This Week
Get Alerts ›
cvehawk_ Get Alerts
Software · Apache Tomcat

Apache Tomcat Vulnerabilities

The latest security flaws in Apache Tomcat, which ones attackers are using, and whether your Tomcat version is affected.

New flaws, 30 days
8
Critical, 8 weeks
5
On CISA's exploited list
6
Latest exploited
4 Aug 2026

Run version.sh in Tomcat's bin folder, or check the server's default error page.

Apache Tomcat Security in Short

Tomcat runs Java web apps. Several release lines are supported at once, and each gets fixes in its own releases. Tomcat flaws are often exploited within days of release, especially ones in partial PUT requests, session handling and the manager app.

How to Keep Tomcat Patched

  • Update to the latest release in your line. Tomcat is often installed by hand, so it won't update with the rest of the system.
  • Remove the example apps and the manager app if you don't use them, or limit who can reach them.
  • Check apps that bundle Tomcat (Spring Boot and many vendor products): they need their own update.

The Past Eight Weeks

Any Score 7+ 8+ 9+

8 flaws scored 8+, newest first.

20 Oct 2026 asynchronous servlets · Race condition Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchron… CVE-2026-101356 9.1

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.

Patch now · NVD Record

20 Oct 2026 Apache Tomcat meant · Memory corruption Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the re… CVE-2026-103119 9.1

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26. Users are recommended to upgrade to version 11.0.27, which fixes the issue.

Patch now · NVD Record

20 Oct 2026 Authentication bypass A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured w… CVE-2026-101296 8.1

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

Patch this week · NVD Record

20 Oct 2026 Race condition Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain so… CVE-2026-80353 8.1

Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.

Patch this week · NVD Record

23 Sep 2026 Authentication bypass Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for a… CVE-2026-76183 9.8

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Patch now · NVD Record

23 Sep 2026 Authentication bypass CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerabil… CVE-2026-86248 9.8

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Patch now · NVD Record

23 Sep 2026 fix for CVE-2026-41293 · Input validation flaw Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache To… CVE-2026-86350 9.1

Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Patch now · NVD Record

23 Sep 2026 Race condition Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in … CVE-2026-77762 8.1

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.

Patch this week · NVD Record

Being Exploited

Apache Tomcat flaws CISA has added to its list of flaws attackers are using in the past six months, newest first. See all 6 on the KEV page.

Patch now

Apache Tomcat

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass…

Score 7.5 / 10 · Being exploited

CVE-2026-34486

Rather not patch it yourself?

Bobble Solutions patches, backs up and watches Linux servers and WordPress sites.

Talk to Bobble Solutions