tomcat11

7 results · Clear filters · Feed

• High 7.3
  CVE-2026-55957 Public exploit

  Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

  Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Jun 29, 2026
• High 7.5
  CVE-2026-24880 Public exploit

  Apache Tomcat: Request smuggling via invalid chunk extension

  Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 throug…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  Apr 9, 2026
• High 7.5
  CVE-2025-55752 Public exploit EPSS 64%

  Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

  Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the UR…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Oct 27, 2025
• High 7.5
  CVE-2025-48976 Public exploit EPSS 33%

  Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

  Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade…

  Apache Software Foundation Apache Commons FileUpload tomcat9 tomcat9 Debian Ubuntu Wolfi Maven
  Jun 16, 2025
• High 7.5
  CVE-2025-49125 Public exploit

  Apache Tomcat: Security constraint bypass for pre/post-resources

  Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That pa…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Jun 16, 2025
• High 7.5
  CVE-2025-48988 Public exploit EPSS 30%

  Apache Tomcat: FileUpload large number of parts with headers DoS

  Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time th…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Jun 16, 2025
• High 7.3
  CVE-2025-46701 Public exploit

  Apache Tomcat: Security constraint bypass for CGI scripts

  Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  May 29, 2025