# Apache Tomcat vulnerabilities Source: https://junglewise.ai/threats/technologies/tomcat Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/tomcat.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 87 vulnerabilities in Apache Tomcat: 1 in the last 7 days and 30 in the last 90 days, 23 of them critical and 7 exploited in the wild. The most recent, CVE-2026-111248, was published on 10 November 2026. 8 vulnerabilities in the last four weeks, down 27% on the four before (11). 0 critical against 3. ## Counts - Last 7 days: 1 - Last 30 days: 9 - Last 90 days: 30 - All time: 87 (23 critical, 7 exploited in the wild) ## About Apache Tomcat Java-based web server and servlet container implementing Java EE standards. ## Latest Apache Tomcat vulnerabilities - [CVE-2026-111248: Apache Tomcat Jakarta Security credential handler bypass](https://junglewise.ai/threats/cve-2026-111248-the-jakarta-security-identity-store-backed-by-the-tomcat-user) (info, published 10 Nov 2026) - [CVE-2026-93446: Apache Tomcat incomplete cleanup in TLS 1.3 connections](https://junglewise.ai/threats/cve-2026-93446-incomplete-cleanup-vulnerability-in-apache-tomcat-could-cause-tls) (info, published 20 Oct 2026) - [CVE-2026-88041: Apache Tomcat HTTP trailer information leak between requests](https://junglewise.ai/threats/cve-2026-88041-incomplete-cleanup-vulnerability-in-apache-tomcat-allowed-an) (info, published 20 Oct 2026) - [CVE-2026-80353: Apache Tomcat TOCTOU race condition in APR/Native connector](https://junglewise.ai/threats/cve-2026-80353-time-of-check-time-of-use-toctou-race-condition-vulnerability-in) (info, published 20 Oct 2026) - [CVE-2026-74049: Apache Tomcat Execution After Redirect vulnerability](https://junglewise.ai/threats/cve-2026-74049-execution-after-redirect-ear-vulnerability-in-apache-tomcat-this) (info, published 20 Oct 2026) - [CVE-2026-74048: Apache Tomcat FIPS mode validation not failing securely](https://junglewise.ai/threats/cve-2026-74048-not-failing-securely-failing-open-vulnerability-in-apache-tomcat) (info, published 20 Oct 2026) - [CVE-2026-103119: Apache Tomcat buffer under-read in non-blocking writes](https://junglewise.ai/threats/cve-2026-103119-buffer-under-read-vulnerability-in-apache-tomcat-meant-that-a) (info, published 20 Oct 2026) - [CVE-2026-101356: Apache Tomcat object recycling vulnerability in HTTP/2 async servlets](https://junglewise.ai/threats/cve-2026-101356-incorrect-object-recycling-and-re-use-vulnerability-in-apache) (info, published 20 Oct 2026) - [CVE-2026-101296: Apache Tomcat authentication bypass in JNDI realm](https://junglewise.ai/threats/cve-2026-101296-a-missing-critical-step-in-authentication-vulnerability-in) (info, published 20 Oct 2026) - [CVE-2026-87022: Apache Tomcat WebSocket message smuggling in per-message-deflate](https://junglewise.ai/threats/cve-2026-87022-improper-handling-of-length-parameter-inconsistency-vulnerability) (high, CVSS 7.5, published 23 Sep 2026) - [CVE-2026-86350: Apache Tomcat HTTP/2 request smuggling via header mix-up](https://junglewise.ai/threats/cve-2026-86350-inconsistent-interpretation-of-http-2-requests-http-request) (critical, CVSS 9.1, published 23 Sep 2026) - [CVE-2026-86248: Apache Tomcat CLIENT_CERT authentication bypass when soft fail disabled](https://junglewise.ai/threats/cve-2026-86248-client-cert-authentication-does-not-fail-as-expected-for-some) (critical, CVSS 9.8, published 23 Sep 2026) - [CVE-2026-79677: Apache Tomcat WebSocket denial of service due to lost async write timeout](https://junglewise.ai/threats/cve-2026-79677-missing-release-of-resource-after-effective-lifetime-comparison) (high, CVSS 7.5, published 23 Sep 2026) - [CVE-2026-78437: Apache Tomcat incomplete cleanup denial of service in HTTP/2](https://junglewise.ai/threats/cve-2026-78437-incomplete-cleanup-vulnerability-in-apache-tomcat-allows-a) (high, CVSS 7.3, published 23 Sep 2026) - [CVE-2026-78383: Apache Tomcat resource exhaustion in AJP connector](https://junglewise.ai/threats/cve-2026-78383-allocation-of-resources-without-limits-or-throttling) (high, CVSS 7.5, published 23 Sep 2026) - [CVE-2026-77791: Apache Tomcat denial of service in WebSocket close message handling](https://junglewise.ai/threats/cve-2026-77791-uncontrolled-resource-consumption-vulnerability-in-apache-tomcat) (high, CVSS 7.5, published 23 Sep 2026) - [CVE-2026-77762: Apache Tomcat HTTP/2 trailer field injection race condition](https://junglewise.ai/threats/cve-2026-77762-concurrent-execution-using-shared-resource-with-improper) (high, CVSS 8.1, published 23 Sep 2026) - [CVE-2026-76183: Apache Tomcat authentication bypass in WebSocket endpoints](https://junglewise.ai/threats/cve-2026-76183-authentication-bypass-by-alternate-name-vulnerability-in-apache) (critical, CVSS 9.8, published 23 Sep 2026) - [CVE-2026-75973: Apache Tomcat improper authentication in Jakarta Authentication](https://junglewise.ai/threats/cve-2026-75973-improper-authentication-vulnerability-in-apache-tomcat-when) (high, CVSS 7.3, published 23 Sep 2026) - [CVE-2026-73581: Apache Tomcat certificate revocation check bypass in