Security 9

This page lists all security vulnerabilities fixed in released versions of Apache Tomcat ® 9.x. Each vulnerability is given a security impact rating by the Apache Tomcat security team — please note that this rating may vary from platform to platform. We also list the versions of Apache Tomcat the flaw is known to affect, and where a flaw has not been verified list the version with a question mark.

Note: Vulnerabilities that are not Tomcat vulnerabilities but have either been incorrectly reported against Tomcat or where Tomcat provides a workaround are listed at the end of this page.

Please note that binary patches are never provided. If you need to apply a source code patch, use the building instructions for the Apache Tomcat version that you are using. For Tomcat 9.0 those are building.html and BUILDING.txt . Both files can be found in the webapps/docs subdirectory of a binary distribution. You may also want to review the Security Considerations page in the documentation.

If you need help on building or configuring Tomcat or other help on following the instructions to mitigate the known vulnerabilities listed here, please send your questions to the public Tomcat Users mailing list

If you have encountered an unlisted security vulnerability or other unexpected behaviour that has security impact , or if the descriptions here are incomplete, please report them privately to the Tomcat Security Team . Thank you.

Low: DoS in WebSocket chat example CVE-2026-66299

The WebSocket chat example provided an unbounded buffer for undelivered messages. A maliciously slow client could cause the buffer to grow continuously, eventually leading to an memory exhaustion and failure of the Tomcat process.

This was fixed with commit f6dda658 .

This issue was reported to the Tomcat security team on 13 July 2026. The issue was made public on 28 July 2026.

Affects: 9.0.89 to 9.0.120 Users who followed the security guidance to remove the examples web application are not affected.

Low: EncryptInterceptor requirements not clearly documented CVE-2026-59084

The requirements to securely configure the EncryptInterceptor were not clearly documented.

This was fixed with commit 617d7275 .

This issue was reported to the Tomcat security team on 29 June 2026. The issue was made public on 14 July 2026.

Affects: 9.0.13 to 9.0.119

Low: Incorrect URL decoding in RewriteValve may allow security control bypass CVE-2026-59083

Incorrect decoding of + in rewritten URIs to a single space could allow security control bypass for some configurations.

This was fixed with commit a520aecb .

This issue was identified by the Tomcat security team on 26 June 2026. The issue was made public on 14 July 2026.

Affects: 9.0.0.M1 to 9.0.119

Moderate: Security constraints for default servlet ignored method CVE-2026-55956

If security constraints were specified for the default servlet, any method or method omission configured as part of the constraint was ignored.

This was fixed with commit a0374c45 .

This issue was reported to the Tomcat security team on 15 June 2026. The issue was made public on 29 June 2026.

Affects: 9.0.0.M1 to 9.0.118

Low: EncryptInterceptor not protected against replay attacks CVE-2026-55955

Contrary to the documentation, the EncryptInterceptor was not protected against replay attacks.

This was fixed with commit 6a7a432c .

This issue was reported to the Tomcat security team on 17 June 2026. The issue was made public on 29 June 2026.

Affects: 9.0.13 to 9.0.118

Low: Logged effective web.xml is incomplete CVE-2026-55276

Logic errors in the effective web.xml generation meant that neither special roles nor empty authorization constraints were included in the logged effective web.xml.

This was fixed with commit 3ca8cae5 .

This issue was reported to the Tomcat security team on 16 June 2026. The issue was made public on 29 June 2026.

Affects: 9.0.0.M1 to 9.0.118

Low: Invalid CRL configuration doesn't trigger failure for FFM Connector CVE-2026-53434

If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.

This was fixed with commit c48ac39c .

This issue was reported to the Tomcat security team on 8 June 2026. The issue was made public on 29 June 2026.

Affects: 9.0.83 to 9.0.118

Low: Bad ornext processing in RewriteValve CVE-2026-53404

If a request matched the first condition in an OR chain, subsequent non-OR conditions were skipped and the rewrite succeeded.

This was fixed with commit fe06ae8a .

This issue was reported to the Tomcat security team on 28 May 2026. The issue was made public on 29 June 2026.

Affects: 9.0.0.M1 to 9.0.118

Low: XSS in number guess example CVE-2026-50229

The use of wild card property mapping resulted in some properties, that were intended to be internal only, being exposed to clients allowing an XSS attack.

This was fixed with commit de5a9504 .

This issue was reported to the Tomcat security team on 11 May 2026. The issue was made public on 29 June 2026.

Affects: 9.0.0.M1 to 9.0.118

Moderate: Security constraints not correctly applied CVE-2026-43515

When multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied.

This was fixed with commit db919ff9 .

This issue was reported to the Tomcat security team on 20 April 2026. The issue was made public on 12 May 2026.

Affects: 9.0.0.M1 to 9.0.117

Low: AJP secret compared in non-constant time CVE-2026-43514

The AJP secret was compared in non-constant time allowing an attacker on the local network to mount a timing attack to determine the AJP secret.

This was fixed with commits 933dcdbf and 2e676264 .

This issue was reported to the Tomcat security team on 20 April 2026. The issue was made public on 12 May 2026.

Affects: 9.0.0.M1 to 9.0.117

Low: LockOutRealm treats user names as case-sensitive CVE-2026-43513

The LockOut Realm treated user names as case sensitive meaning that, for Realms where the user name was case insensitive, the LockOut Realm was not as effective at blocking brute force attacks against a user's password.

This was fixed with commit 6dd75beb .

This issue was reported to the Tomcat security team on 20 April 2026. The issue was made public on 12 May 2026.

Affects: 9.0.0.M1 to 9.0.117

Moderate: Digest authenticator will authenticate any unknown user CVE-2026-43512

When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null".

This was fixed with commit 6565a6cb .

This issue was reported to the Tomcat security team on 20 April 2026. The issue was made public on 12 May 2026.

Affects: 9.0.0.M1 to 9.0.117

Low: WebSocket authentication header exposure CVE-2026-42498

If a WebSocket request was redirected after authentication, Tomcat's WebSocket client would present the most recent authentication header to the redirect target host.

This was fixed with commit 169d7257 .

This issue was reported to the Tomcat security team on 21 April 2026. The issue was made public on 12 May 2026.

Affects: 9.0.2 to 9.0.117

Low: HTTP/2 request headers not validated CVE-2026-41293

HTTP/2 request headers were not validated which may have triggered unexpected application behaviour if the application (quite reasonably) assumed that header value exposed through the Servlet API would be specification compliant.

This was fixed with commits cf945244 , 1c704804 and 57c2b3bf .

This issue was reported to the Tomcat security team on 15 April 2026. The issue was made public on 12 May 2026.

Affects: 9.0.0.M1 to 9.0.117

Low: Unbounded read in WebDAV LOCK and PROPFIND handling CVE-2026-41284

No limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users.

This was fixed with commit 17dacd9a .

This issue was reported to the Tomcat security team on 11 April 2026. The issue was made public on 12 May 2026.

Affects: 9.0.0.M1 to 9.0.117

Moderate: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled CVE-2026-34500

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used.

This was fixed with commit ff589ab2 .

This issue was reported to the Tomcat security team on 25 March 2026. The issue was made public on 9 April 2026.

Affects: 9.0.92 to 9.0.116

Low: Cloud membership for clustering component exposed the Kubernetes bearer token CVE-2026-34487

The cloud membership for clustering component exposed the Kubernetes bearer token in log messages.

This was fixed with commit f593292a .

This issue was reported to the Tomcat security team on 25 March 2026. The issue was made public on 9 April 2026.

Affects: 9.0.13 to 9.0.116

Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor CVE-2026-34486

An error in the fix for CVE-2026-29146 allowed the EncryptInterceptor to be bypassed.

This was fixed with commit 776e12b3 .

This issue was reported to the Tomcat security team on 26 March 2026. The issue was made public on 9 April 2026.

Low: Incomplete escaping of JSON access logs CVE-2026-34483

Incomplete escaping when non-default values were used for the Connector attributes relaxedPathChars and/or relaxedQueryChars allowed the injection of arbitrary JSON into the JSON access log.

This was fixed with commit 97566842 .

This issue was reported to the Tomcat security team on 25 March 2026. The issue was made public on 9 April 2026.

Affects: 9.0.40 to 9.0.116

Moderate: The fix for CVE-2025-66614 was incomplete CVE-2026-32990

The validation of SNI name and host name did not take account of possible differences in case allowing the strict SNI checks to be bypassed.

This was fixed with commit 95f77782 .

This issue was reported to the Tomcat security team on 13 March 2026. The issue was made public on 9 April 2026.

Affects: 9.0.113 to 9.0.115

Important: EncryptInterceptor vulnerable to padding oracle attack by default CVE-2026-29146

The EncryptInterceptor used CBC by default which is vulnerable to a padding Oracle attack.

This was fixed with commit 0112ed22 .

