=read endpoint. A single unauthenticated GET request can exfiltrate credentials, DataONE client certificates and private keys, and embargoed research data. Publicly available exploit code exists (POC demonstrated and verified); the issue is fixed only in Metacat 3.0.0, and 2.x will not be backported.
Cross-user HTTP response poisoning in Traefik's default reverse proxy allows an unauthenticated remote attacker using HTTP/2 or HTTP/3 to smuggle responses into other clients' backend connections, potentially delivering authenticated or private content from one user to another. All supported Traefik branches through v2.11.52, v3.6.23, and v3.7.8 are affected in default configuration when fronting Go net/http or gunicorn/Flask backends, which are confirmed 'armed' (respond to CONNECT with keep-alive non-2xx without draining the body). A proof-of-concept is publicly available demonstrating reliable cross-user poisoning including a cascade scenario where 8 of 8 sequential victims read responses that were not their own; no CISA KEV listing was present at time of analysis.
Remote code execution in Apache Axis2/Java through 2.0.0 arises from unsafe deserialization of Java objects in the optional Tribes clustering component, allowing unauthenticated remote attackers with network access to the clustering port to execute arbitrary code via crafted serialized payloads. The vulnerability is only exploitable when clustering is explicitly enabled, which is off by default. No active exploitation or public exploit code has been observed; the issue is resolved by upgrading to version 2.0.1, which removes the entire clustering feature.
Cluster-communication confidentiality and integrity in Apache Tomcat can be undermined because the secure-configuration requirements for the EncryptInterceptor were never clearly documented, leaving operators liable to deploy the cluster session-replication channel insecurely. The flaw affects Tomcat 7.0.100-7.0.109, 8.5.38-8.5.100, 9.0.13-9.0.119, 10.1.0-M1-10.1.56 and 11.0.0-M1-11.0.23, and is fixed in 9.0.120, 10.1.57 and 11.0.24. It carries a CVSS 9.1 (C:H/I:H) but SSVC records exploitation as none, no public exploit identified at time of analysis, and the root cause is a documentation weakness (CWE-1059) rather than a code defect.
Security constraint bypass in Apache Tomcat (8.5.0-8.5.100, 9.0.0.M1-9.0.119, 10.1.0-M1-10.1.56, 11.0.0-M1-11.0.23) lets remote attackers reach protected resources by abusing improperly handled hex URL encoding in the RewriteValve, defeating URL-pattern security constraints. Because the flaw resides in the rewrite valve, only deployments that use the RewriteValve together with security constraints are exposed, but where present an unauthenticated attacker (per CVSS PR:N) can access or manipulate resources meant to be restricted. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Remote code execution in DSpace 8.0-8.3 and 9.0-9.2 allows an authenticated administrator to execute arbitrary Java via Velocity templates used to render COAR Notify/LDN messages, using reflection to escape the templating sandbox. Exploitation requires valid DSpace administrator credentials and is most impactful when chained with the related LDN path-traversal flaw (GHSA-9qm4-rh6w-pq5x). No public exploit identified at time of analysis, and CVSS is 8.0 (High).
Path traversal in XWiki running on Jetty 12+ lets remote users read arbitrary files the Jetty process can access by sending doubly URL-encoded '../' sequences to the skin resource endpoint (e.g. /xwiki/bin/skin/..%252f/..). Depending on how deep the webapp sits below root, this exposes both in-webapp secrets such as WEB-INF/xwiki.cfg and Hibernate configuration, and out-of-webapp OS files like /etc/passwd. No public exploit or active exploitation is tracked, but the vendor advisory (GHSA-qj4x-9g63-25g6) itself publishes working request URLs, so weaponization is trivial.
Authentication bypass in Apache Tomcat (7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.100, 10.1.0-M1-10.1.36, 11.0.0-M1-11.0.4) lets remote attackers authenticate without supplying the correct password when the JNDIRealm is configured to validate credentials via GSSAPI bind. The flaw (CWE-304, Missing Critical Step in Authentication) means the realm accepts a bind as successful even when the password verification step is effectively skipped. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%, 12th percentile), and it is not listed in CISA KEV.
Incomplete security-constraint logging in Apache Tomcat (8.5.0-8.5.100, 9.0.0.M1-9.0.118, 10.1.0-M1-10.1.55, 11.0.0-M1-11.0.22) omits special roles and empty authorization constraints when the effective web.xml is written to the log, giving administrators an inaccurate view of the deployed access-control configuration. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and CISA SSVC marks exploitation status as none, despite the inflated 9.1 CVSS published by Apache. The practical effect is misleading audit/diagnostic output rather than direct attacker compromise.
Improper handling of a Certificate Revocation List (CRL) error condition in Apache Tomcat's FFM-based (Foreign Function & Memory / OpenSSL) connector allows revoked client certificates to be accepted during mutual TLS authentication, defeating revocation checking. The flaw affects Tomcat 9.0.83-9.0.118, 10.1.0-M7-10.1.55, and 11.0.0-M1-11.0.22 when a CRL is configured on the FFM connector, letting an attacker holding a revoked-but-otherwise-valid client certificate reach protected resources. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, though the CVSS base score is 9.1 (CWE-390).
Access-control bypass in Apache Tomcat's RewriteValve (versions 8.5.0-8.5.100, 9.0.0.M1-9.0.118, 10.1.0-M1-10.1.55, and 11.0.0-M1-11.0.22) arises because once the first condition in an OR (`[OR]`) chain matched, subsequent non-OR conditions were never evaluated. Where operators rely on chained rewrite conditions to gate or restrict requests, an attacker can satisfy only the first condition and have later guard conditions silently skipped, leading to information disclosure or unintended request routing. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Apache has released fixes in 11.0.23, 10.1.56, and 9.0.119.
Unauthenticated Solr streaming expression injection in Goobi viewer Core (versions 4.8.0 through 26.04) allows remote attackers to fully read, modify, or delete the backend Solr index by posting arbitrary expressions to the `/api/v1/index/stream` endpoint. No public exploit identified at time of analysis, but the vulnerability is trivially exploitable with CVSS 9.8 and bypasses access-condition protections such as moving walls and licence restrictions. EPSS is currently low (0.04%) reflecting the niche audience rather than technical difficulty.
Arbitrary file write leading to unauthenticated remote code execution affects efw4.X (Enterprise Framework for Web) prior to 4.08.010, where efw.file.FileManager.unZip extracts ZIP entries via new File(baseDir, zipEntry.getName()) with no canonical-path validation - a classic Zip Slip. By combining the framework's public multipart /uploadServlet with an event that chains file.saveUploadFiles and FileManager.unZip, an attacker with no credentials can plant a JSP webshell in the Tomcat servlet context root and execute OS commands as the Tomcat user. Publicly available exploit code exists (SSVC lists proof-of-concept); the flaw is not on CISA KEV and EPSS is low (0.21%, 43rd percentile).
Authorization bypass in Apache Tomcat (versions 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54, and 11.0.0-M1-11.0.21) lets remote unauthenticated attackers reach protected resources when multiple security-constraint elements define an HTTP method for the same URL extension, causing method constraints to be misapplied. Per CVSS PR:N the flaw is exploitable without authentication, yielding high confidentiality and integrity impact but no availability impact (C:H/I:H/A:N). There is no public exploit identified at time of analysis; EPSS is very low (0.02%) and CISA SSVC records exploitation status as none, though the impact is rated total and the issue is automatable.
Information disclosure in Apache Tomcat's LockOutRealm component allows remote attackers to bypass account-lockout tracking because usernames are compared with inconsistent case sensitivity (CWE-178), enabling authentication-related information leakage across Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54 and 11.0.0-M1-11.0.21. The CVSS 3.1 vector (7.5, C:H only) scopes the impact to confidentiality with no integrity or availability effect, consistent with the 'Information Disclosure' tagging. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%, 5th percentile), and CISA SSVC records exploitation as none.
Authentication bypass in Apache Tomcat's DIGEST authentication implementation allows remote attackers to circumvent HTTP Digest access authentication and reach protected resources without valid credentials, affecting Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54 and 11.0.0-M1-11.0.21. The NVD-published CVSS of 9.8 reflects an unauthenticated network vector with total impact, but this record is marked DEPRECATED by the CVE program and there is no public exploit identified at time of analysis, with EPSS at just 0.04% (12th percentile) and no CISA KEV listing. Impact is scoped to deployments that actually enable DIGEST authentication, which is uncommon relative to Tomcat's overall footprint.
