Skip to content
OpenAdvisories

Package · Debian

tomcat9

117 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-50229 Public exploit

    Apache Tomcat: XSS in number guess example

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through …

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  • Medium 6.1
    CVE-2026-25854 Public exploit

    Apache Tomcat: Occasionally open redirect

    Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, …

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven
  • Medium 6.5
    CVE-2026-24733 Public exploit

    Apache Tomcat: Security constraint bypass with HTTP/0.9

    Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET req…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven
  • Medium 6.5
    CVE-2025-55668 Public exploit

    Apache Tomcat: session fixation via rewrite valve

    Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended …

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • Medium 5.3
    CVE-2024-21733 Public exploit EPSS 14%

    Apache Tomcat: Leaking of unrelated request bodies in default error page

    Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade …

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  • Medium 6.1
    CVE-2023-41080 Public exploit

    Apache Tomcat: Open redirect with FORM authentication

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 thr…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  • Medium 6.1
    CVE-2019-0221 Public exploit EPSS 58%

    Cross-site scripting in Apache Tomcat

    The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and…

    Apache Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven