Threats affecting pkg:maven/org.apache.tomcat/tomcat

A buffer under-read vulnerability in Apache Tomcat versions 11.0.0-M25 through 11.0.26 can cause the response body of a large non-blocking write to be split between the current and next request on the same connection. This may lead to failure of the second request and potential data leakage from the first response to the second. The issue is fixed in version 11.0.27.

CVE-2026-101356 is a critical vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets. It involves incorrect object recycling and reuse, which can cause request and response mix-ups between users. This flaw affects Apache Tomcat versions 9.0.118 through 9.0.122, 10.1.55 through 10.1.60, and 11.0.22 through 11.0.26. The issue is resolved in versions 9.0.123, 10.1.61, and 11.0.27.

A critical authentication vulnerability exists in Apache Tomcat when using the JNDI realm configured with a non-GSSAPI SASL authentication mechanism. This flaw allows attackers to bypass password verification and authenticate without providing the correct password. The issue affects multiple versions of Apache Tomcat, including 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, 9.0.0.M1 through 9.0.122, and certain end-of-life versions. Fixed versions are 11.0.27, 10.1.61, and 9.0.123.

CVE-2026-93446 is an incomplete cleanup vulnerability in Apache Tomcat that can cause TLS 1.3 connections to fail intermittently. The issue affects multiple versions of Apache Tomcat and has been fixed in later releases. Users should upgrade to the fixed versions to resolve the problem.

An incomplete cleanup vulnerability in Apache Tomcat allows trailer information from a previous request to leak into a subsequent request. This affects multiple versions of Apache Tomcat and has been fixed in later releases.

CVE-2026-80353 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat affecting the APR/Native connector when creating Unix domain sockets. This flaw allows an unauthorized local user to access the Unix domain socket. The issue affects Apache Tomcat versions from 9.0.47 through 9.0.122 and was fixed in version 9.0.123.

CVE-2026-74049 is an Execution After Redirect (EAR) vulnerability in Apache Tomcat affecting multiple versions from 7.0.0 through 11.0.26. The flaw allows execution of code after an HTTP redirect, potentially leading to partial compromise of confidentiality and integrity. The issue is fixed in Apache Tomcat versions 11.0.27, 10.1.61, and 9.0.123.

CVE-2026-74048 is a failing open vulnerability in Apache Tomcat related to the OpenSSLLifecycleListener configured for FIPS mode. If FIPS activation fails, Tomcat logs an error but continues operating in non-FIPS mode using JSSE, potentially weakening cryptographic security. This affects Apache Tomcat versions 9.0.92 through 9.0.122, 10.1.22 through 10.1.60, and 11.0.0-M14 through 11.0.26. Upgrading to versions 9.0.123, 10.1.61, or 11.0.27 resolves the issue.

CVE-2026-87022 is a high-severity vulnerability in Apache Tomcat involving improper handling of length parameter inconsistencies when using per-message-deflate in WebSocket communications. This flaw allows WebSocket message smuggling, potentially enabling attackers to interfere with message integrity. The vulnerability affects multiple versions of Apache Tomcat, including 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, and some older end-of-support versions. Fixed versions are available, and users are advised to upgrade to 11.0.26, 10.1.60, or 9.1.22 to mitigate the issue.

CVE-2026-86350 is a critical vulnerability in Apache Tomcat involving inconsistent interpretation of HTTP/2 requests, leading to HTTP Request/Response smuggling. This flaw is a regression from a previous fix (CVE-2026-41293) and can cause request header mix-ups. It affects Apache Tomcat versions 9.0.118 through 9.0.121, 10.1.55 through 10.1.59, and 11.0.22 through 11.0.25. Upgrading to versions 9.0.122, 10.1.60, or 11.0.26 resolves the issue.

A race condition vulnerability (CWE-362) in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request due to improper synchronization of shared resources. This affects multiple versions of Apache Tomcat including 8.5.59 through 8.5.100, 9.0.39 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25. The issue is fixed in versions 8.5.101 and later, 9.0.122 and later, 10.1.60 and later, and 11.0.26 and later. The vulnerability has a high severity with a CVSS score of 8.1.

CVE-2026-77756 is a medium severity vulnerability in Apache Tomcat involving inconsistent interpretation of HTTP requests, specifically HTTP Request/Response Smuggling. The issue arises from how the transfer-encoding header is processed for HTTP/1.0 requests when Tomcat is behind a reverse proxy, potentially causing one user's request to fail due to another user's request. Affected versions include Apache Tomcat 8.5.67 through 8.5.100, 9.0.47 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25. Users are advised to upgrade to fixed versions 8.5.101 or later, 9.0.122 or later, 10.1.60 or later, or 11.0.26 or later to remediate the issue.

CVE-2026-76183 is a critical authentication bypass vulnerability in Apache Tomcat affecting multiple versions from 7.0.43 through 11.0.25. It allows bypassing security constraints on WebSocket endpoints, potentially enabling unauthorized access. The issue is fixed in Apache Tomcat versions 11.0.26, 10.1.60, and 9.0.122. Users should upgrade to these versions to mitigate the risk.

CVE-2026-75973 is an improper authentication vulnerability in Apache Tomcat affecting multiple versions. When Jakarta Authentication is configured with SimpleAuthConfigProvider as the default provider and multiple web applications use it, the authentication realm from the first web application is incorrectly applied to all others. This can lead to authentication bypass or cross-application authentication issues. The vulnerability affects Apache Tomcat versions from 8.5.0 through 8.5.100, 9.0.0.M4 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25. Fixed versions are 8.5.101, 9.0.122, 10.1.60, and 11.0.26. The CVSS score is 7.3 (high severity).

A vulnerability in Apache Tomcat's CLIENT_CERT authentication allows authentication to not fail as expected in certain scenarios when soft fail is disabled. This affects multiple versions of Apache Tomcat and can lead to critical impacts on confidentiality, integrity, and availability. Fixed versions have been released to address this issue.

CVE-2026-79677 is a high-severity vulnerability in Apache Tomcat involving a missing release of resources after their effective lifetime, specifically related to asynchronous WebSocket writes. This flaw can cause denial of service due to lost timeouts. It affects multiple versions across several major Tomcat branches, including 7.0.43 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25. Fixed versions are 11.0.26, 10.1.60, and 9.0.122.

CVE-2026-78437 is an incomplete cleanup vulnerability in Apache Tomcat that may cause one user's request to fail due to a malformed request from another user, depending on timing. It affects Apache Tomcat versions 9.0.116 through 9.0.121, 10.1.53 through 10.1.59, and 11.0.19 through 11.0.25. The issue is fixed in versions 9.0.122, 10.1.60, and 11.0.26.