# org.apache.tomcat:tomcat-coyote (Maven) vulnerabilities Source: https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-coyote Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-coyote.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 34 vulnerabilities in org.apache.tomcat:tomcat-coyote (Maven): 0 in the last 7 days and 1 in the last 90 days, 4 of them critical and 1 exploited in the wild. The most recent, CVE-2026-65637, was published on 25 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 1 - All time: 34 (4 critical, 1 exploited in the wild) ## About org.apache.tomcat:tomcat-coyote (Maven) Apache Tomcat HTTP connector and protocol handler component. ## Latest org.apache.tomcat:tomcat-coyote (Maven) vulnerabilities - [CVE-2026-65637: Apache Tomcat improper input validation in incomplete fix](https://junglewise.ai/threats/cve-2026-65637-apache-tomcat-improper-input-validation-in-incomplete-fix) (critical, CVSS 9.8, published 25 Aug 2026) - [CVE-2026-41293: Apache Tomcat improper input validation in HTTP/2 request headers](https://junglewise.ai/threats/cve-2026-41293-apache-tomcat-improper-input-validation-in-http-2-request-headers) (critical, CVSS 9.8, published 12 May 2026) - [CVE-2026-32990: Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of . This issue affects Apache Tomcat…](https://junglewise.ai/threats/cve-2026-32990-apache-tomcat-improper-input-validation) (medium, CVSS 5.3, published 9 Apr 2026) - [CVE-2026-29129: Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from…](https://junglewise.ai/threats/cve-2026-29129-apache-tomcat-cipher-preference-order-not-preserved) (high, CVSS 7.5, published 9 Apr 2026) - [CVE-2026-24880: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via…](https://junglewise.ai/threats/cve-2026-24880-apache-tomcat-http-request-smuggling-via-invalid-chunk-extension) (high, CVSS 7.5, published 9 Apr 2026) - [CVE-2025-66614: Apache Tomcat client certificate verification bypass via SNI mismatch](https://junglewise.ai/threats/cve-2025-66614-apache-tomcat-client-certificate-verification-bypass-via-sni) (critical, CVSS 9.1, published 17 Feb 2026) - [CVE-2026-24733: Apache Tomcat security constraint bypass in HTTP/0.9 handling](https://junglewise.ai/threats/cve-2026-24733-apache-tomcat-security-constraint-bypass-in-http-0-9-handling) (medium, CVSS 4, published 17 Feb 2026) - [CVE-2026-24734: Apache Tomcat certificate revocation bypass in OCSP validation](https://junglewise.ai/threats/cve-2026-24734-apache-tomcat-certificate-revocation-bypass-in-ocsp-validation) (high, CVSS 7.5, published 17 Feb 2026) - [CVE-2025-48989: Apache Tomcat denial of service in HTTP/2 via MadeYouReset](https://junglewise.ai/threats/cve-2025-48989-apache-tomcat-denial-of-service-in-http-2-via-madeyoureset) (high, CVSS 7.5, published 13 Aug 2025) - [CVE-2025-53506: Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams](https://junglewise.ai/threats/cve-2025-53506-apache-tomcat-coyote-vulnerable-to-denial-of-service-via) (low, CVSS 3.1, published 10 Jul 2025) - [CVE-2025-52434: Apache Tomcat race condition in APR/Native connector](https://junglewise.ai/threats/cve-2025-52434-apache-tomcat-race-condition-in-apr-native-connector) (high, CVSS 7.5, published 10 Jul 2025) - [CVE-2025-31650: Apache Tomcat Denial of Service via invalid HTTP priority header](https://junglewise.ai/threats/cve-2025-31650-apache-tomcat-denial-of-service-via-invalid-http-priority-header) (medium, CVSS 4, published 28 Apr 2025) - [CVE-2024-52317: Apache Tomcat Request and/or response mix-up](https://junglewise.ai/threats/cve-2024-52317-apache-tomcat-request-and-or-response-mix-up) (low, CVSS 3.1, published 18 Nov 2024) - [CVE-2024-38286: Apache Tomcat resource exhaustion in TLS handshake](https://junglewise.ai/threats/cve-2024-38286-apache-tomcat-resource-exhaustion-in-tls-handshake) (high, CVSS 8.6, published 7 Nov 2024) - [CVE-2024-34750: Apache Tomcat - Denial of Service](https://junglewise.ai/threats/cve-2024-34750-apache-tomcat-denial-of-service) (low, CVSS 3.1, published 3 Jul 2024) - [CVE-2024-24549: Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests](https://junglewise.ai/threats/cve-2024-24549-apache-tomcat-denial-of-service-due-to-improper-input-validation) (low, CVSS 3.1, published 13 Mar 2024) - [CVE-2024-21733: Apache Tomcat sensitive information disclosure in error messages](https://junglewise.ai/threats/cve-2024-21733-apache-tomcat-sensitive-information-disclosure-in-error-messages) (medium, CVSS 5.3, published 19 Jan 2024) - [CVE-2023-46589: Apache Tomcat Improper Input Validation vulnerability](https://junglewise.ai/threats/cve-2023-46589-apache-tomcat-improper-input-validation-vulnerability) (high, CVSS 7.5, published 28 Nov 2023) - [CVE-2023-45648: Apache Tomcat request smuggling via improper trailer header parsing](https://junglewise.ai/threats/cve-2023-45648-apache-tomcat-request-smuggling-via-improper-trailer-header) (medium, CVSS 5.3, published 10 Oct 