Improper input validation in Apache Tomcat (CWE-20) affects a broad range of releases across the 8.5, 9.0, 10.0, 10.1, and 11.0 branches, with the NVD assigning a critical CVSS 9.8 and a network/no-auth vector. No public exploit has been identified at time of analysis and the EPSS probability is only 0.04% (11th percentile), and CISA SSVC records exploitation status as none. Note a signal conflict: the intelligence tags label this 'Information Disclosure' while the official CVSS claims full confidentiality, integrity, and availability impact - the terse advisory does not resolve which is correct.
Information disclosure in Apache Tomcat versions 7.0.83 through 11.0.21 exposes HTTP authentication headers to unintended hosts during WebSocket authentication handshakes, enabling credential leakage to third-party endpoints. The flaw carries a CVSS 7.3 score with partial confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. EPSS probability is very low (0.03%) but SSVC marks the issue as automatable, indicating that scripted exploitation is feasible if attacker positioning is achieved.
Denial of service in Apache Tomcat 9.x, 10.1.x, and 11.0.x allows remote unauthenticated attackers to exhaust server resources due to missing limits or throttling on a resource allocation path (CWE-770). Affected versions span 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, and 9.0.0.M1 through 9.0.117, with older unsupported branches also implicated per the EUVD entry. No public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 5th percentile), but the SSVC framework flags the issue as automatable with partial technical impact.
Server-side template injection in OpenMRS Core allows authenticated users with 'Manage Concepts' privilege to execute arbitrary Java code by injecting malicious Apache Velocity templates into concept reference range criteria fields. The vulnerability stems from unsafe VelocityEngine initialization without sandbox restrictions (no SecureUberspector), enabling unrestricted Java reflection. Exploitation persists across all facility users whenever observations are validated against the compromised concept, creating a persistent remote code execution vector. Fixed in versions 2.7.9 and 2.8.6 via migration from Velocity to sandboxed Spring Expression Language (SpEL) with SimpleEvaluationContext. No active exploitation confirmed (not in CISA KEV), but proof-of-concept details available from researcher advisory at machinespirits.com.
Path traversal (Zip Slip) vulnerability in OpenMRS Core ≤ 2.7.8 and 2.8.0-2.8.5 allows authenticated administrators to achieve remote code execution by uploading a malicious .omod module archive to the REST API endpoint POST /openmrs/ws/rest/v1/module. Attackers can write arbitrary JSP files to the Tomcat webroot via crafted ZIP entries containing directory traversal sequences (e.g., web/module/../../../../malicious.jsp), which bypass incomplete path validation in WebModuleUtil.startModule(). The vulnerability also bypasses the module.allow_web_admin security control, as the REST API does not enforce this restriction despite Legacy UI being protected. No vendor-released patch identified at time of analysis for either affected version range.
Path traversal in OpenMRS Core's ModuleResourcesServlet allows unauthenticated attackers to read arbitrary files from the server filesystem, including sensitive configuration files and system files like /etc/passwd. The vulnerability exists in versions ≤ 2.7.8 and 2.8.0-2.8.5, with exploitation requiring Apache Tomcat < 8.5.31 where path parameter bypass protections are absent. Fix available in version 2.8.6 for the 2.8.x branch; no patch released for 2.7.x series at time of analysis. CVSS 7.5 (High) reflects network-accessible unauthenticated exploitation with high confidentiality impact.
Apache Tomcat's cloud membership clustering component logs Kubernetes bearer tokens in plaintext, enabling unauthenticated remote attackers to extract authentication credentials from log files. Affects Tomcat 9.0.13-9.0.116, 10.1.0-M1-10.1.53, and 11.0.0-M1-11.0.20. CVSS 7.5 (High) reflects confidentiality impact; no public exploit identified at time of analysis. Exploitation requires network access to log files or log aggregation systems, potentially enabling privilege escalation within Kubernetes clusters.
Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive session data to network-positioned attackers because the EncryptInterceptor - the clustering security control - can be bypassed due to a regression introduced by the fix for CVE-2026-29146. Listed in CISA KEV as actively exploited with a publicly available exploit, though EPSS sits at just 0.01% (1st percentile), indicating targeted rather than widespread automated exploitation. The confidentiality impact is rated High with no integrity or availability impact, consistent with CWE-311 (Missing Encryption of Sensitive Data).
Information disclosure in Apache Tomcat's JsonAccessLogValve allows unauthenticated remote attackers to retrieve sensitive data due to improper output encoding. Affects Tomcat versions 11.0.0-M1 through 11.0.20, 10.1.0-M1 through 10.1.53, and 9.0.40 through 9.0.116. The vulnerability enables high-impact confidentiality breaches through network-accessible attack vectors with low complexity and no user interaction required. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.02%).
Padding oracle attack in Apache Tomcat EncryptInterceptor leaks encrypted session data confidentiality across versions 7.0.100-7.0.109, 8.5.38-8.5.100, 9.0.13-9.0.115, 10.0.0-M1-10.1.52, and 11.0.0-M1-11.0.18 when default configuration is deployed. Unauthenticated remote attackers exploit oracle responses to decrypt sensitive information without authentication (CVSS:3.1 AV:N/AC:L/PR:N). CWE-209 (information exposure through error messages) enables cryptographic side-channel extraction. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.02%).
Authentication bypass in Apache Tomcat 9.x through 11.x and Tomcat Native 1.1.23-2.0.13 allows unauthenticated remote attackers to bypass CLIENT_CERT authentication when soft-fail is disabled, achieving unauthorized access to confidentiality- and integrity-sensitive resources. Exploitation requires no user interaction or privileges (CVSS:3.1 PR:N/UI:N). The flaw affects CLIENT_CERT authentication logic, permitting access under conditions where authentication should fail. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.04%).
Cipher preference order enforcement failure in Apache Tomcat 9.0.114-9.0.115, 10.1.51-10.1.52, and 11.0.16-11.0.18 allows unauthenticated remote attackers to force selection of weaker cryptographic ciphers during TLS negotiation, enabling potential decryption of confidential data transmitted over HTTPS connections. The vulnerability stems from improper preservation of administrator-configured cipher suite priority, potentially exposing sensitive session data, credentials, or application content. No public exploit identified at time of analysis. CVSS 7.5 (High) reflects network-accessible confidentiality impact requiring no privileges.
HTTP request smuggling in Apache Tomcat 7.x through 11.x permits unauthenticated remote attackers to manipulate request routing and bypass security controls via malformed chunk extension processing. Exploitation enables header injection, cache poisoning, and request routing manipulation without code execution. Affects Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.115, 10.1.0-M1-10.1.52, and 11.0.0-M1-11.0.18. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.02%).
Remote code execution in OpenIdentityPlatform OpenAM 16.0.5 and earlier allows unauthenticated attackers to execute arbitrary OS commands via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypass exploits an unpatched deserialization sink in JATO's ClientSession.deserializeAttributes() that was overlooked when CVE-2021-35464 was mitigated. Attackers can target any JATO ViewBean endpoint with <jato:form> tags (commonly found in password reset pages) using a PriorityQue
Server-side template injection in OpenOlat e-learning platform versions prior to 19.1.31, 20.1.18, and 20.2.5 enables authenticated users with Author role to execute arbitrary operating system commands via crafted Velocity directives in reminder email templates. Exploitation requires low-privilege authentication (PR:L) but is network-accessible (AV:N) with low complexity (AC:L), achieving full system compromise (C:H/I:H/A:H). The vulnerability leverages Java reflection through Velocity templates to instantiate ProcessBuilder and execute commands with Tomcat process privileges, often root in containerized environments. EPSS data not provided; no CISA KEV status confirmed; publicly available exploit code exists per GitHub security advisory disclosure.
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. [CVSS 7.5 HIGH]
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 11.6%.
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 22.1%.
HTTP request desynchronization in Apache Tomcat allows an unauthenticated remote attacker to cause a single request belonging to another user to fail when Tomcat is deployed behind a reverse proxy. The flaw (CWE-444) arises because Tomcat processes the Transfer-Encoding header on HTTP/1.0 requests, and when a fronting proxy interprets that header differently, the two sides disagree about request boundaries on a shared upstream connection. Affected releases are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.47 through 9.0.121, and the end-of-life 8.5.67 through 8.5.100; standalone Tomcat with no fronting proxy is not affected. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) - no persistence, data exposure, or code execution is described - and no public exploit code was identified at time of analysis.
