Apache Tomcat Common Vulnerabilities & Exposures (CVE)

Select your version of Apache Tomcat & get full list of CVEs that effect you.

Top 5 Tomcat Vulnerabilities Demonstrated

video preview

Talk to our Dev Team

Apache Tomcat 11.0.x

First release:

2024-10-03

0

Support Lifecycle:

Namespace:

javax

Apache Tomcat 10.1.x

First release:

2022-09-23

0

Support Lifecycle:

Namespace:

javax

10.1.0 10.1.1 10.1.2 10.1.4 10.1.5 10.1.6 10.1.7 10.1.8 10.1.9 10.1.10 10.1.11 10.1.12 10.1.13 10.1.14 10.1.15 10.1.16 10.1.17 10.1.18 10.1.19 10.1.20 10.1.23 10.1.24 10.1.25 10.1.26 10.1.28 10.1.29 10.1.30 10.1.31 10.1.33

Apache Tomcat 10.0.x

First release:

2021-02-02

0

Support Lifecycle:

Namespace:

jakarta

10.0.0 10.0.2 10.0.4 10.0.5 10.0.6 10.0.7 10.0.8 10.0.10 10.0.11 10.0.12 10.0.13 10.0.14 10.0.16 10.0.17 10.0.18 10.0.20 10.0.21 10.0.22 10.0.23 10.0.26 10.0.27

Apache Tomcat 9.0.x

First release:

2018-01-18

0

Support Lifecycle:

Maintenance Support

Namespace:

javax

Apache Tomcat 8.5.x

First release:

2016-06-13

0

Support Lifecycle:

Maintenance Support

Namespace:

javax

Apache Tomcat 8.0.x

First release:

2014-06-25

First release:

2018-06-30

0

Support Lifecycle:

Namespace:

javax

Apache Tomcat 7.0.x

First release:

2011-01-14

First release:

2021-03-31

0

Support Lifecycle:

Maintenance Support

Namespace:

javax

Apache Tomcat 6.0.x

First release:

2007-02-28

First release:

2016-12-31

0

Support Lifecycle:

Namespace:

javax

6.0.0 6.0.1 6.0.2 6.0.4 6.0.6 6.0.7 6.0.8 6.0.9 6.0.10 6.0.13 6.0.14 6.0.16 6.0.18 6.0.20 6.0.24 6.0.26 6.0.28 6.0.29 6.0.30 6.0.32 6.0.33 6.0.35 6.0.36 6.0.37 6.0.39 6.0.41 6.0.43 6.0.44 6.0.45 6.0.47 6.0.48 6.0.51 6.0.53

Latest Apache Tomcat CVEs

CVE

Severity

Description

Category

Affected

0.0

Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

data operational

0.0

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.

data operational

3.1

Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.

data operational

7.5

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.

data operational

5.9

Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.

data operational

Most Critical Apache Tomcat CVEs

CVE

Severity

Description

Category

Affected

9.8

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.

Information Disclosure

9.8

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

data operational

AJP Request Injection leading to possible Remote Code Execution

9.1

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.

9.1

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.

data functional

8.8

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).

configuration data

Remote Code Execution

Scanned for Vulnerabilities lately?

Contact us & see how we can help

First name ^*
Last name ^*
Email ^*
Company ^*
How did you hear about Tomitribe? ^*
Tell us more ^*

Send me a confirmation email

^* These fields are required.