2023) - [CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attack](https://junglewise.ai/threats/cve-2023-44487-http-2-rapid-reset-attack-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 10 Oct 2023) - [CVE-2023-42794: Apache Tomcat Incomplete Cleanup vulnerability](https://junglewise.ai/threats/cve-2023-42794-apache-tomcat-incomplete-cleanup-vulnerability) (low, CVSS 3.1, published 10 Oct 2023) - [CVE-2023-28709: Apache Tomcat - Fix for was incomplete](https://junglewise.ai/threats/cve-2023-28709-apache-tomcat-fix-for-was-incomplete) (low, CVSS 3.1, published 6 Jul 2023) - [CVE-2023-34981: Apache Tomcat vulnerable to information leak](https://junglewise.ai/threats/cve-2023-34981-apache-tomcat-vulnerable-to-information-leak) (low, CVSS 3.1, published 21 Jun 2023) - [CVE-2023-24998: Apache Commons FileUpload denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2023-24998-apache-commons-fileupload-denial-of-service-via-resource) (high, CVSS 7.5, published 20 Feb 2023) - [CVE-2022-42252: Apache Tomcat may reject request containing invalid Content-Length header](https://junglewise.ai/threats/cve-2022-42252-apache-tomcat-may-reject-request-containing-invalid-content) (low, CVSS 3.1, published 1 Nov 2022) ## Most severe org.apache.tomcat:tomcat-coyote (Maven) vulnerabilities - [CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attack](https://junglewise.ai/threats/cve-2023-44487-http-2-rapid-reset-attack-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 10 Oct 2023) - [CVE-2026-41293: Apache Tomcat improper input validation in HTTP/2 request headers](https://junglewise.ai/threats/cve-2026-41293-apache-tomcat-improper-input-validation-in-http-2-request-headers) (critical, CVSS 9.8, published 12 May 2026) - [CVE-2026-65637: Apache Tomcat improper input validation in incomplete fix](https://junglewise.ai/threats/cve-2026-65637-apache-tomcat-improper-input-validation-in-incomplete-fix) (critical, CVSS 9.8, published 25 Aug 2026) - [CVE-2025-66614: Apache Tomcat client certificate verification bypass via SNI mismatch](https://junglewise.ai/threats/cve-2025-66614-apache-tomcat-client-certificate-verification-bypass-via-sni) (critical, CVSS 9.1, published 17 Feb 2026) - [CVE-2024-38286: Apache Tomcat resource exhaustion in TLS handshake](https://junglewise.ai/threats/cve-2024-38286-apache-tomcat-resource-exhaustion-in-tls-handshake) (high, CVSS 8.6, published 7 Nov 2024) - [CVE-2019-0199: Apache Tomcat Denial of Service in HTTP/2 implementation](https://junglewise.ai/threats/cve-2019-0199-apache-tomcat-denial-of-service-in-http-2-implementation) (high, CVSS 7.5, published 15 Jun 2020) - [CVE-2020-13934: Apache Tomcat denial of service via h2c connection leak](https://junglewise.ai/threats/cve-2020-13934-apache-tomcat-denial-of-service-via-h2c-connection-leak) (high, CVSS 7.5, published 8 Feb 2022) - [CVE-2023-24998: Apache Commons FileUpload denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2023-24998-apache-commons-fileupload-denial-of-service-via-resource) (high, CVSS 7.5, published 20 Feb 2023) - [CVE-2021-25122: Apache Tomcat information disclosure in h2c connection handling](https://junglewise.ai/threats/cve-2021-25122-apache-tomcat-information-disclosure-in-h2c-connection-handling) (high, CVSS 7.5, published 16 Jun 2021) - [CVE-2025-48989: Apache Tomcat denial of service in HTTP/2 via MadeYouReset](https://junglewise.ai/threats/cve-2025-48989-apache-tomcat-denial-of-service-in-http-2-via-madeyoureset) (high, CVSS 7.5, published 13 Aug 2025) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 1 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Maven technologies - [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core): 259 vulnerabilities - [org.apache.tomcat:tomcat (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat): 169 vulnerabilities - [com.liferay.portal:release.portal.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom): 159 vulnerabilities - [com.liferay.portal:release.dxp.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom): 125 vulnerabilities - [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services): 122 vulnerabilities - [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind): 86 vulnerabilities - [org.apache.tomcat.embed:tomcat-embed-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core): 83 vulnerabilities - [org.apache.struts:struts2-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core): 60 vulnerabilities - [org.keycloak:keycloak-core (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core): 57 vulnerabilities - [org.xwiki.platform:xwiki-platform-oldcore (Maven)](https://junglewise.ai/threats/technologies/org-xwiki-platform-xwiki-platform-oldcore): 46 vulnerabilities - [org.apache.tomcat:tomcat-catalina (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina): 44 vulnerabilities - [org.elasticsearch:elasticsearch (Maven)](https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch): 41 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "org.apache.tomcat:tomcat-coyote (Maven) vulnerabilities", https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-coyote, 9 November 2026.