CVE Tools
Track your stack

Apache Tomcat

298 CVEs tracked. 7 of them are in CISA KEV.

This hub aggregates every CVE we track for Apache Tomcat, a product in the networking infrastructure space. Use it to gauge the current risk picture and drill into individual advisories.

Apache Tomcat CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Apache Tomcat CVEs per month
MonthCVEs
2024-114
2024-123
2025-010
2025-020
2025-031
2025-042
2025-051
2025-063
2025-073
2025-082
2025-090
2025-103
2025-110
2025-120
2026-010
2026-023
2026-030
2026-0410
2026-057
2026-067
2026-073
2026-0810
2026-0912
2026-108

Severity

How the 298 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2910%
  • High10235%
  • Medium14550%
  • Low165%

Latest CVEs

The 15 most recently published vulnerabilities affecting Apache Tomcat.

  1. CVE-2026-103119Apache Tomcat: AJP response mix-up9.1
  2. CVE-2026-101356Apache Tomcat: HTTP/2 request/response mix-up after error during async processing9.1
  3. CVE-2026-101296Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms—
  4. CVE-2026-93446Apache Tomcat: Possible TLS 1.3 connection failures—
  5. CVE-2026-88041Apache Tomcat: HTTP/2 trailer header cross-contamination—
  6. CVE-2026-80353Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector—
  7. CVE-2026-74049Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)—
  8. CVE-2026-74048Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up—
  9. CVE-2026-87022Apache Tomcat: WebSocket message smuggling with per-message-deflate7.5
  10. CVE-2026-86350Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up9.1
  11. CVE-2026-86248Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled9.8
  12. CVE-2026-79677Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout7.5
  13. CVE-2026-78437Apache Tomcat: HTTP/2 DoS via malformed request7.3
  14. CVE-2026-78383Apache Tomcat: AJP DoS via missing request body7.5
  15. CVE-2026-77791Apache Tomcat: DoS via busy wait during WebSocket close7.5

Product grouping is registry-driven, with AI assist and human review. How it works