{"schema_version":1,"title":"org.apache.tomcat:tomcat-coyote (Maven) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 34 vulnerabilities in org.apache.tomcat:tomcat-coyote (Maven): 0 in the last 7 days and 1 in the last 90 days, 4 of them critical and 1 exploited in the wild. The most recent, CVE-2026-65637, was published on 25 August 2026. Nothing was published in the last eight weeks.","url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-coyote","json_url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-coyote.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-coyote","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":11,"all_time":34,"critical":4,"exploited":1,"last_7_days":0,"last_30_days":0,"last_90_days":1,"last_365_days":8},"latest":[{"cve":"CVE-2026-65637","cvss":9.8,"epss":0.0061,"slug":"cve-2026-65637-apache-tomcat-improper-input-validation-in-incomplete-fix","title":"Apache Tomcat improper input validation in incomplete fix","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:05.177+00:00","url":"https://junglewise.ai/threats/cve-2026-65637-apache-tomcat-improper-input-validation-in-incomplete-fix"},{"cve":"CVE-2026-41293","cvss":9.8,"epss":0.0168,"slug":"cve-2026-41293-apache-tomcat-improper-input-validation-in-http-2-request-headers","title":"Apache Tomcat improper input validation in HTTP/2 request headers","severity":"critical","exploited":false,"published_at":"2026-05-12T16:16:17.553+00:00","url":"https://junglewise.ai/threats/cve-2026-41293-apache-tomcat-improper-input-validation-in-http-2-request-headers"},{"cve":"CVE-2026-32990","cvss":5.3,"epss":0.0031,"slug":"cve-2026-32990-apache-tomcat-improper-input-validation","title":"Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of . This issue affects Apache Tomcat: from","severity":"medium","exploited":false,"published_at":"2026-04-09T20:16:24.81+00:00","url":"https://junglewise.ai/threats/cve-2026-32990-apache-tomcat-improper-input-validation"},{"cve":"CVE-2026-29129","cvss":7.5,"epss":0.0026,"slug":"cve-2026-29129-apache-tomcat-cipher-preference-order-not-preserved","title":"Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.","severity":"high","exploited":false,"published_at":"2026-04-09T20:16:24.343+00:00","url":"https://junglewise.ai/threats/cve-2026-29129-apache-tomcat-cipher-preference-order-not-preserved"},{"cve":"CVE-2026-24880","cvss":7.5,"epss":0.007,"slug":"cve-2026-24880-apache-tomcat-http-request-smuggling-via-invalid-chunk-extension","title":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.","severity":"high","exploited":false,"published_at":"2026-04-09T20:16:24.06+00:00","url":"https://junglewise.ai/threats/cve-2026-24880-apache-tomcat-http-request-smuggling-via-invalid-chunk-extension"},{"cve":"CVE-2025-66614","cvss":9.1,"epss":0.0024,"slug":"cve-2025-66614-apache-tomcat-client-certificate-verification-bypass-via-sni","title":"Apache Tomcat client certificate verification bypass via SNI mismatch","severity":"critical","exploited":false,"published_at":"2026-02-17T21:31:13+00:00","url":"https://junglewise.ai/threats/cve-2025-66614-apache-tomcat-client-certificate-verification-bypass-via-sni"},{"cve":"CVE-2026-24733","cvss":4,"epss":0.0051,"slug":"cve-2026-24733-apache-tomcat-security-constraint-bypass-in-http-0-9-handling","title":"Apache Tomcat security constraint bypass in HTTP/0.9 handling","severity":"medium","exploited":false,"published_at":"2026-02-17T21:31:13+00:00","url":"https://junglewise.ai/threats/cve-2026-24733-apache-tomcat-security-constraint-bypass-in-http-0-9-handling"},{"cve":"CVE-2026-24734","cvss":7.5,"epss":0.0058,"slug":"cve-2026-24734-apache-tomcat-certificate-revocation-bypass-in-ocsp-validation","title":"Apache Tomcat certificate revocation bypass in OCSP validation","severity":"high","exploited":false,"published_at":"2026-02-17T19:21:56.953+00:00","url":"https://junglewise.ai/threats/cve-2026-24734-apache-tomcat-certificate-revocation-bypass-in-ocsp-validation"},{"cve":"CVE-2025-48989","cvss":7.5,"epss":0.0369,"slug":"cve-2025-48989-apache-tomcat-denial-of-service-in-http-2-via-madeyoureset","title":"Apache Tomcat denial of service in HTTP/2 via MadeYouReset","severity":"high","exploited":false,"published_at":"2025-08-13T13:15:34.153+00:00","url":"https://junglewise.ai/threats/cve-2025-48989-apache-tomcat-denial-of-service-in-http-2-via-madeyoureset"},{"cve":"CVE-2025-53506","cvss":3.1,"epss":0.0199,"slug":"cve-2025-53506-apache-tomcat-coyote-vulnerable-to-denial-of-service-via","title":"Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams","severity":"low","exploited":false,"published_at":"2025-07-10T21:31:53+00:00","url":"https://junglewise.ai/threats/cve-2025-53506-apache-tomcat-coyote-vulnerable-to-denial-of-service-via"},{"cve":"CVE-2025-52434","cvss":7.5,"epss":0.0191,"slug":"cve-2025-52434-apache-tomcat-race-condition-in-apr-native-connector","title":"Apache Tomcat race condition in APR/Native connector","severity":"high","exploited":false,"published_at":"2025-07-10T21:31:52+00:00","url":"https://junglewise.ai/threats/cve-2025-52434-apache-tomcat-race-condition-in-apr-native-connector"},{"cve":"CVE-2025-31650","cvss":4,"epss":0.6104,"slug":"cve-2025-31650-apache-tomcat-denial-of-service-via-invalid-http-priority-header","title":"Apache Tomcat Denial of Service via invalid HTTP priority header","severity":"medium","exploited":false,"published_at":"2025-04-28T21:30:43+00:00","url":"https://junglewise.ai/threats/cve-2025-31650-apache-tomcat-denial-of-service-via-invalid-http-priority-header"},{"cve":"CVE-2024-52317","cvss":3.1,"epss":0.021,"slug":"cve-2024-52317-apache-tomcat-request-and-or-response-mix-up","title":"Apache Tomcat Request and/or response mix-up","severity":"low","exploited":false,"published_at":"2024-11-18T12:30:43+00:00","url":"https://junglewise.ai/threats/cve-2024-52317-apache-tomcat-request-and-or-response-mix-up"},{"cve":"CVE-2024-38286","cvss":8.6,"epss":0.0169,"slug":"cve-2024-38286-apache-tomcat-resource-exhaustion-in-tls-handshake","title":"Apache Tomcat resource exhaustion in TLS handshake","severity":"high","exploited":false,"published_at":"2024-11-07T09:30:42+00:00","url":"https://junglewise.ai/threats/cve-2024-38286-apache-tomcat-resource-exhaustion-in-tls-handshake"},{"cve":"CVE-2024-34750","cvss":3.1,"epss":0.046,"slug":"cve-2024-34750-apache-tomcat-denial-of-service","title":"Apache Tomcat - Denial of Service","severity":"low","exploited":false,"published_at":"2024-07-03T21:39:44+00:00","url":"https://junglewise.ai/threats/cve-2024-34750-apache-tomcat-denial-of-service"},{"cve":"CVE-2024-24549","cvss":3.1,"epss":0.2307,"slug":"cve-2024-24549-apache-tomcat-denial-of-service-due-to-improper-input-validation","title":"Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests","severity":"low","exploited":false,"published_at":"2024-03-13T18:31:34+00:00","url":"https://junglewise.ai/threats/cve-2024-24549-apache-tomcat-denial-of-service-due-to-improper-input-validation"},{"cve":"CVE-2024-21733","cvss":5.3,"epss":0.1429,"slug":"cve-2024-21733-apache-tomcat-sensitive-information-disclosure-in-error-messages","title":"Apache Tomcat sensitive information disclosure in error messages","severity":"medium","exploited":false,"published_at":"2024-01-19T12:30:18+00:00","url":"https://junglewise.ai/threats/cve-2024-21733-apache-tomcat-sensitive-information-disclosure-in-error-messages"},{"cve":"CVE-2023-46589","cvss":7.5,"epss":0.0265,"slug":"cve-2023-46589-apache-tomcat-improper-input-validation-vulnerability","title":"Apache Tomcat Improper Input Validation vulnerability","severity":"high","exploited":false,"published_at":"2023-11-28T18:30:23+00:00","url":"https://junglewise.ai/threats/cve-2023-46589-apache-tomcat-improper-input-validation-vulnerability"},{"cve":"CVE-2023-45648","cvss":5.3,"epss":0.0585,"slug":"cve-2023-45648-apache-tomcat-request-smuggling-via-improper-trailer-header","title":"Apache Tomcat request smuggling via improper trailer header parsing","severity":"medium","exploited":false,"published_at":"2023-10-10T21:31:12+00:00","url":"https://junglewise.ai/threats/cve-2023-45648-apache-tomcat-request-smuggling-via-improper-trailer-header"},{"cve":"CVE-2023-44487","cvss":5.3,"epss":1,"slug":"cve-2023-44487-http-2-rapid-reset-attack-vulnerability","title":"Multiple Vendors HTTP/2 denial of service via Rapid Reset attack","severity":"critical","exploited":true,"published_at":"2023-10-10T21:28:24+00:00","url":"https://junglewise.ai/threats/cve-2023-44487-http-2-rapid-reset-attack-vulnerability"},{"cve":"CVE-2023-42794","cvss":3.1,"epss":0.0185,"slug":"cve-2023-42794-apache-tomcat-incomplete-cleanup-vulnerability","title":"Apache