Apache Tomcat's OpenSSL and OpenSSL-FFM TLS connectors ignore certificate revocation lists when the certificate is loaded from a keystore, so a client certificate that has already been revoked can still be accepted for mutual-TLS authentication. Affected releases are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.58, and 9.0.0-M1 through 9.0.121, with end-of-life 8.5.0 through 8.5.100 also known to be affected; fixed versions are 11.0.26, 10.1.59, and 9.0.122. No vendor CVSS score, EPSS value, CISA KEV entry, or public proof-of-concept was supplied, and our internal assessment rates the issue CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, reachable unauthenticated but only in the non-default combination of an OpenSSL or OpenSSL-FFM TLS connector, keystore-based certificates, mutual-TLS client-certificate authentication, and CRL-based revocation checking; no public exploit identified at time of analysis.
Path-confusion access-control bypass in Envoy Proxy before versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1 allows remote, unauthenticated clients to reach resources that a path-based Envoy policy (path-based route selection or path-based authorization) intended to protect. Envoy matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource, so a request like /admin;x=1 is matched by Envoy against an unprotected fallback route while the backend still serves the protected resource; Envoy's legacy ignore_path_parameters_in_path_matching option only truncates at the first semicolon and does not reproduce per-segment backend behavior. Exploitation is conditional (it requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment) and the assessed impact is limited to Low confidentiality with no integrity or availability effect; no public exploit identified at time of analysis.
Insufficient session expiration in Apache Tomcat allows an authenticated attacker to maintain an active WebSocket connection after the underlying HTTP session has been invalidated, violating the Jakarta WebSocket specification's requirement that WebSocket sessions close when their parent HTTP session ends. Affected are all supported branches from 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, and 11.0.0-M1 through 11.0.24, plus EOL branches 7.0.43-7.0.109 and 8.5.0-8.5.100. No public exploit or CISA KEV listing has been identified at time of analysis, and the low EPSS score (0.28%, 19th percentile) reflects limited real-world exploitation probability.
Uncontrolled resource consumption in Apache Tomcat's default WebSocket chat example allows remote attackers to cause denial of service. Affected versions include 11.0.0-M20 through 11.0.24, 10.1.24 through 10.1.57, and 9.0.89 through 9.0.120; users who have removed the examples web application as recommended are not impacted. No public exploit code or active exploitation is reported.
Unauthenticated disabling of the ACME service in Dogtag PKI allows persistent denial of service via URL manipulation. By appending a trailing slash to admin-only enable/disable endpoints, an attacker can bypass the Tomcat authentication constraint while RESTEasy routes the request, enabling unauthorized toggling. No public exploit or active exploitation has been reported.
Path traversal via the COAR Notify / Linked Data Notifications (LDN) service in DSpace 8.0-8.3 and 9.0-9.2 allows an authenticated DSpace administrator to reference arbitrary filesystem paths as LDN inbound-pattern templates, causing those files to be read and interpreted as Apache Velocity templates. While no public exploit or active exploitation has been identified, the vulnerability was demonstrated as part of a proven attack chain in which an administrator stages a malicious Velocity payload in a predictable file location and triggers its execution, enabling either sensitive file disclosure or arbitrary Java code execution via Velocity template injection. No special conditions (KEV, public PoC) are confirmed at time of analysis.
Local file inclusion in DSpace's OAI-ORE Ingestion Crosswalk allows a collection administrator to expose arbitrary server-side files as ingested bitstreams by supplying or triggering a malicious ORE XML document referencing file:/// URIs. Versions 7.x through 7.6.6, 8.0-8.3, and 9.0-9.2 are confirmed affected; fixed releases (7.6.7, 8.4, 9.3, 10.0) are available per the GitHub security advisory. No public exploit and no CISA KEV listing exist at time of analysis; the CVSS score of 4.4 reflects meaningful constraints on exploitation (high privileges, high complexity).
Path traversal in DSpace's Curation Task reporter parameter exposes authenticated Collection, Community, and Site Administrators to file write operations at arbitrary server-side paths writable by the DSpace/Tomcat OS user. Affected are DSpace versions through 7.6.6, 8.0-8.3, and 9.0-9.2, where the attack surface widened when web UI access was granted to admin roles beyond CLI-only system administrators. No public exploit or CISA KEV listing exists; the vendor-assigned CVSS 3.1 score of 5.5 (PR:H, A:H) correctly reflects that high-privilege credentials are required but the availability impact from overwriting configuration or binary files can be severe.
Improper Authorization (CWE-285) in Apache Tomcat's default servlet allows HTTP method-based and method-omission security constraints to be silently bypassed across all major supported Tomcat branches from 7.0.x through 11.0.x. An attacker can perform HTTP operations - such as PUT or DELETE - that the web.xml security constraint configuration was intended to restrict, potentially enabling unauthorized file upload, modification, or deletion on the default servlet's served content. No active exploitation has been confirmed (not in CISA KEV) and no CVSS score has been published at time of analysis, but the broad version range and ubiquitous deployment footprint of Tomcat make prompt patching a priority.
Replay attack vulnerability in Apache Tomcat's cluster EncryptionInterceptor allows a network-adjacent attacker to retransmit previously captured encrypted inter-node cluster messages, causing receiving nodes to accept and process them as legitimate - potentially corrupting distributed session state or triggering unintended cluster actions. All major supported branches are affected: 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.13 through 9.0.18, plus end-of-life branches 8.5.38-8.5.100 and 7.0.100-7.0.109. No public exploit or CISA KEV listing has been identified at time of analysis; however, the breadth of affected versions across all active and legacy branches elevates organizational exposure, particularly for environments running EOL 8.5.x or 7.x with no available patch.
Reflected XSS in Apache Tomcat's bundled 'number guess' example application exposes users of that demo page to script injection across all major Tomcat release lines from 7.0 through 11.0. The flaw resides in a sample JSP/servlet, not the core Tomcat runtime, meaning exploitation depends entirely on the example application being deployed and accessible - a configuration that violates standard production hardening guidance. No public exploit code or active exploitation has been identified at time of analysis; no CVSS vector was assigned by the reporter.
Arbitrary file write in GeoServer's Master Password Dump web page allows an authenticated administrator to write attacker-controlled content to any absolute filesystem path the GeoServer process can write to, including JSP files in a Tomcat webapps directory. Because GeoServer enforces no maximum master password length, an admin can embed malicious JSP code into the master password and dump it to an executable location, escalating to remote code execution on the host. No public exploit identified at time of analysis and the issue is not in CISA KEV.
Unbounded memory allocation and CPU exhaustion in OpenTelemetry Java SDK's baggage propagation allows remote unauthenticated attackers to degrade or deny service by sending oversized baggage headers. Affected components - W3CBaggagePropagator, JaegerPropagator, and OtTracePropagator - all lacked enforcement of the W3C Baggage specification's recommended size and entry limits, causing character-by-character parsing of arbitrarily large inputs. A distinctive amplification risk exists: baggage is automatically re-injected into all outgoing requests, meaning a single malicious inbound payload can fan out DoS effects to downstream services that never directly received the original request. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Timing side-channel in Apache Tomcat's AJP secret comparison exposes the shared AJP connector secret to remote, unauthenticated attackers capable of making precise network timing measurements. The vulnerability, tracked as CWE-208 (Observable Timing Discrepancy), affects all major Tomcat branches from 7.0.0 through current releases prior to the fixed versions, and could allow an attacker to recover the AJP shared secret through repeated probing. No public exploit code exists at time of analysis, EPSS is 0.02%, and CISA SSVC rates exploitation as none - making real-world risk low despite the network-accessible attack vector.
CLIENT_CERT authentication bypass in Apache Tomcat allows unauthenticated remote attackers to bypass certificate-based authentication when soft fail is disabled and Foreign Function Memory (FFM) is enabled, affecting Tomcat 9.0.92-9.0.116, 10.1.22-10.1.53, and 11.0.0-M14-11.0.20. The vulnerability has a CVSS score of 6.5 with high confidentiality impact and partial integrity impact; however, the EPSS score of 0.04% (11th percentile) indicates very low real-world exploitation probability, and no public exploit code or confirmed active exploitation has been identified.
Improper input validation in Apache Tomcat allows remote unauthenticated attackers to obtain sensitive information via an incomplete fix of the prior CVE-2025-66614 vulnerability. Affected versions include Tomcat 11.0.15-11.0.19, 10.1.50-10.1.52, and 9.0.113-9.0.115. The CVSS score of 5.3 reflects low confidentiality impact with no integrity or availability impact, and the 0.04% EPSS score indicates minimal real-world exploitation probability at time of analysis with no public exploit code or KEV status confirmed.
Open redirect vulnerability in Apache Tomcat's LoadBalancerDrainingValve allows unauthenticated remote attackers to redirect users to untrusted sites via crafted URLs. Affects Tomcat 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, 9.0.0.M23 through 9.0.115, and 8.5.30 through 8.5.100. The vulnerability requires user interaction (clicking a malicious link) and has low real-world exploitation probability (EPSS 0.01%), with no public exploit code or confirmed active exploitation identified at the time of analysis.