TLS](https://junglewise.ai/threats/cve-2026-73581-improper-check-for-certificate-revocation-vulnerability-in-apache) (medium, CVSS 6.5, published 23 Sep 2026) - [CVE-2026-73180: Apache Tomcat WebSocket session lifetime violation](https://junglewise.ai/threats/cve-2026-73180-apache-tomcat-websocket-session-lifetime-violation) (medium, CVSS 6.8, published 25 Aug 2026) - [CVE-2026-68763: Apache Tomcat resource exhaustion in HTTP/2 backlog tracking](https://junglewise.ai/threats/cve-2026-68763-apache-tomcat-resource-exhaustion-in-http-2-backlog-tracking) (high, CVSS 7.5, published 25 Aug 2026) - [CVE-2026-68569: Apache Tomcat authentication bypass in DataSourceRealm](https://junglewise.ai/threats/cve-2026-68569-apache-tomcat-authentication-bypass-in-datasourcerealm) (high, CVSS 8.1, published 25 Aug 2026) - [CVE-2026-68525: Apache Tomcat FORM authentication authorization bypass](https://junglewise.ai/threats/cve-2026-68525-apache-tomcat-form-authentication-authorization-bypass) (critical, CVSS 9.1, published 25 Aug 2026) - [CVE-2026-66422: Apache Tomcat improper authorization in security-role-ref](https://junglewise.ai/threats/cve-2026-66422-apache-tomcat-improper-authorization-in-security-role-ref) (high, CVSS 8.1, published 25 Aug 2026) ## Most severe Apache Tomcat vulnerabilities - [CVE-2026-34486: Apache Tomcat encryption bypass in EncryptInterceptor](https://junglewise.ai/threats/cve-2026-34486-apache-tomcat-encryption-bypass-in-encryptinterceptor) (critical, exploited in the wild, CVSS 7.5, published 9 Apr 2026) - [CVE-2023-44487: Multiple Vendors HTTP/2 denial of service via Rapid Reset attack](https://junglewise.ai/threats/cve-2023-44487-http-2-rapid-reset-attack-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 10 Oct 2023) - [CVE-2025-24813: Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT](https://junglewise.ai/threats/cve-2025-24813-apache-tomcat-path-equivalence-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 10 Mar 2025) - [CVE-2020-1938: Improper Privilege Management in Tomcat](https://junglewise.ai/threats/cve-2020-1938-apache-tomcat-improper-privilege-management-vulnerability) (critical, exploited in the wild, CVSS 3.1, published 15 Jun 2020) - [CVE-2017-12617: Unrestricted Upload of File with Dangerous Type Apache Tomcat](https://junglewise.ai/threats/cve-2017-12617-apache-tomcat-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3, published 14 May 2022) - [CVE-2017-12615: When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server](https://junglewise.ai/threats/cve-2017-12615-apache-tomcat-on-windows-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3, published 17 Oct 2018) - [CVE-2016-8735: Apache Tomcat Improper Access Control vulnerability](https://junglewise.ai/threats/cve-2016-8735-apache-tomcat-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 3, published 13 May 2022) - [CVE-2009-3555: Apache Tomcat plaintext injection via TLS renegotiation](https://junglewise.ai/threats/cve-2009-3555-apache-tomcat-plaintext-injection-via-tls-renegotiation) (critical, CVSS 9.8, published 2 May 2022) - [CVE-2026-41293: Apache Tomcat improper input validation in HTTP/2 request headers](https://junglewise.ai/threats/cve-2026-41293-apache-tomcat-improper-input-validation-in-http-2-request-headers) (critical, CVSS 9.8, published 12 May 2026) - [CVE-2026-43512: Apache Tomcat authentication bypass in digest authentication](https://junglewise.ai/threats/cve-2026-43512-apache-tomcat-authentication-bypass-in-digest-authentication) (critical, CVSS 9.8, published 12 May 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, down 27% on the four before (11). 0 critical against 3. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 10 | 4 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 11 | 3 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 8 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Other Apache technologies - [Apache Airflow](https://junglewise.ai/threats/technologies/airflow): 95 vulnerabilities - [Apache Camel](https://junglewise.ai/threats/technologies/camel): 87 vulnerabilities - [Apache Thrift](https://junglewise.ai/threats/technologies/thrift): 77 vulnerabilities - [Apache Ofbiz](https://junglewise.ai/threats/technologies/ofbiz): 67 vulnerabilities - [Apache HTTP Server](https://junglewise.ai/threats/technologies/http-server): 62 vulnerabilities - [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server): 55 vulnerabilities - [Apache Brpc](https://junglewise.ai/threats/technologies/brpc): 36 vulnerabilities - [Apache Roller](https://junglewise.ai/threats/technologies/roller): 30 vulnerabilities - [Apache CloudStack](https://junglewise.ai/threats/technologies/cloudstack): 28 vulnerabilities - [Apache ActiveMQ](https://junglewise.ai/threats/technologies/activemq): 27 vulnerabilities - [Apache Apisix](https://junglewise.ai/threats/technologies/apisix): 27 vulnerabilities - [Apache Wicket](https://junglewise.ai/threats/technologies/apache-wicket): 23 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Apache Tomcat vulnerabilities", https://junglewise.ai/threats/technologies/tomcat, 12 November 2026.