This issue was reported to the Tomcat security team on 22 February 2026. The issue was made public on 9 April 2026.

Affects: 9.0.13 to 9.0.115

Moderate: OCSP checks sometimes soft-fail even when soft-fail is disabled CVE-2026-29145

CLIENT_CERT authentication did not fail OCSP checks as expected for some scenarios when soft fail was disabled.

This was fixed with commit d1406df5 .

This issue was reported to the Tomcat security team on 26 February 2026. The issue was made public on 9 April 2026.

Low: Configured TLS cipher preference order not preserved CVE-2026-29129

The additional of the ability to configure TLS 1.3 cipher suites did not preserve the order of the configured cipher suites and ciphers.

This was fixed with commit 6db23856 .

This was reported as a bug on 20 February 026 and the security implications identified by the Tomcat security team the same day. The issue was made public on 9 April 2026.

Affects: 9.0.114 to 9.0.115

Low: Occasionally open redirect CVE-2026-25854

When a Tomcat node in a cluster with the LoadBalancerDrainingValve was in the disabled (draining) state, a specially crafted URL could be used to trigger a redirect to a URI of the attackers choice.

This was fixed with commit c5a45ae6 .

This issue was reported to the Tomcat security team on 30 January 2026. The issue was made public on 9 April 2026.

Affects: 9.0.0.M23 to 9.0.115

Low: Request smuggling via invalid chunk extension CVE-2026-24880

Tomcat did not validate that contents of HTTP/1.1 chunk extensions. This enabled a request smuggling attack if a reverse proxy in front of Tomcat allowed CRLF sequences in an otherwise valid chunk extension.

This was fixed with commits 1b586d6a and 6d478dbe .

This issue was reported to the Tomcat security team on 19 January 2026. The issue was made public on 9 April 2026.

Affects: 9.0.0.M1 to 9.0.115

Moderate: Incomplete OCSP verification checks CVE-2026-24734

When using an OCSP responder, Tomcat's FFM integration with OpenSSL did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

Affects: 9.0.83 to 9.0.114

This issue was reported to the Tomcat security team on 2 November 2025. The issue was made public on 17 February 2026.

Low: Security constraint bypass CVE-2026-24733

Tomcat did not limit HTTP/0.9 requests to the GET method. If a security constraint was configured to allow HEAD requests to a URI but deny GET requests, the user could bypass that constraint on GET requests by sending a (specification invalid) HEAD request using HTTP/0.9.

This was fixed with commit 2e2fa23f .

This issue was identified by the Tomcat security team on 26 November 2025. The issue was made public on 17 February 2026.

Affects: 9.0.0.M1 to 9.0.112

Moderate: Client certificate verification bypass due to virtual host mapping CVE-2025-66614

Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

This was fixed with commits 152c1488 , a4aa7423 and 9276b5e7 .

This issue was reported to the Tomcat security team on 15 October 2025. The issue was made public on 17 February 2026.

Affects: 9.0.0.M1 to 9.0.112

Low: Delayed cleaning of multipart upload temporary files may lead to DoS CVE-2025-61795

If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to local storage were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

This was fixed with commit afa422bd .

This issue was reported to the Tomcat security team on 7 September 2025. The issue was made public on 27 October 2025.

Affects: 9.0.0.M1 to 9.0.109

Low: Console manipulation via escape sequences in log messages CVE-2025-55754

Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems.

This was fixed with commit a03cabf3 .

This issue was reported to the Tomcat security team on 5 August 2025. The issue was made public on 27 October 2025.

Affects: 9.0.40 to 9.0.108

Important: Directory traversal via Rewrite Valve with possible remote code execution if PUT is enabled CVE-2025-55752

The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/ . If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.

This was fixed with commit b5042622 .

This issue was reported to the Tomcat security team on 11 August 2025. The issue was made public on 27 October 2025.

Affects: 9.0.0.M11 to 9.0.108

Important: DoS in HTTP/2 due to client triggered stream reset CVE-2025-48989

Tomcat's HTTP/2 implementation was vulnerable to the made you reset attack. The denial of service typically manifested as an OutOfMemoryError .

This was fixed with commit f36b8a4e .

This issue was reported to the ASF security team on 29 May 2025. The issue was made public on 13 August 2025.

Affects: 9.0.0.M1 to 9.0.107

Important: APR/Native Connector crash leading to DoS CVE-2025-52434

A race condition on connection close could trigger a JVM crash when using the APR/Native connector leading to a DoS. This was particularly noticeable with client initiated closes of HTTP/2 connections.