Critical hardcoded credentials vulnerability in ZKTeco ZKBioSecurity 3.0's bundled Apache Tomcat server that allows unauthenticated remote attackers to upload malicious WAR files and execute arbitrary code with SYSTEM privileges. Multiple public exploits are available (Exploit-DB, Packet Storm), making this a high-risk vulnerability for organizations using this biometric security management software.
Sandbox escape in dotCMS Velocity scripting engine (VTools) allows authenticated users to execute arbitrary SQL. CVSS 9.9 with scope change — affects one of the largest Java CMS platforms.
Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. [CVSS 3.7 LOW]
Input validation vulnerability in Apache Tomcat affecting versions 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.34, and 9.0.0.M1 through 9.0.98. Critical severity issue in one of the most widely deployed Java application servers.
In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Apache Tomcat Native 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 can, under a narrow timing window, down-grade the client-certificate verification requirement for connections, weakening mutual-TLS authentication for deployments that enforce client-cert auth through the APR/OpenSSL-based connector. The flaw is a CWE-366 race condition within a thread (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), so an unauthenticated network attacker must win a non-deterministic race to succeed, making exploitation probabilistic rather than guaranteed. Only Tomcat instances that actually use Tomcat Native and are configured for client-certificate verification are exposed; no public exploit identified at time of analysis, and no CISA KEV confirmation of active exploitation. Vendor-released fixes are available in 2.0.16 and 1.3.9.
Insecure-by-default OpenSSL options in Apache Tomcat Native (versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8) silently weaken the TLS layer used by the APR/OpenSSL connector, enabling insecure client-initiated renegotiation, disabling the Extended Master Secret extension, ignoring unexpected EOF (truncation), and permitting key exchanges without (EC)DHE forward secrecy. The vendor scored this 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N), but our independent assessment rates it substantially lower - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - because meaningful abuse requires an on-path/man-in-the-middle attacker who can actively position themselves between client and server, and because the four options are only applied when the deployment has not explicitly overridden them. Only Tomcat instances configured with the Apache Tomcat Native (APR) TLS connector at an affected version are exposed; JSSE/NIO-based connectors are unaffected, and no public exploit code or CISA KEV entry was identified at time of analysis. Vendors/users should upgrade to Tomcat Native 2.0.16 or 1.3.9.
Denial of service via JVM crash affects Apache Tomcat Native versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8, where a buffer over-read (CWE-126) during the TLS handshake lets a malicious client terminate the server process, rated CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The flaw is reachable remotely and unauthenticated with no user interaction, but only where the APR/OpenSSL-based native TLS connector is actually deployed and handling TLS connections; Tomcat instances using the pure-Java JSSE/NIO connector are not affected. Impact is confined to availability - no confidentiality or integrity loss, no data exposure and no code execution - and no public exploit was identified at time of analysis, with no CISA KEV entry.
WebSocket message smuggling in Apache Tomcat allows a remote, unauthenticated attacker to inject or reorder messages within a compressed WebSocket stream, corrupting application-level message boundaries and undermining integrity of data exchanged over the connection. The flaw affects the 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 release lines, plus the end-of-support 8.5.0-8.5.100 and 7.0.56-7.0.109 branches, but it only triggers when the per-message-deflate compression extension has been negotiated on the WebSocket connection; deployments that serve only standard HTTP or that run WebSocket endpoints without compression are not exposed. There is no confirmed active exploitation (CISA KEV does not list this issue), no public exploit code identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none', making this a genuine but conditionally-gated integrity flaw rather than a drop-everything emergency.
HTTP/2 request smuggling in Apache Tomcat can mix up request headers between concurrent streams, allowing unauthenticated remote attackers to potentially read or alter other users' request data when the connector has HTTP/2 explicitly enabled. The flaw is a regression from the fix for CVE-2026-41293 and affects only Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121; exploitation is rated high complexity (AC:H) with limited confidentiality and integrity impact (C:L/I:L). No public exploit code has been identified at time of analysis, and the independent assessment rates this as a moderate-priority, genuine protocol-layer flaw rather than a critical emergency.
Authentication can succeed when it should have been rejected in Apache Tomcat deployments that use CLIENT_CERT (mutual-TLS) authentication with soft fail disabled, allowing network attackers to reach resources that the mutual-TLS configuration was meant to protect. The affected range is broad - 9.0.92 through 9.0.121, 10.1.22 through 10.1.59, and 11.0.0-M14 through 11.0.25 - but the flaw is gated on two non-default conditions (the CLIENT_CERT authenticator in use and soft fail turned off) and, per the vendor, only manifests in some scenarios, so it is not universally reproducible even on correctly configured vulnerable instances. No public exploit code has been identified at time of analysis, and no evidence of active exploitation is present; the attacker needs network reachability to the mTLS-protected listener.
Denial of service in Apache Tomcat's asynchronous WebSocket write path allows remote, unauthenticated attackers to exhaust server resources by triggering lost write timeouts, so non-blocking WebSocket sends are never released after their effective lifetime. All maintained branches are affected - 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121, plus the end-of-life 8.5.0-8.5.100 and 7.0.43-7.0.109 lines - although exposure is bounded to instances whose deployed applications actually perform asynchronous (non-blocking) WebSocket writes; servers with no WebSocket endpoints or only synchronous writes are not exposed. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only) and CISA's SSVC assessment records no observed exploitation, with no public exploit code identified at time of analysis; the primary risk is sustained resource pressure that degrades or halts the affected connector rather than data compromise.
Apache Tomcat 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121 can cause an unrelated user's request to fail when a malformed request triggers incomplete cleanup of request-processing state on a reachable HTTP connector. No authentication or user interaction is required, but the effect is fundamentally gated by a race window - the advisory itself states the failure occurs only 'depending on timing' - so it is non-deterministic and cannot be reliably triggered on demand, and the realistic worst case is intermittent failure of another user's individual request rather than sustained denial of service, data disclosure, or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 7.3 base score reflects low impact across confidentiality, integrity, and availability, though our assessment rates attack complexity as High rather than Low.
Denial of service in Apache Tomcat allows an attacker to pin an AJP processing thread through a single AJP request, exhausting the connector's limited thread pool (CWE-770, allocation of resources without limits or throttling). The affected range is broad: 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, plus the end-of-life branches 8.5.0-8.5.100 and 7.0.0-7.0.109, which remain affected even though they are no longer supported. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS score in the input; the independent assessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (availability-only impact), but exploitation requires the AJP connector to be enabled and network-reachable, which has not been the default configuration since Tomcat 9.0.31.
Uncontrolled resource consumption in Apache Tomcat's WebSocket close-message handling allows unauthenticated remote attackers to exhaust server resources and degrade availability on instances that expose WebSocket endpoints. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the impact is limited to availability (Low) with no confidentiality or integrity effect, and no user interaction is required. Affected releases are 11.0.0-M5 through 11.0.25, 10.1.8 through 10.1.59, 9.0.74 through 9.0.121, plus the end-of-life 8.5.88 through 8.5.100 line; fixes are available in 11.0.26, 10.1.60, and 9.0.122. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, but the low attack complexity and unauthenticated network reachability make prompt patching advisable for any deployment using WebSockets.
Apache Tomcat's HTTP/2 connector harbors a race condition (CWE-362) that allows unauthenticated remote attackers to inject trailer fields into another user's concurrent HTTP/2 request, resulting in high confidentiality and integrity impact without affecting availability. Affected versions are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.39 through 9.0.121, and the end-of-life 8.5.59 through 8.5.100; exploitation is conditional on winning a concurrency race and only applies when the HTTP/2 upgrade protocol is enabled and actively serving traffic. No public exploit code or active exploitation has been identified at time of analysis, and the overall threat is considered credible but conditional.
Authentication bypass in Apache Tomcat allows unauthenticated remote attackers to reach WebSocket endpoints that are supposed to be protected by container-managed security constraints, simply by referencing the endpoint under an alternate name so the constraint is never matched. Exploitation requires only that the application expose one or more WebSocket endpoints and rely on container-level (web.xml security-constraint) authentication or authorization rules to guard them; no credentials, no user interaction, and no non-default configuration beyond that are needed, and per the CVSS vector (PR:N) the attack is unauthenticated and network-reachable. Affected lines are Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, plus end-of-support 8.5.0-8.5.100 and 7.0.43-7.0.109; no public exploit code has been identified at time of analysis and Apache has released fixed versions 11.0.26, 10.1.60 and 9.0.122.
