CVE-2026-50229
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk28th percentile — higher than 28% of all known CVEs
Summary
A basic XSS (Cross-Site Scripting) vulnerability was found in the number guess example application in Apache Tomcat. Improper neutralization of script-related HTML tags allows an attacker to inject malicious JavaScript code.
Risk Assessment
An attacker can exploit this vulnerability to execute scripts in the victim's browser, potentially leading to session theft, redirects to malicious sites, or credential theft.
Recommendation
Immediately upgrade Apache Tomcat to version 11.0.23, 10.1.56, or 9.0.119, which contain the fix for this vulnerability.
Original NVD description (English source)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.