Technology · Apache
Apache Tomcat vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 87 vulnerabilities in Apache Tomcat: 1 in the last 7 days and 30 in the last 90 days, 23 of them critical and 7 exploited in the wild. The most recent, CVE-2026-111248, was published on 10 November 2026. 8 vulnerabilities in the last four weeks, down 27% on the four before (11). 0 critical against 3.
- Last 7 days
- 1
- Last 90 days
- 30
- Critical, all time
- 23
- Exploited in the wild
- 7
About Apache Tomcat
Java-based web server and servlet container implementing Java EE standards.
Latest Apache Tomcat vulnerabilities
- CVE-2026-111248: Apache Tomcat Jakarta Security credential handler bypassinfo
- CVE-2026-93446: Apache Tomcat incomplete cleanup in TLS 1.3 connectionsinfo
- CVE-2026-88041: Apache Tomcat HTTP trailer information leak between requestsinfo
- CVE-2026-80353: Apache Tomcat TOCTOU race condition in APR/Native connectorinfo
- CVE-2026-74049: Apache Tomcat Execution After Redirect vulnerabilityinfo
- CVE-2026-74048: Apache Tomcat FIPS mode validation not failing securelyinfo
- CVE-2026-103119: Apache Tomcat buffer under-read in non-blocking writesinfo
- CVE-2026-101356: Apache Tomcat object recycling vulnerability in HTTP/2 async servletsinfo
- CVE-2026-101296: Apache Tomcat authentication bypass in JNDI realminfo
- CVE-2026-87022: Apache Tomcat WebSocket message smuggling in per-message-deflatehighCVSS 7.5EPSS 0.4%
- CVE-2026-86350: Apache Tomcat HTTP/2 request smuggling via header mix-upcriticalCVSS 9.1EPSS 0.3%
- CVE-2026-86248: Apache Tomcat CLIENT_CERT authentication bypass when soft fail disabledcriticalCVSS 9.8EPSS 0.4%
- CVE-2026-79677: Apache Tomcat WebSocket denial of service due to lost async write timeouthighCVSS 7.5EPSS 0.3%
- CVE-2026-78437: Apache Tomcat incomplete cleanup denial of service in HTTP/2highCVSS 7.3EPSS 0.3%
- CVE-2026-78383: Apache Tomcat resource exhaustion in AJP connectorhighCVSS 7.5EPSS 0.4%
- CVE-2026-77791: Apache Tomcat denial of service in WebSocket close message handlinghighCVSS 7.5EPSS 0.5%
- CVE-2026-77762: Apache Tomcat HTTP/2 trailer field injection race conditionhighCVSS 8.1EPSS 0.4%
- CVE-2026-76183: Apache Tomcat authentication bypass in WebSocket endpointscriticalCVSS 9.8EPSS 0.4%
- CVE-2026-75973: Apache Tomcat improper authentication in Jakarta AuthenticationhighCVSS 7.3EPSS 0.2%
- CVE-2026-73581: Apache Tomcat certificate revocation check bypass in TLSmediumCVSS 6.5EPSS 0.1%
- CVE-2026-73180: Apache Tomcat WebSocket session lifetime violationmediumCVSS 6.8EPSS 0.4%
- CVE-2026-68763: Apache Tomcat resource exhaustion in HTTP/2 backlog trackinghighCVSS 7.5EPSS 0.7%
- CVE-2026-68569: Apache Tomcat authentication bypass in DataSourceRealmhighCVSS 8.1EPSS 0.5%
- CVE-2026-68525: Apache Tomcat FORM authentication authorization bypasscriticalCVSS 9.1EPSS 0.6%
- CVE-2026-66422: Apache Tomcat improper authorization in security-role-refhighCVSS 8.1EPSS 0.5%
Most severe Apache Tomcat vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-34486: Apache Tomcat encryption bypass in EncryptInterceptorcriticalexploited in the wildCVSS 7.5EPSS 6.6%
- CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attackcriticalexploited in the wildCVSS 5.3EPSS 100.0%
- CVE-2025-24813: Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTcriticalexploited in the wildCVSS 3.1EPSS 99.9%
- CVE-2020-1938: Improper Privilege Management in Tomcatcriticalexploited in the wildCVSS 3.1EPSS 99.3%
- CVE-2017-12617: Unrestricted Upload of File with Dangerous Type Apache Tomcatcriticalexploited in the wildCVSS 3EPSS 100.0%
- CVE-2017-12615: When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the servercriticalexploited in the wildCVSS 3EPSS 99.6%
- CVE-2016-8735: Apache Tomcat Improper Access Control vulnerabilitycriticalexploited in the wildCVSS 3EPSS 90.3%
- CVE-2009-3555: Apache Tomcat plaintext injection via TLS renegotiationcriticalCVSS 9.8EPSS 87.3%
- CVE-2026-41293: Apache Tomcat improper input validation in HTTP/2 request headerscriticalCVSS 9.8EPSS 1.7%
- CVE-2026-43512: Apache Tomcat authentication bypass in digest authenticationcriticalCVSS 9.8EPSS 1.3%
Vulnerabilities per week
8 vulnerabilities in the last four weeks, down 27% on the four before (11). 0 critical against 3. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 10 | 4 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 11 | 3 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 8 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 1 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Apache Tomcat vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/tomcat)<a href="https://junglewise.ai/threats/technologies/tomcat"><img src="https://junglewise.ai/threats/technologies/tomcat/badge.svg" alt="Apache Tomcat vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/tomcat.json, and this page as text at https://junglewise.ai/threats/technologies/tomcat.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Apache Tomcat vulnerabilities", https://junglewise.ai/threats/technologies/tomcat, 12 November 2026.