Cross-application authentication realm leakage in Apache Tomcat's Jakarta Authentication integration causes requests to be validated against the realm established by whichever co-hosted web application authenticated first, breaking per-application authentication boundaries. The flaw (CWE-287, improper authentication) affects Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M4 through 9.0.121, plus end-of-life 8.5.0 through 8.5.100. Exploitation is gated by a non-default deployment - SimpleAuthConfigProvider as the default Jakarta Authentication provider with two or more applications sharing it - and the independent assessment rates the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (unauthenticated, high attack complexity, low impact); no public exploit identified at time of analysis, the issue is not in CISA KEV, and the vulnerable configuration is not Tomcat's default.
Authorization bypass in Eclipse Arrowhead 5.0.0-5.2.1 allows any authenticated system - regardless of privilege level - to reach every protected management API endpoint by submitting percent-encoded paths that defeat the raw-URL substring check while still being routed by Spring MVC's decoded dispatcher. Exploiting the flaw is trivial: encoding a single character in '/mgmt/' (e.g. 'm' → '%6D') causes the filter to fall through without authorizing the request, yet Tomcat decodes and dispatches it normally. The highest-impact target is POST /authentication/mgmt/identities, which creates new sysop-level accounts, yielding full administrative takeover of the Arrowhead local cloud. No public exploit has been identified at time of analysis.
Authentication bypass in Eclipse Arrowhead 5.0.0 through 5.2.1 lets an unauthenticated attacker who can publish to the MQTT broker impersonate the cloud's system operator. When the MQTT API runs with the certificate authentication policy, CertificateMqttFilter reads an X.509 certificate straight from the MQTT message payload and trusts its Subject DN without ever verifying the signature or issuer chain, reducing authorization to two string comparisons on public, attacker-controlled values. By minting a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu and dnQualifier=op, the attacker gains isSysOp==true and full management access. No public exploit is identified at time of analysis, but the technique is described in full detail in the advisory.
Uncontrolled resource consumption in Apache Tomcat's HTTP/2 implementation allows remote unauthenticated attackers to exhaust server memory by repeatedly opening and resetting HTTP/2 streams, exploiting an allocation leak in the backlog tracking mechanism that fails to release memory on stream reset. Affected branches span Tomcat 9.0.39-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24, with EOL branch 8.5.59-8.5.100 also confirmed vulnerable but unpatchable. No public exploit has been identified at time of analysis; EPSS stands at a low 0.22%, but the unauthenticated network vector and high availability impact make this operationally significant for any HTTP/2-enabled Tomcat deployment.
Improper Authentication in Apache Tomcat allows a remote, low-privileged attacker to gain authenticated access to applications even when the presented identity does not exist in the configured DataSourceRealm. The flaw is triggered specifically under CLIENT-CERT or SPNEGO authentication schemes, causing Tomcat to grant a session to a non-existent user. No public exploit or CISA KEV listing is present at time of analysis, but the CVSS C:H/I:H impact rating reflects the potential to fully compromise protected application resources if exploited in matching deployments.
Authorization bypass in Apache Tomcat's FORM-based authentication lets attackers reach protected resources that a security constraint was meant to restrict, defeating rules that grant a role POST access but withhold GET (or vice versa) on the same URL. It affects Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, plus EOL 8.5.0-8.5.100 and 7.0.0-7.0.109. There is no public exploit identified at time of analysis, and EPSS is low (0.28%), but CISA SSVC rates the technical impact as total and the attack as automatable.
Improper Authorization in Apache Tomcat causes security-role-ref mappings - intended only for servlet-level isUserInRole() checks - to be incorrectly applied as role aliases within the Realm's authorization logic, allowing authenticated low-privileged users to access resources protected by higher-privileged roles. Supported branches 9.0.25-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24 are confirmed affected, along with EOL branches 7.0.97-7.0.109 and 8.5.46-8.5.100. No public exploit identified at time of analysis, and EPSS probability stands at 0.20% (10th percentile), though the CVSS 8.1 score reflects meaningful integrity and availability exposure in deployments relying on Realm-enforced role separation.
Rewrite valve processing in Apache Tomcat contains an off-by-one error (CWE-193) in the handling of the [N] (Next) flag, causing rule iteration to restart from the second rewrite rule instead of the first, which can produce unintended looping behavior and result in a denial-of-service condition. Affected supported versions span Tomcat 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, and 11.0.0-M1 through 11.0.24; the EOL 8.5.x branch is also affected but will not receive a fix. No active exploitation is confirmed (not in CISA KEV), EPSS stands at 0.20% (10th percentile), and no public exploit code has been identified at time of analysis.
Authentication bypass in Apache Tomcat's DIGEST authenticator lets a network attacker who has captured a valid DIGEST-authenticated request replay it once when its nonceCount sits on the upper boundary of the replay window and fewer than windowSize requests have since been made. It affects Tomcat 11.0.0-M1 through 11.0.24, 10.1.0-M1 through 10.1.57, 9.0.0.M1 through 9.0.120, plus EOL 8.5.x and 7.0.x branches, but only where DIGEST authentication is actually enabled. No public exploit identified at time of analysis; EPSS is low at 0.28% (20th percentile), so the assigned 9.8 overstates practical risk.
Improper input validation in Apache Tomcat 9.0.115-9.0.120, 10.1.53-10.1.57, and 11.0.20-11.0.24 stems from an incomplete fix for CVE-2026-32990 and, per its CVSS:3.1 vector, permits remote unauthenticated attackers to compromise confidentiality, integrity, and availability of the servlet container. Reported by the Apache security team, it carries a critical 9.8 base score, though vendor tagging labels the impact as Information Disclosure, which is narrower than the vector implies. No public exploit identified at time of analysis, and EPSS estimates exploitation probability at just 0.21% (11th percentile).
Apache Tomcat's Unix domain socket creation path exposes a TOCTOU race condition across versions 9.0.42-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24, enabling an unauthorized local OS user to seize the socket before Tomcat finalizes access permissions. The vendor-assigned CVSS 8.1 with AV:N directly conflicts with the description's explicit 'local user' constraint and the inherently host-local nature of Unix domain sockets - the effective attack surface is limited to users with OS-level access on Tomcat hosts. No public exploit code or active exploitation has been identified; EPSS sits at 0.16% (5th percentile), indicating negligible real-world exploitation pressure at time of analysis.
Security constraint bypass in Apache Tomcat (7.0.x through 11.0.x) lets remote unauthenticated attackers reach protected resources when a broader security constraint for a longer path is declared ahead of a more restrictive constraint for a shorter sub-path, causing the wrong constraint to be applied. The flaw (CVSS 9.1, CWE-284) exposes access-controlled application paths without valid credentials. No public exploit identified at time of analysis, and EPSS is low (0.23%), but the network-reachable, no-interaction profile makes it a meaningful patch priority.
Unauthenticated SQL injection in Metacat 2.0.0 through 3.4.0 lets remote attackers read, modify, and delete the entire backing PostgreSQL database via the nodeId parameter of the /cn/v1/object and /cn/v2/object REST endpoints. Because SQL errors are mirrored back inside Metacat's XML error responses, an attacker can use error-based extraction (e.g. PostgreSQL CAST) to exfiltrate arbitrary data with no credentials. Full working proof-of-concept exploits have been developed and verified by the reporter, though there is no public exploit identified and no CISA KEV listing at time of analysis.
Unauthenticated arbitrary file read in NCEAS Metacat (all 1.x and 2.x through 2.19.1) lets a remote attacker retrieve any file readable by the Tomcat process via a path-traversal in the archiveEntryName parameter of the legacy 1.x action=read endpoint. A single unauthenticated GET request can exfiltrate credentials, DataONE client certificates and private keys, and embargoed research data. Publicly available exploit code exists (POC demonstrated and verified); the issue is fixed only in Metacat 3.0.0, and 2.x will not be backported.
Cross-user HTTP response poisoning in Traefik's default reverse proxy allows an unauthenticated remote attacker using HTTP/2 or HTTP/3 to smuggle responses into other clients' backend connections, potentially delivering authenticated or private content from one user to another. All supported Traefik branches through v2.11.52, v3.6.23, and v3.7.8 are affected in default configuration when fronting Go net/http or gunicorn/Flask backends, which are confirmed 'armed' (respond to CONNECT with keep-alive non-2xx without draining the body). A proof-of-concept is publicly available demonstrating reliable cross-user poisoning including a cascade scenario where 8 of 8 sequential victims read responses that were not their own; no CISA KEV listing was present at time of analysis.