Tomcat Incomplete Cleanup vulnerability","severity":"low","exploited":false,"published_at":"2023-10-10T18:31:35+00:00","url":"https://junglewise.ai/threats/cve-2023-42794-apache-tomcat-incomplete-cleanup-vulnerability"},{"cve":"CVE-2023-28709","cvss":3.1,"epss":0.4803,"slug":"cve-2023-28709-apache-tomcat-fix-for-was-incomplete","title":"Apache Tomcat - Fix for was incomplete","severity":"low","exploited":false,"published_at":"2023-07-06T21:14:59+00:00","url":"https://junglewise.ai/threats/cve-2023-28709-apache-tomcat-fix-for-was-incomplete"},{"cve":"CVE-2023-34981","cvss":3.1,"epss":0.0112,"slug":"cve-2023-34981-apache-tomcat-vulnerable-to-information-leak","title":"Apache Tomcat vulnerable to information leak","severity":"low","exploited":false,"published_at":"2023-06-21T12:30:19+00:00","url":"https://junglewise.ai/threats/cve-2023-34981-apache-tomcat-vulnerable-to-information-leak"},{"cve":"CVE-2023-24998","cvss":7.5,"epss":0.4879,"slug":"cve-2023-24998-apache-commons-fileupload-denial-of-service-via-resource","title":"Apache Commons FileUpload denial of service via resource exhaustion","severity":"high","exploited":false,"published_at":"2023-02-20T18:30:17+00:00","url":"https://junglewise.ai/threats/cve-2023-24998-apache-commons-fileupload-denial-of-service-via-resource"},{"cve":"CVE-2022-42252","cvss":3.1,"epss":0.0154,"slug":"cve-2022-42252-apache-tomcat-may-reject-request-containing-invalid-content","title":"Apache Tomcat may reject request containing invalid Content-Length header","severity":"low","exploited":false,"published_at":"2022-11-01T12:00:30+00:00","url":"https://junglewise.ai/threats/cve-2022-42252-apache-tomcat-may-reject-request-containing-invalid-content"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"org.jenkins-ci.main:jenkins-core (Maven)","slug":"org-jenkins-ci-main-jenkins-core","vulnerabilities":259,"url":"https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core"},{"name":"org.apache.tomcat:tomcat (Maven)","slug":"org-apache-tomcat-tomcat","vulnerabilities":169,"url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat"},{"name":"com.liferay.portal:release.portal.bom (Maven)","slug":"com-liferay-portal-release-portal-bom","vulnerabilities":159,"url":"https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom"},{"name":"com.liferay.portal:release.dxp.bom (Maven)","slug":"com-liferay-portal-release-dxp-bom","vulnerabilities":125,"url":"https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom"},{"name":"org.keycloak:keycloak-services (Maven)","slug":"org-keycloak-keycloak-services","vulnerabilities":122,"url":"https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services"},{"name":"com.fasterxml.jackson.core:jackson-databind (Maven)","slug":"com-fasterxml-jackson-core-jackson-databind","vulnerabilities":86,"url":"https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind"},{"name":"org.apache.tomcat.embed:tomcat-embed-core (Maven)","slug":"org-apache-tomcat-embed-tomcat-embed-core","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core"},{"name":"org.apache.struts:struts2-core (Maven)","slug":"org-apache-struts-struts2-core","vulnerabilities":60,"url":"https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core"},{"name":"org.keycloak:keycloak-core (Maven)","slug":"org-keycloak-keycloak-core","vulnerabilities":57,"url":"https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core"},{"name":"org.xwiki.platform:xwiki-platform-oldcore (Maven)","slug":"org-xwiki-platform-xwiki-platform-oldcore","vulnerabilities":46,"url":"https://junglewise.ai/threats/technologies/org-xwiki-platform-xwiki-platform-oldcore"},{"name":"org.apache.tomcat:tomcat-catalina (Maven)","slug":"org-apache-tomcat-tomcat-catalina","vulnerabilities":44,"url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina"},{"name":"org.elasticsearch:elasticsearch (Maven)","slug":"org-elasticsearch-elasticsearch","vulnerabilities":41,"url":"https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch"}],"technology":{"hub":true,"name":"org.apache.tomcat:tomcat-coyote (Maven)","slug":"org-apache-tomcat-tomcat-coyote","vendor":{"hub":true,"name":"Maven","slug":"maven","url":"https://junglewise.ai/threats/vendors/maven"},"aliases":[],"homepage":"https://tomcat.apache.org/","repo_url":"https://github.com/apache/tomcat","description":"Apache Tomcat HTTP connector and protocol handler component.","url":"https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-coyote"},"most_severe":[{"cve":"CVE-2023-44487","cvss":5.3,"epss":1,"slug":"cve-2023-44487-http-2-rapid-reset-attack-vulnerability","title":"Multiple Vendors HTTP/2 denial of service via Rapid Reset attack","severity":"critical","exploited":true,"published_at":"2023-10-10T21:28:24+00:00","url":"https://junglewise.ai/threats/cve-2023-44487-http-2-rapid-reset-attack-vulnerability"},{"cve":"CVE-2026-41293","cvss":9.8,"epss":0.0168,"slug":"cve-2026-41293-apache-tomcat-improper-input-validation-in-http-2-request-headers","title":"Apache Tomcat improper input validation in HTTP/2 request headers","severity":"critical","exploited":false,"published_at":"2026-05-12T16:16:17.553+00:00","url":"https://junglewise.ai/threats/cve-2026-41293-apache-tomcat-improper-input-validation-in-http-2-request-headers"},{"cve":"CVE-2026-65637","cvss":9.8,"epss":0.0061,"slug":"cve-2026-65637-apache-tomcat-improper-input-validation-in-incomplete-fix","title":"Apache Tomcat improper input validation in incomplete fix","severity":"critical","exploited":false,"published_at":"2026-08-25T22:17:05.177+00:00","url":"https://junglewise.ai/threats/cve-2026-65637-apache-tomcat-improper-input-validation-in-incomplete-fix"},{"cve":"CVE-2025-66614","cvss":9.1,"epss":0.0024,"slug":"cve-2025-66614-apache-tomcat-client-certificate-verification-bypass-via-sni","title":"Apache Tomcat client certificate verification bypass via SNI mismatch","severity":"critical","exploited":false,"published_at":"2026-02-17T21:31:13+00:00","url":"https://junglewise.ai/threats/cve-2025-66614-apache-tomcat-client-certificate-verification-bypass-via-sni"},{"cve":"CVE-2024-38286","cvss":8.6,"epss":0.0169,"slug":"cve-2024-38286-apache-tomcat-resource-exhaustion-in-tls-handshake","title":"Apache Tomcat resource exhaustion in TLS handshake","severity":"high","exploited":false,"published_at":"2024-11-07T09:30:42+00:00","url":"https://junglewise.ai/threats/cve-2024-38286-apache-tomcat-resource-exhaustion-in-tls-handshake"},{"cve":"CVE-2019-0199","cvss":7.5,"epss":0.7286,"slug":"cve-2019-0199-apache-tomcat-denial-of-service-in-http-2-implementation","title":"Apache Tomcat Denial of Service in HTTP/2 implementation","severity":"high","exploited":false,"published_at":"2020-06-15T18:51:09+00:00","url":"https://junglewise.ai/threats/cve-2019-0199-apache-tomcat-denial-of-service-in-http-2-implementation"},{"cve":"CVE-2020-13934","cvss":7.5,"epss":0.6412,"slug":"cve-2020-13934-apache-tomcat-denial-of-service-via-h2c-connection-leak","title":"Apache Tomcat denial of service via h2c connection leak","severity":"high","exploited":false,"published_at":"2022-02-08T22:05:00+00:00","url":"https://junglewise.ai/threats/cve-2020-13934-apache-tomcat-denial-of-service-via-h2c-connection-leak"},{"cve":"CVE-2023-24998","cvss":7.5,"epss":0.4879,"slug":"cve-2023-24998-apache-commons-fileupload-denial-of-service-via-resource","title":"Apache Commons FileUpload denial of service via resource exhaustion","severity":"high","exploited":false,"published_at":"2023-02-20T18:30:17+00:00","url":"https://junglewise.ai/threats/cve-2023-24998-apache-commons-fileupload-denial-of-service-via-resource"},{"cve":"CVE-2021-25122","cvss":7.5,"epss":0.1811,"slug":"cve-2021-25122-apache-tomcat-information-disclosure-in-h2c-connection-handling","title":"Apache Tomcat information disclosure in h2c connection handling","severity":"high","exploited":false,"published_at":"2021-06-16T17:45:29+00:00","url":"https://junglewise.ai/threats/cve-2021-25122-apache-tomcat-information-disclosure-in-h2c-connection-handling"},{"cve":"CVE-2025-48989","cvss":7.5,"epss":0.0369,"slug":"cve-2025-48989-apache-tomcat-denial-of-service-in-http-2-via-madeyoureset","title":"Apache Tomcat denial of service in HTTP/2 via MadeYouReset","severity":"high","exploited":false,"published_at":"2025-08-13T13:15:34.153+00:00","url":"https://junglewise.ai/threats/cve-2025-48989-apache-tomcat-denial-of-service-in-http-2-via-madeyoureset"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}