This was fixed with commit 8a83c3c4 .

This issue was reported to the Tomcat security team on 6 June 2025. The issue was made public on 10 July 2025.

Affects: 9.0.0.M1 to 9.0.106

Low: DoS due to overflow in file upload limit CVE-2025-52520

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability could lead to a DoS via bypassing of size limits.

This was fixed with commit 927d66fb .

This issue was reported to the Tomcat security team on 7 June 2025. The issue was made public on 10 July 2025.

Affects: 9.0.0.M1 to 9.0.106

Important: DoS via excessive HTTP/2 streams CVE-2025-53506

An uncontrolled resource consumption vulnerability if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams could result in a DoS.

This was fixed with commit 43477293 .

This issue was reported to the Tomcat security team on 28 June 2025. The issue was made public on 10 July 2025.

Affects: 9.0.0.M1 to 9.0.106

Moderate: Session fixation possible via rewrite valve CVE-2025-55668

If the rewrite valve was enabled for a web application, an attacker was able to craft a URL that, if a victim clicked on it, would cause the victim's interaction with that resource to occur in the context of the attacker's session.

This was fixed with commit 9c3673ba .

This issue was reported to the Tomcat security team on 30 May 2025. The issue was made public on 13 August 2025.

Affects: 9.0.0.M1 to 9.0.105

Moderate: Security constraint bypass for PreResources and PostResources CVE-2025-49125

When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.

This was fixed with commit 9418e3ff .

This issue was reported to the Tomcat security team on 30 May 2025. The issue was made public on 16 June 2025.

Affects: 9.0.0.M1 to 9.0.105

Low: Side-loading via Tomcat installer for Windows CVE-2025-49124

During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This enabled a side-loading vulnerability.

This was fixed with commit 28726cc2 .

This issue was reported to the Tomcat security team on 30 May 2025. The issue was made public on 16 June 2025.

Affects: 9.0.23 to 9.0.105

Important: DoS in multipart upload CVE-2025-48988

Tomcat used the same limit for both request parameters and parts in a multipart request. Since uploaded parts also include headers which must be retained, processing multipart requests can result in significantly more memory usage. A specially crafted request that used a large number of parts could trigger excessive memory usage leading to a DoS. The maximum number of parts is now configurable (maxPartCount on the Connector) with a default of 10 parts.

This was fixed with commit ee8042ff .

This issue was reported to the ASF security team on 16 May 2025. The issue was made public on 16 June 2025.

Affects: 9.0.0.M1 to 9.0.105

Important: DoS in Commons FileUpload CVE-2025-48976

Apache Commons FileUpload provided a hard-coded limit of 10kB for the size of the headers associated with a multipart request. A specially crafted request that used a large number of parts with large headers could trigger excessive memory usage leading to a DoS. This limit is now configurable (maxPartHeaderSize on the Connector) with a default of 512 bytes.

This was fixed with commit 97790a35 .

This issue was reported to the ASF security team on 16 May 2025. The issue was made public on 16 June 2025.

Affects: 9.0.0.M1 to 9.0.105

Low: CGI security constraint bypass CVE-2025-46701

When running on a case insensitive file system with security constraints configured for the pathInfo component of a URL that mapped to the CGI servlet, it was possible to bypass those security constraints with a specially crafted URL.

This was fixed with commits 8df00018 and 8cb95ff0 .

This issue was reported to the Tomcat security team on 7 April 2025. The issue was made public on 29 May 2025.

Affects: 9.0.0.M1 to 9.0.104

Note: The issues below were fixed in Apache Tomcat 9.0.103 but the release vote for the 9.0.103 release candidate did not pass. Therefore, although users must download 9.0.104 to obtain a version that includes a fix for these issues, version 9.0.103 is not included in the list of affected versions.

Low: Rewrite rule bypass CVE-2025-31651

For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.

This was fixed with commits ee3ab548 and 175dc75f .

This issue was reported to the Tomcat security team on 28 February 2025. The issue was made public on 28 April 2025.

Affects: 9.0.0.M1 to 9.0.102

Important: Denial of Service via invalid HTTP priority header CVE-2025-31650

Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.

This was fixed with commits 40ae788c , b98e74f5 and b7674782 .

This issue was not disclosed responsibly. It was reported via the public bug tracker on 13 March 2025. The CVE was published on 28 April 2025.

Affects: 9.0.76 to 9.0.102

Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind CVE-2026-55957

When the JNDIRealm was configured to authenticate binds using GSSAPI, an attacker was able authenticate without providing the correct password.

This was fixed with commits c32bbd37 .

This issue was reported to the Tomcat security team on 14 June 2026. The issue was made public on 29 June 2026.

Affects: 9.0.0-M1 to 9.0.100

Important: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet - CVE-2025-24813

The original implementation of partial PUT used a temporary file based on the user provided file name and path with the path separator replaced by ".".

If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:

If all of the following were true, a malicious user was able to perform remote code execution:

This was fixed with commit eb61aade .

This issue was reported to the Tomcat security team on 13 January 2025. The issue was made public on 10 March 2025.

Affects: 9.0.0.M1 to 9.0.98

Important: Remote Code Execution via write enabled Default Servlet. Mitigation for CVE-2024-50379 was incomplete - CVE-2024-56337

The mitigation for CVE-2024-50379 was incomplete. In addition to upgrading to 9.0.98 or later, users running Tomcat on a case insensitive file system with the default servlet write enabled may need additional configuration depending on the version of Java being used: running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true ) running on Java 17: the system property sun.io.useCanonCaches , if set, must be set to false (it defaults to false ) running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed)

This issue was reported to the Tomcat security team on 17 December 2024. The issue was made public on 20 December 2024.

Affects: 9.0.0.M1 to 9.0.97

Low: DoS in examples web application CVE-2024-54677

Numerous examples in the examples web application did not place limits on uploaded data enabling an OutOfMemoryError to be triggered causing a denial of service.

This was fixed with commits 1d88dd3f , 721544ea , 84065e26 , 3315a902 , c2f7ce21 , 75ff7e86 , 4d5cc653 , 84c4af76 and 9ffd23fc .

This issue was reported to the Tomcat security team on 23 November 2024. The issue was made public on 17 December 2024.

Affects: 9.0.0.M1 to 9.0.97

Important: Remote Code Execution via write enabled Default Servlet CVE-2024-50379

If the default servlet is write enabled ( readonly initialisation parameter set to the non-default value of false ) for a case insensitive file system, concurrent read and upload under load of the same file can bypass Tomcat's case sensitivity checks and cause an uploaded file to be treated as a JSP leading to remote code execution.

This was fixed with commits 43b507eb and 631500b0 .

This issue was reported to the Tomcat security team on 18 October 2024. The issue was made public on 17 December 2024.

Affects: 9.0.0.M1 to 9.0.97

Important: XSS in generated JSPs CVE-2024-52318

The fix for improvement 69333 caused pooled JSP tags not to be released after use which in turn could cause output of some tags not to escaped as expected. This unescaped output could lead to XSS.

This was fixed with commit 9813c5dd .

This issue was not disclosed responsibly. It was reported via the public bug tracker on 6 November 2024. The CVE was published on 18 November 2024.

Important: Request and/or response mix-up CVE-2024-52317

Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users.

This was fixed with commit 47307ee2 .

This issue was identified by the Tomcat Security Team on 1 October 2024. The issue was made public on 18 November 2024.

Affects: 9.0.92 to 9.0.95

Low: Authentication Bypass CVE-2024-52316

If Tomcat was configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not have failed, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.

This was fixed with commit 7532f9dc .

This issue was identified by the Tomcat Security Team on 19 September 2024. The issue was made public on 18 November 2024.

Affects: 9.0.0-M1 to 9.0.95

Important: Denial of Service CVE-2024-34750

When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.

This was fixed with commit 9fec9a82 .

This issue was reported to the Tomcat Security Team on 4 May 2024. The issue was made public on 3 July 2024.

Affects: 9.0.0-M1 to 9.0.89

Important: Denial of Service CVE-2024-38286

Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

This was fixed with commit 76c5cce6 .

This issue was reported to the Tomcat Security Team on 4 June 2024. The issue was made public on 23 September 2024.

Affects: 9.0.13 to 9.0.89

Important: Denial of Service CVE-2024-23672

It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption.

This was fixed with commit 52d6650e .

This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made public on 13 March 2024.

Affects: 9.0.0-M1 to 9.0.85

Important: Denial of Service CVE-2024-24549

When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.

This was fixed with commit 8e03be9f .

This issue was reported to the Tomcat Security Team on 24 January 2024. The issue was made public on 13 March 2024.

Affects: 9.0.0-M1 to 9.0.85

Important: Request smuggling CVE-2023-46589

Tomcat did not correctly parse HTTP trailer headers. A specially crafted trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

This was fixed with commit 7a2d8818 .

This issue was reported to the Tomcat Security Team on 20 October 2023. The issue was made public on 28 November 2023.

Affects: 9.0.0-M1 to 9.0.82

Important: Request smuggling CVE-2023-45648

Tomcat did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

This was fixed with commit 59583245 .

This issue was reported to the Tomcat Security Team on 12 September 2023. The issue was made public on 10 October 2023.

Affects: 9.0.0-M1 to 9.0.80

Important: Denial of Service CVE-2023-44487

Tomcat's HTTP/2 implementation was vulnerable to the rapid reset attack. The denial of service typically manifested as an OutOfMemoryError .

This was fixed with commit 6d1a9fd6 .

This issue was reported to the Tomcat Security Team on 14 September 2023. The issue was made public on 10 October 2023.

Affects: 9.0.0-M1 to 9.0.80

Important: Information Disclosure CVE-2023-42795

When recycling various internal objects, including the request and the response, prior to re-use by the request/response, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the .

This was fixed with commit 44d05d75 .

This issue was identified by the Tomcat Security Team on 13 September 2023. The issue was made public on 10 October 2023.

Affects: 9.0.0-M1 to 9.0.80

Low: Denial of Service CVE-2023-42794

Tomcat's internal fork of a Commons FileUpload included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full.

This was fixed with commit 43b882b8 .

This issue was reported to the Tomcat Security Team on 1 September 2023. The issue was made public on 10 October 2023.

Affects: 9.0.70 to 9.0.80

Moderate: Open redirect CVE-2023-41080

If the ROOT (default) web application is configured to use FORM authentication then it is possible that a specially crafted URL could be used to trigger a redirect to an URL of the attackers choice.

This was fixed with commit 77c0ce2d .

This issue was reported to the Tomcat Security Team on 17 August 2023. The issue was made public on 22 August 2023.

Affects: 9.0.0-M1 to 9.0.79

Important: Information disclosure CVE-2023-34981

The fix for bug 66512 introduced a regression that was fixed as bug 66591 . The regression meant that, if a response did not have any HTTP headers set, no AJP SEND_HEADERS message would be sent which in turn meant that at least one AJP based proxy (mod_proxy_ajp) would use the response headers from the request for the current request leading to an information leak.

This was fixed with commit 2f0ca237 .

This issue was reported to the Tomcat Security Team on 24 May 2023. The issue was made public on 21 June 2023.

Moderate: Apache Tomcat denial of service CVE-2023-28709

The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.

This was fixed with commit fbd81421 .

This issue was reported to the Tomcat Security Team on 13 March 2023. The issue was made public on 22 May 2023.

Affects: 9.0.71 to 9.0.73

Important: Apache Tomcat information disclosure CVE-2023-28708

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https , session cookies created by Tomcat did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

This was fixed with commit 3b512307 .

66471 was reported publicly on 8 February 2023. The security implications were identified by the Tomcat Security team on 9 February 2023. The issue was made public on 22 March 2023.

Affects: 9.0.0-M1 to 9.0.71

Important: Apache Tomcat denial of service CVE-2023-24998

Apache Tomcat uses a packaged renamed copy of Apache Commons FileUpload to provide the file upload functionality defined in the Jakarta Servlet specification. Apache Tomcat was, therefore, also vulnerable to the Apache Commons FileUpload vulnerability CVE-2023-24998 as there was no limit to the number of request parts processed. This resulted in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

This was fixed with commit cf77cc54 .

This issue was reported to the Apache Tomcat Security team on 11 December 2022. The issue was made public on 20 February 2023.

Affects: 9.0.0-M1 to 9.0.70

Low: Apache Tomcat JsonErrorReportValve injection CVE-2022-45143

The JsonErrorReportValve did not escape the type , message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

This was fixed with commit b336f4e5 .

This issue was identified by the Apache Tomcat Security team on 2 September 2022. The issue was made public on 3 January 2023.

Affects: 9.0.40 to 9.0.68

Low: Apache Tomcat request smuggling CVE-2022-42252

If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (not the default), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

This was fixed with commit 4c7f4fd0 .

This issue was reported to the Apache Tomcat Security team on 29 September 2022. The issue was made public on 31 October 2022.

Affects: 9.0.0-M1 to 9.0.67

Low: Apache Tomcat XSS in examples web application CVE-2022-34305

The Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

This was fixed with commit 8b60af90 .

This issue was reported to the Apache Tomcat Security team on 22 June 2022. The issue was made public on 23 June 2022.