Remote code execution in Apache Axis2/Java through 2.0.0 arises from unsafe deserialization of Java objects in the optional Tribes clustering component, allowing unauthenticated remote attackers with network access to the clustering port to execute arbitrary code via crafted serialized payloads. The vulnerability is only exploitable when clustering is explicitly enabled, which is off by default. No active exploitation or public exploit code has been observed; the issue is resolved by upgrading to version 2.0.1, which removes the entire clustering feature.
Cluster-communication confidentiality and integrity in Apache Tomcat can be undermined because the secure-configuration requirements for the EncryptInterceptor were never clearly documented, leaving operators liable to deploy the cluster session-replication channel insecurely. The flaw affects Tomcat 7.0.100-7.0.109, 8.5.38-8.5.100, 9.0.13-9.0.119, 10.1.0-M1-10.1.56 and 11.0.0-M1-11.0.23, and is fixed in 9.0.120, 10.1.57 and 11.0.24. It carries a CVSS 9.1 (C:H/I:H) but SSVC records exploitation as none, no public exploit identified at time of analysis, and the root cause is a documentation weakness (CWE-1059) rather than a code defect.
Security constraint bypass in Apache Tomcat (8.5.0-8.5.100, 9.0.0.M1-9.0.119, 10.1.0-M1-10.1.56, 11.0.0-M1-11.0.23) lets remote attackers reach protected resources by abusing improperly handled hex URL encoding in the RewriteValve, defeating URL-pattern security constraints. Because the flaw resides in the rewrite valve, only deployments that use the RewriteValve together with security constraints are exposed, but where present an unauthenticated attacker (per CVSS PR:N) can access or manipulate resources meant to be restricted. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Remote code execution in DSpace 8.0-8.3 and 9.0-9.2 allows an authenticated administrator to execute arbitrary Java via Velocity templates used to render COAR Notify/LDN messages, using reflection to escape the templating sandbox. Exploitation requires valid DSpace administrator credentials and is most impactful when chained with the related LDN path-traversal flaw (GHSA-9qm4-rh6w-pq5x). No public exploit identified at time of analysis, and CVSS is 8.0 (High).
Path traversal in XWiki running on Jetty 12+ lets remote users read arbitrary files the Jetty process can access by sending doubly URL-encoded '../' sequences to the skin resource endpoint (e.g. /xwiki/bin/skin/..%252f/..). Depending on how deep the webapp sits below root, this exposes both in-webapp secrets such as WEB-INF/xwiki.cfg and Hibernate configuration, and out-of-webapp OS files like /etc/passwd. No public exploit or active exploitation is tracked, but the vendor advisory (GHSA-qj4x-9g63-25g6) itself publishes working request URLs, so weaponization is trivial.
Authentication bypass in Apache Tomcat (7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.100, 10.1.0-M1-10.1.36, 11.0.0-M1-11.0.4) lets remote attackers authenticate without supplying the correct password when the JNDIRealm is configured to validate credentials via GSSAPI bind. The flaw (CWE-304, Missing Critical Step in Authentication) means the realm accepts a bind as successful even when the password verification step is effectively skipped. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%, 12th percentile), and it is not listed in CISA KEV.
Incomplete security-constraint logging in Apache Tomcat (8.5.0-8.5.100, 9.0.0.M1-9.0.118, 10.1.0-M1-10.1.55, 11.0.0-M1-11.0.22) omits special roles and empty authorization constraints when the effective web.xml is written to the log, giving administrators an inaccurate view of the deployed access-control configuration. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and CISA SSVC marks exploitation status as none, despite the inflated 9.1 CVSS published by Apache. The practical effect is misleading audit/diagnostic output rather than direct attacker compromise.
Improper handling of a Certificate Revocation List (CRL) error condition in Apache Tomcat's FFM-based (Foreign Function & Memory / OpenSSL) connector allows revoked client certificates to be accepted during mutual TLS authentication, defeating revocation checking. The flaw affects Tomcat 9.0.83-9.0.118, 10.1.0-M7-10.1.55, and 11.0.0-M1-11.0.22 when a CRL is configured on the FFM connector, letting an attacker holding a revoked-but-otherwise-valid client certificate reach protected resources. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, though the CVSS base score is 9.1 (CWE-390).
Access-control bypass in Apache Tomcat's RewriteValve (versions 8.5.0-8.5.100, 9.0.0.M1-9.0.118, 10.1.0-M1-10.1.55, and 11.0.0-M1-11.0.22) arises because once the first condition in an OR (`[OR]`) chain matched, subsequent non-OR conditions were never evaluated. Where operators rely on chained rewrite conditions to gate or restrict requests, an attacker can satisfy only the first condition and have later guard conditions silently skipped, leading to information disclosure or unintended request routing. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Apache has released fixes in 11.0.23, 10.1.56, and 9.0.119.
Unauthenticated Solr streaming expression injection in Goobi viewer Core (versions 4.8.0 through 26.04) allows remote attackers to fully read, modify, or delete the backend Solr index by posting arbitrary expressions to the `/api/v1/index/stream` endpoint. No public exploit identified at time of analysis, but the vulnerability is trivially exploitable with CVSS 9.8 and bypasses access-condition protections such as moving walls and licence restrictions. EPSS is currently low (0.04%) reflecting the niche audience rather than technical difficulty.
Arbitrary file write leading to unauthenticated remote code execution affects efw4.X (Enterprise Framework for Web) prior to 4.08.010, where efw.file.FileManager.unZip extracts ZIP entries via new File(baseDir, zipEntry.getName()) with no canonical-path validation - a classic Zip Slip. By combining the framework's public multipart /uploadServlet with an event that chains file.saveUploadFiles and FileManager.unZip, an attacker with no credentials can plant a JSP webshell in the Tomcat servlet context root and execute OS commands as the Tomcat user. Publicly available exploit code exists (SSVC lists proof-of-concept); the flaw is not on CISA KEV and EPSS is low (0.21%, 43rd percentile).
Authorization bypass in Apache Tomcat (versions 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54, and 11.0.0-M1-11.0.21) lets remote unauthenticated attackers reach protected resources when multiple security-constraint elements define an HTTP method for the same URL extension, causing method constraints to be misapplied. Per CVSS PR:N the flaw is exploitable without authentication, yielding high confidentiality and integrity impact but no availability impact (C:H/I:H/A:N). There is no public exploit identified at time of analysis; EPSS is very low (0.02%) and CISA SSVC records exploitation status as none, though the impact is rated total and the issue is automatable.
Information disclosure in Apache Tomcat's LockOutRealm component allows remote attackers to bypass account-lockout tracking because usernames are compared with inconsistent case sensitivity (CWE-178), enabling authentication-related information leakage across Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54 and 11.0.0-M1-11.0.21. The CVSS 3.1 vector (7.5, C:H only) scopes the impact to confidentiality with no integrity or availability effect, consistent with the 'Information Disclosure' tagging. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%, 5th percentile), and CISA SSVC records exploitation as none.
Authentication bypass in Apache Tomcat's DIGEST authentication implementation allows remote attackers to circumvent HTTP Digest access authentication and reach protected resources without valid credentials, affecting Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54 and 11.0.0-M1-11.0.21. The NVD-published CVSS of 9.8 reflects an unauthenticated network vector with total impact, but this record is marked DEPRECATED by the CVE program and there is no public exploit identified at time of analysis, with EPSS at just 0.04% (12th percentile) and no CISA KEV listing. Impact is scoped to deployments that actually enable DIGEST authentication, which is uncommon relative to Tomcat's overall footprint.
Improper input validation in Apache Tomcat (CWE-20) affects a broad range of releases across the 8.5, 9.0, 10.0, 10.1, and 11.0 branches, with the NVD assigning a critical CVSS 9.8 and a network/no-auth vector. No public exploit has been identified at time of analysis and the EPSS probability is only 0.04% (11th percentile), and CISA SSVC records exploitation status as none. Note a signal conflict: the intelligence tags label this 'Information Disclosure' while the official CVSS claims full confidentiality, integrity, and availability impact - the terse advisory does not resolve which is correct.
Information disclosure in Apache Tomcat versions 7.0.83 through 11.0.21 exposes HTTP authentication headers to unintended hosts during WebSocket authentication handshakes, enabling credential leakage to third-party endpoints. The flaw carries a CVSS 7.3 score with partial confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. EPSS probability is very low (0.03%) but SSVC marks the issue as automatable, indicating that scripted exploitation is feasible if attacker positioning is achieved.
Denial of service in Apache Tomcat 9.x, 10.1.x, and 11.0.x allows remote unauthenticated attackers to exhaust server resources due to missing limits or throttling on a resource allocation path (CWE-770). Affected versions span 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, and 9.0.0.M1 through 9.0.117, with older unsupported branches also implicated per the EUVD entry. No public exploit identified at time of analysis, and the EPSS score is very low (0.02%, 5th percentile), but the SSVC framework flags the issue as automatable with partial technical impact.
