Apache Tomcat vulnerabilities
55 known CVE vulnerabilities in Apache Tomcat, translated and rated.
- CVE-2026-55956Medium
An improper authorization vulnerability in Apache Tomcat causes security constraints for the default servlet to ignore any configured HTTP method or method omission. This affects Tomcat versions from 7.0.0 through 11.0.22.
- CVE-2026-55955Medium
A vulnerability in Apache Tomcat allows a replay attack against the EncryptionInterceptor in the cluster component. The issue stems from improper authentication, enabling an attacker to reuse intercepted data.
- CVE-2026-53404High
An Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve causes subsequent non-OR conditions to be skipped if the first condition in an OR chain matches.
- CVE-2026-50229Medium
A basic XSS (Cross-Site Scripting) vulnerability was found in the number guess example application in Apache Tomcat. Improper neutralization of script-related HTML tags allows an attacker to inject malicious JavaScript code.
- CVE-2023-34981High
A regression in the fix for bug 66512 in Apache Tomcat causes that if a response does not include any HTTP headers, no AJP SEND_HEADERS message will be sent. This leads to at least one AJP proxy (mod_proxy_ajp) using the response headers from the previous request, resulting in an information leak.