This vulnerability (CVE-2026-50229) in Apache Tomcat is a CWE-80 improper neutralization of script-related HTML tags, resulting in a basic cross-site scripting (XSS) flaw in the number guess example application. It affects multiple major branches of Apache Tomcat from early milestone releases through specific versions: 7.0.0 to 7.0.109, 8.5.0 to 8.5.100, 9.0.0.M1 to 9.0.118, 10.1.0-M1 to 10.1.55, and 11.0.0-M1 to 11.0.22. The vulnerability allows an attacker to inject malicious scripts that can execute in the user's browser, potentially leading to information disclosure or session hijacking. The CVSS v3.1 base score is 6.1 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity. The vendor recommends upgrading to versions 11.0.23, 10.1.56, or 9.0.119 and later, which contain fixes for this issue.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary script code in the context of a user's browser when interacting with the vulnerable number guess example in Apache Tomcat. This can lead to limited confidentiality and integrity impacts such as theft of user session information or manipulation of web content. There is no impact on availability. The vulnerability requires user interaction and has a medium severity rating.

Users should upgrade affected Apache Tomcat versions to 11.0.23, 10.1.56, 9.0.119, or later versions where the vulnerability is fixed. No official temporary or alternative mitigations are indicated. Patch status is confirmed by the vendor's recommended upgrade versions. Users should verify their Tomcat version and apply the upgrade accordingly.