Server-side template injection in OpenMRS Core allows authenticated users with 'Manage Concepts' privilege to execute arbitrary Java code by injecting malicious Apache Velocity templates into concept reference range criteria fields. The vulnerability stems from unsafe VelocityEngine initialization without sandbox restrictions (no SecureUberspector), enabling unrestricted Java reflection. Exploitation persists across all facility users whenever observations are validated against the compromised concept, creating a persistent remote code execution vector. Fixed in versions 2.7.9 and 2.8.6 via migration from Velocity to sandboxed Spring Expression Language (SpEL) with SimpleEvaluationContext. No active exploitation confirmed (not in CISA KEV), but proof-of-concept details available from researcher advisory at machinespirits.com.
Path traversal (Zip Slip) vulnerability in OpenMRS Core ≤ 2.7.8 and 2.8.0-2.8.5 allows authenticated administrators to achieve remote code execution by uploading a malicious .omod module archive to the REST API endpoint POST /openmrs/ws/rest/v1/module. Attackers can write arbitrary JSP files to the Tomcat webroot via crafted ZIP entries containing directory traversal sequences (e.g., web/module/../../../../malicious.jsp), which bypass incomplete path validation in WebModuleUtil.startModule(). The vulnerability also bypasses the module.allow_web_admin security control, as the REST API does not enforce this restriction despite Legacy UI being protected. No vendor-released patch identified at time of analysis for either affected version range.
Path traversal in OpenMRS Core's ModuleResourcesServlet allows unauthenticated attackers to read arbitrary files from the server filesystem, including sensitive configuration files and system files like /etc/passwd. The vulnerability exists in versions ≤ 2.7.8 and 2.8.0-2.8.5, with exploitation requiring Apache Tomcat < 8.5.31 where path parameter bypass protections are absent. Fix available in version 2.8.6 for the 2.8.x branch; no patch released for 2.7.x series at time of analysis. CVSS 7.5 (High) reflects network-accessible unauthenticated exploitation with high confidentiality impact.
Apache Tomcat's cloud membership clustering component logs Kubernetes bearer tokens in plaintext, enabling unauthenticated remote attackers to extract authentication credentials from log files. Affects Tomcat 9.0.13-9.0.116, 10.1.0-M1-10.1.53, and 11.0.0-M1-11.0.20. CVSS 7.5 (High) reflects confidentiality impact; no public exploit identified at time of analysis. Exploitation requires network access to log files or log aggregation systems, potentially enabling privilege escalation within Kubernetes clusters.
Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive session data to network-positioned attackers because the EncryptInterceptor - the clustering security control - can be bypassed due to a regression introduced by the fix for CVE-2026-29146. Listed in CISA KEV as actively exploited with a publicly available exploit, though EPSS sits at just 0.01% (1st percentile), indicating targeted rather than widespread automated exploitation. The confidentiality impact is rated High with no integrity or availability impact, consistent with CWE-311 (Missing Encryption of Sensitive Data).
Information disclosure in Apache Tomcat's JsonAccessLogValve allows unauthenticated remote attackers to retrieve sensitive data due to improper output encoding. Affects Tomcat versions 11.0.0-M1 through 11.0.20, 10.1.0-M1 through 10.1.53, and 9.0.40 through 9.0.116. The vulnerability enables high-impact confidentiality breaches through network-accessible attack vectors with low complexity and no user interaction required. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.02%).
Padding oracle attack in Apache Tomcat EncryptInterceptor leaks encrypted session data confidentiality across versions 7.0.100-7.0.109, 8.5.38-8.5.100, 9.0.13-9.0.115, 10.0.0-M1-10.1.52, and 11.0.0-M1-11.0.18 when default configuration is deployed. Unauthenticated remote attackers exploit oracle responses to decrypt sensitive information without authentication (CVSS:3.1 AV:N/AC:L/PR:N). CWE-209 (information exposure through error messages) enables cryptographic side-channel extraction. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.02%).
Authentication bypass in Apache Tomcat 9.x through 11.x and Tomcat Native 1.1.23-2.0.13 allows unauthenticated remote attackers to bypass CLIENT_CERT authentication when soft-fail is disabled, achieving unauthorized access to confidentiality- and integrity-sensitive resources. Exploitation requires no user interaction or privileges (CVSS:3.1 PR:N/UI:N). The flaw affects CLIENT_CERT authentication logic, permitting access under conditions where authentication should fail. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.04%).
Cipher preference order enforcement failure in Apache Tomcat 9.0.114-9.0.115, 10.1.51-10.1.52, and 11.0.16-11.0.18 allows unauthenticated remote attackers to force selection of weaker cryptographic ciphers during TLS negotiation, enabling potential decryption of confidential data transmitted over HTTPS connections. The vulnerability stems from improper preservation of administrator-configured cipher suite priority, potentially exposing sensitive session data, credentials, or application content. No public exploit identified at time of analysis. CVSS 7.5 (High) reflects network-accessible confidentiality impact requiring no privileges.
HTTP request smuggling in Apache Tomcat 7.x through 11.x permits unauthenticated remote attackers to manipulate request routing and bypass security controls via malformed chunk extension processing. Exploitation enables header injection, cache poisoning, and request routing manipulation without code execution. Affects Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.115, 10.1.0-M1-10.1.52, and 11.0.0-M1-11.0.18. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.02%).
Remote code execution in OpenIdentityPlatform OpenAM 16.0.5 and earlier allows unauthenticated attackers to execute arbitrary OS commands via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypass exploits an unpatched deserialization sink in JATO's ClientSession.deserializeAttributes() that was overlooked when CVE-2021-35464 was mitigated. Attackers can target any JATO ViewBean endpoint with <jato:form> tags (commonly found in password reset pages) using a PriorityQue
Server-side template injection in OpenOlat e-learning platform versions prior to 19.1.31, 20.1.18, and 20.2.5 enables authenticated users with Author role to execute arbitrary operating system commands via crafted Velocity directives in reminder email templates. Exploitation requires low-privilege authentication (PR:L) but is network-accessible (AV:N) with low complexity (AC:L), achieving full system compromise (C:H/I:H/A:H). The vulnerability leverages Java reflection through Velocity templates to instantiate ProcessBuilder and execute commands with Tomcat process privileges, often root in containerized environments. EPSS data not provided; no CISA KEV status confirmed; publicly available exploit code exists per GitHub security advisory disclosure.
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. [CVSS 7.5 HIGH]
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 11.6%.
The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 22.1%.
HTTP request desynchronization in Apache Tomcat allows an unauthenticated remote attacker to cause a single request belonging to another user to fail when Tomcat is deployed behind a reverse proxy. The flaw (CWE-444) arises because Tomcat processes the Transfer-Encoding header on HTTP/1.0 requests, and when a fronting proxy interprets that header differently, the two sides disagree about request boundaries on a shared upstream connection. Affected releases are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.47 through 9.0.121, and the end-of-life 8.5.67 through 8.5.100; standalone Tomcat with no fronting proxy is not affected. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) - no persistence, data exposure, or code execution is described - and no public exploit code was identified at time of analysis.
Apache Tomcat's OpenSSL and OpenSSL-FFM TLS connectors ignore certificate revocation lists when the certificate is loaded from a keystore, so a client certificate that has already been revoked can still be accepted for mutual-TLS authentication. Affected releases are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.58, and 9.0.0-M1 through 9.0.121, with end-of-life 8.5.0 through 8.5.100 also known to be affected; fixed versions are 11.0.26, 10.1.59, and 9.0.122. No vendor CVSS score, EPSS value, CISA KEV entry, or public proof-of-concept was supplied, and our internal assessment rates the issue CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, reachable unauthenticated but only in the non-default combination of an OpenSSL or OpenSSL-FFM TLS connector, keystore-based certificates, mutual-TLS client-certificate authentication, and CRL-based revocation checking; no public exploit identified at time of analysis.
Path-confusion access-control bypass in Envoy Proxy before versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1 allows remote, unauthenticated clients to reach resources that a path-based Envoy policy (path-based route selection or path-based authorization) intended to protect. Envoy matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource, so a request like /admin;x=1 is matched by Envoy against an unprotected fallback route while the backend still serves the protected resource; Envoy's legacy ignore_path_parameters_in_path_matching option only truncates at the first semicolon and does not reproduce per-segment backend behavior. Exploitation is conditional (it requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment) and the assessed impact is limited to Low confidentiality with no integrity or availability effect; no public exploit identified at time of analysis.