Affects: 9.0.30 to 9.0.64

Low: Apache Tomcat EncryptInterceptor DoS CVE-2022-29885

The documentation for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

This was fixed with commit eaafd282 .

This issue was reported to the Apache Tomcat Security team by 4ra1n on 17 April 2022. The issue was made public on 10 May 2022.

Affects: 9.0.13 to 9.0.62

Note: The issue below was fixed in Apache Tomcat 9.0.61 but the release vote for the 9.0.61 release candidate did not pass. Therefore, although users must download 9.0.62 to obtain a version that includes a fix for these issues, version 9.0.61 is not included in the list of affected versions.

High: Information Disclosure CVE-2021-43980

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug that could cause client connections to an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

This was fixed with commit 170e0f79 .

This issue was reported to the Apache Tomcat Security team by Adam Thomas, Richard Hernandez and Ryan Schmitt on 11 November 2021. The issue was made public on 28 September 2022.

Affects: 9.0.0-M1 to 9.0.60

Note: The issue below was fixed in Apache Tomcat 9.0.57 but the release vote for the 9.0.57 release candidate did not pass. Therefore, although users must download 9.0.58 to obtain a version that includes a fix for these issues, version 9.0.57 is not included in the list of affected versions.

Low: Local Privilege Escalation CVE-2022-23181

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

This was fixed with commit 1385c624 .

This issue was reported to the Apache Tomcat Security team by Trung Pham of Viettel Cyber Security on 10 December 2021. The issue was made public on 26 January 2022.

Affects: 9.0.35 to 9.0.56

Important: Denial of Service CVE-2021-42340

The fix for bug 63362 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the WebSocket connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

This was fixed with commit 80f1438e .

The memory leak was reported publicly via the users mailing list on 23 September 2021. The security implications were identified by the Tomcat Security team the same day. The issue was made public on 14 October 2021.

Affects: 9.0.40 to 9.0.53

Note: The issue below was fixed in Apache Tomcat 9.0.47 but the release vote for the 9.0.47 release candidate did not pass. Therefore, although users must download 9.0.48 to obtain a version that includes a fix for this issue, version 9.0.47 is not included in the list of affected versions.

Important: Request Smuggling CVE-2021-33037

Apache Tomcat did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility of request smuggling when used with a reverse proxy. Specifically: Tomcat incorrectly ignored the transfer-encoding header if the client declared it would only accept an HTTP/1.0 response; Tomcat honoured the identify encoding; and Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

This was fixed with commits 45d70a86 , 05f9e8b0 and a2c3dc4c .

This issue was reported to the Apache Tomcat Security team by Bahruz Jabiyev, Steven Sprecher and Kaan Onarlioglu of NEU seclab on 7 May 2021. The issue was made public on 12 July 2021.

Affects: 9.0.0.M1 to 9.0.46

Low: Authentication weakness CVE-2021-30640

Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data (eg user names) as well as configuration data provided by an administrator. In limited circumstances it was possible for users to authenticate using variations of their user name and/or to bypass some of the protection provided by the LockOut Realm.

This was fixed with commits c4df8d44 , 749f3cc1 , c6b6e101 , 91ecdc61 , e5006748 , b5585a9e , 32993201 and 3ce84512 .

This issue was reported publicly as 65224 .

Affects: 9.0.0.M1 to 9.0.45

Important: Denial of Service CVE-2021-30639

An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS.

This was fixed with commit 8ece47c4 .

This issue was reported publicly as 65203 .

Important: Denial of Service CVE-2021-41079

When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

This was fixed with commit d4b340fa .

This issue was first reported to the Apache Tomcat Security Team by Thomas Wozenilek on 26 February 2021 but could not be confirmed. A speculative fix was applied on 3 March 2021. On 14 September 2021 David Frankson of Infinite Campus independently reported the issue and included a test case. This allowed both the issue and the speculative fix to be verified. The issue was made public on 15 September 2021.

Affects: 9.0.0-M1 to 9.0.43

Important: Information Disclosure CVE-2024-21733

Incomplete POST requests triggered an error response that could contain data from a request from another user.

This was fixed with commit 86ccc439 .

This issue was reported to the Apache Tomcat Security Team by xer0dayz from Sn1perSecurity LLC on 20 December 2023. The issue was made public on 19 January 2024.

Affects: 9.0.0-M11 to 9.0.43

Note: The issues below were fixed in Apache Tomcat 9.0.42 but the release vote for the 9.0.42 release candidate did not pass. Therefore, although users must download 9.0.43 to obtain a version that includes a fix for these issues, version 9.0.42 is not included in the list of affected versions.