Insufficient session expiration in Apache Tomcat allows an authenticated attacker to maintain an active WebSocket connection after the underlying HTTP session has been invalidated, violating the Jakarta WebSocket specification's requirement that WebSocket sessions close when their parent HTTP session ends. Affected are all supported branches from 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, and 11.0.0-M1 through 11.0.24, plus EOL branches 7.0.43-7.0.109 and 8.5.0-8.5.100. No public exploit or CISA KEV listing has been identified at time of analysis, and the low EPSS score (0.28%, 19th percentile) reflects limited real-world exploitation probability.
Uncontrolled resource consumption in Apache Tomcat's default WebSocket chat example allows remote attackers to cause denial of service. Affected versions include 11.0.0-M20 through 11.0.24, 10.1.24 through 10.1.57, and 9.0.89 through 9.0.120; users who have removed the examples web application as recommended are not impacted. No public exploit code or active exploitation is reported.
Unauthenticated disabling of the ACME service in Dogtag PKI allows persistent denial of service via URL manipulation. By appending a trailing slash to admin-only enable/disable endpoints, an attacker can bypass the Tomcat authentication constraint while RESTEasy routes the request, enabling unauthorized toggling. No public exploit or active exploitation has been reported.
Path traversal via the COAR Notify / Linked Data Notifications (LDN) service in DSpace 8.0-8.3 and 9.0-9.2 allows an authenticated DSpace administrator to reference arbitrary filesystem paths as LDN inbound-pattern templates, causing those files to be read and interpreted as Apache Velocity templates. While no public exploit or active exploitation has been identified, the vulnerability was demonstrated as part of a proven attack chain in which an administrator stages a malicious Velocity payload in a predictable file location and triggers its execution, enabling either sensitive file disclosure or arbitrary Java code execution via Velocity template injection. No special conditions (KEV, public PoC) are confirmed at time of analysis.
Local file inclusion in DSpace's OAI-ORE Ingestion Crosswalk allows a collection administrator to expose arbitrary server-side files as ingested bitstreams by supplying or triggering a malicious ORE XML document referencing file:/// URIs. Versions 7.x through 7.6.6, 8.0-8.3, and 9.0-9.2 are confirmed affected; fixed releases (7.6.7, 8.4, 9.3, 10.0) are available per the GitHub security advisory. No public exploit and no CISA KEV listing exist at time of analysis; the CVSS score of 4.4 reflects meaningful constraints on exploitation (high privileges, high complexity).
Path traversal in DSpace's Curation Task reporter parameter exposes authenticated Collection, Community, and Site Administrators to file write operations at arbitrary server-side paths writable by the DSpace/Tomcat OS user. Affected are DSpace versions through 7.6.6, 8.0-8.3, and 9.0-9.2, where the attack surface widened when web UI access was granted to admin roles beyond CLI-only system administrators. No public exploit or CISA KEV listing exists; the vendor-assigned CVSS 3.1 score of 5.5 (PR:H, A:H) correctly reflects that high-privilege credentials are required but the availability impact from overwriting configuration or binary files can be severe.
Improper Authorization (CWE-285) in Apache Tomcat's default servlet allows HTTP method-based and method-omission security constraints to be silently bypassed across all major supported Tomcat branches from 7.0.x through 11.0.x. An attacker can perform HTTP operations - such as PUT or DELETE - that the web.xml security constraint configuration was intended to restrict, potentially enabling unauthorized file upload, modification, or deletion on the default servlet's served content. No active exploitation has been confirmed (not in CISA KEV) and no CVSS score has been published at time of analysis, but the broad version range and ubiquitous deployment footprint of Tomcat make prompt patching a priority.
Replay attack vulnerability in Apache Tomcat's cluster EncryptionInterceptor allows a network-adjacent attacker to retransmit previously captured encrypted inter-node cluster messages, causing receiving nodes to accept and process them as legitimate - potentially corrupting distributed session state or triggering unintended cluster actions. All major supported branches are affected: 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.13 through 9.0.18, plus end-of-life branches 8.5.38-8.5.100 and 7.0.100-7.0.109. No public exploit or CISA KEV listing has been identified at time of analysis; however, the breadth of affected versions across all active and legacy branches elevates organizational exposure, particularly for environments running EOL 8.5.x or 7.x with no available patch.
Reflected XSS in Apache Tomcat's bundled 'number guess' example application exposes users of that demo page to script injection across all major Tomcat release lines from 7.0 through 11.0. The flaw resides in a sample JSP/servlet, not the core Tomcat runtime, meaning exploitation depends entirely on the example application being deployed and accessible - a configuration that violates standard production hardening guidance. No public exploit code or active exploitation has been identified at time of analysis; no CVSS vector was assigned by the reporter.
Arbitrary file write in GeoServer's Master Password Dump web page allows an authenticated administrator to write attacker-controlled content to any absolute filesystem path the GeoServer process can write to, including JSP files in a Tomcat webapps directory. Because GeoServer enforces no maximum master password length, an admin can embed malicious JSP code into the master password and dump it to an executable location, escalating to remote code execution on the host. No public exploit identified at time of analysis and the issue is not in CISA KEV.
Unbounded memory allocation and CPU exhaustion in OpenTelemetry Java SDK's baggage propagation allows remote unauthenticated attackers to degrade or deny service by sending oversized baggage headers. Affected components - W3CBaggagePropagator, JaegerPropagator, and OtTracePropagator - all lacked enforcement of the W3C Baggage specification's recommended size and entry limits, causing character-by-character parsing of arbitrarily large inputs. A distinctive amplification risk exists: baggage is automatically re-injected into all outgoing requests, meaning a single malicious inbound payload can fan out DoS effects to downstream services that never directly received the original request. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Timing side-channel in Apache Tomcat's AJP secret comparison exposes the shared AJP connector secret to remote, unauthenticated attackers capable of making precise network timing measurements. The vulnerability, tracked as CWE-208 (Observable Timing Discrepancy), affects all major Tomcat branches from 7.0.0 through current releases prior to the fixed versions, and could allow an attacker to recover the AJP shared secret through repeated probing. No public exploit code exists at time of analysis, EPSS is 0.02%, and CISA SSVC rates exploitation as none - making real-world risk low despite the network-accessible attack vector.
CLIENT_CERT authentication bypass in Apache Tomcat allows unauthenticated remote attackers to bypass certificate-based authentication when soft fail is disabled and Foreign Function Memory (FFM) is enabled, affecting Tomcat 9.0.92-9.0.116, 10.1.22-10.1.53, and 11.0.0-M14-11.0.20. The vulnerability has a CVSS score of 6.5 with high confidentiality impact and partial integrity impact; however, the EPSS score of 0.04% (11th percentile) indicates very low real-world exploitation probability, and no public exploit code or confirmed active exploitation has been identified.
Improper input validation in Apache Tomcat allows remote unauthenticated attackers to obtain sensitive information via an incomplete fix of the prior CVE-2025-66614 vulnerability. Affected versions include Tomcat 11.0.15-11.0.19, 10.1.50-10.1.52, and 9.0.113-9.0.115. The CVSS score of 5.3 reflects low confidentiality impact with no integrity or availability impact, and the 0.04% EPSS score indicates minimal real-world exploitation probability at time of analysis with no public exploit code or KEV status confirmed.
Open redirect vulnerability in Apache Tomcat's LoadBalancerDrainingValve allows unauthenticated remote attackers to redirect users to untrusted sites via crafted URLs. Affects Tomcat 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, 9.0.0.M23 through 9.0.115, and 8.5.30 through 8.5.100. The vulnerability requires user interaction (clicking a malicious link) and has low real-world exploitation probability (EPSS 0.01%), with no public exploit code or confirmed active exploitation identified at the time of analysis.
Critical hardcoded credentials vulnerability in ZKTeco ZKBioSecurity 3.0's bundled Apache Tomcat server that allows unauthenticated remote attackers to upload malicious WAR files and execute arbitrary code with SYSTEM privileges. Multiple public exploits are available (Exploit-DB, Packet Storm), making this a high-risk vulnerability for organizations using this biometric security management software.
Sandbox escape in dotCMS Velocity scripting engine (VTools) allows authenticated users to execute arbitrary SQL. CVSS 9.9 with scope change — affects one of the largest Java CMS platforms.
Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. [CVSS 3.7 LOW]
Input validation vulnerability in Apache Tomcat affecting versions 11.0.0-M1 through 11.0.14, 10.1.0-M1 through 10.1.34, and 9.0.0.M1 through 9.0.98. Critical severity issue in one of the most widely deployed Java application servers.
In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.