Low: Fix for CVE-2020-9484 was incomplete CVE-2021-25329

The fix for CVE-2020-9484 was incomplete. When using a highly unlikely configuration edge case, the Tomcat instance was still vulnerable to CVE-2020-9484 . Note that both the previously published prerequisites for CVE-2020-9484 and the previously published non-upgrade mitigations for CVE-2020-9484 also apply to this issue.

This was fixed with commit 4785433a .

This issue was reported to the Apache Tomcat Security team by Trung Pham of Viettel Cyber Security on 12 January 2021. The issue was made public on 1 March 2021.

Affects: 9.0.0.M1 to 9.0.41

Important: Request mix-up with h2c CVE-2021-25122

When responding to new h2c connection requests, Apache Tomcat could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

This was fixed with commit d47c20a7 .

This issue was identified by the Apache Tomcat Security team on 11 January 2021. The issue was made public on 1 March 2021.

Affects: 9.0.0.M1 to 9.0.41

Important: Information disclosure CVE-2021-24122

When serving resources from a network location using the NTFS file system it was possible to bypass security constraints and/or view the source code for JSPs in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API ( FindFirstFileW ) in some circumstances.

This was fixed with commit 935fc558 .

This issue was reported the Apache Tomcat Security team by Ilja Brander on 26 October 2020. The issue was made public on 14 January 2021.

Affects: 9.0.0.M1 to 9.0.39

Moderate: HTTP/2 request header mix-up CVE-2020-17527

While investigating issue 64830 it was discovered that Apache Tomcat could re-use an HTTP request header value from the stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

This was fixed with commit d56293f8 .

This issue was identified by the Apache Tomcat Security team on 10 November 2020. The issue was made public on 3 December 2020.

Affects: 9.0.0-M1 to 9.0.39

Moderate: HTTP/2 request mix-up CVE-2020-13943

If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

This was fixed with commit 55911430 .

This issue was identified by the Apache Tomcat Security team on 23 July 2020. The issue was made public on 12 October 2020.

Affects: 9.0.0.M1 to 9.0.37

Important: WebSocket DoS CVE-2020-13935

The payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

This was fixed with commit 40fa74c7 .

This issue was reported publicly via the Apache Bugzilla instance on 28 June 2020 and included references to high CPU but no specific reference to denial of service. The associated DoS risks were identified by the Apache Tomcat Security Team the same day. The issue was made public on 14 July 2020.

Affects: 9.0.0.M1 to 9.0.36

Moderate: HTTP/2 DoS CVE-2020-13934

An h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

This was fixed with commit 172977f0 .

This issue was reported publicly via the Apache Tomcat Users mailing list on 22 June 2020 without reference to the potential for DoS. After further discussion to identify the steps necessary to reproduce the issue, the root cause of the issue and the associated DoS risks were identified by the Apache Tomcat Security Team on 26 June 2020. The issue was made public on 14 July 2020.

Affects: 9.0.0.M5 to 9.0.36

Important: HTTP/2 DoS CVE-2020-11996

A specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

This was fixed with commit 9a023168 .

This issue was reported publicly via the Apache Tomcat Users mailing list on 21 May 2020 without reference to the potential for DoS. The DoS risks were identified by the Apache Tomcat Security Team the same day. The issue was made public on 25 June 2020.

Affects: 9.0.0.M1 to 9.0.35

Important: Remote Code Execution via session persistence CVE-2020-9484

then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control.

Note: All of conditions above must be true for the attack to succeed.

As an alternative to upgrading to 9.0.35 or later, users may configure the PersistenceManager with an appropriate value for sessionAttributeValueClassNameFilter to ensure that only application provided attributes are serialized and deserialized.

This was fixed with commit 3aa8f28d .

This issue was reported to the Apache Tomcat Security Team by by jarvis threedr3am of pdd security research on 12 April 2020. The issue was made public on 20 May 2020.

Affects: 9.0.0.M1 to 9.0.34

Important: AJP Request Injection and potential Remote Code Execution CVE-2020-1938

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. Prior to Tomcat 9.0.31, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required.

Prior to this vulnerability report, the known risks of an attacker being able to access the AJP port directly were:

This vulnerability report identified a mechanism that allowed the following:

Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible.

It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31 or later. Users should note that a number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31 or later will need to make small changes to their configurations as a result.

This was fixed with commits 0e8a50f0 , 9ac90532 , 64fa5b99 , 7a1406a3 and 49ad3f95 .

This issue was reported to ...