Product by Apache Software Foundation
Apache Tomcat
152 known vulnerabilities in Apache Tomcat (Apache Software Foundation), 6 of them actively exploited (CISA KEV).
Key figures
152
Vulnerabilities
6
Actively exploited (KEV)
1
Used by ransomware
34
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-24813 | Apache Tomcat Path Equivalence Vulnerability In CISA KEValso in 13 other products | 9.8 | |
| Critical | CVE-2017-12615 | Apache Tomcat on Windows Remote Code Execution Vulnerability In CISA KEVRansomwarealso in 22 other products | 8.1 | |
| Critical | CVE-2026-34486 | Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor In CISA KEValso in 8 other products | 7.5 | |
| Critical | CVE-2020-1938 | Apache Tomcat Improper Privilege Management Vulnerability In CISA KEValso in 20 other products | 9.8 | |
| Critical | CVE-2016-8735 | Apache Tomcat Remote Code Execution Vulnerability In CISA KEValso in 20 other products | 9.8 | |
| Critical | CVE-2017-12617 | Apache Tomcat Remote Code Execution Vulnerability In CISA KEValso in 55 other products | 8.1 | |
| Critical | CVE-2024-50379 | Apache Tomcat: RCE due to TOCTOU issue in JSP compilation | 9.8 | |
| Critical | CVE-2025-55754 | Apache Tomcat: console manipulation via escape sequences in log messages | 9.6 | |
| Critical | CVE-2024-56337 | Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete | 9.8 | |
| High | CVE-2025-55752 | Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled | 7.5 | |
| High | CVE-2026-29146 | Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default | 7.5 | |
| Critical | CVE-2024-52316 | Apache Tomcat: Authentication bypass when using Jakarta Authentication API | 9.8 | |
| Critical | CVE-2018-8014 | Apache Tomcat: security vulnerability | 9.8 | |
| High | CVE-2025-31650 | Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame | 7.5 | |
| High | CVE-2025-48988 | Apache Tomcat: FileUpload large number of parts with headers DoS | 7.5 | |
| Critical | CVE-2025-31651 | Apache Tomcat: Bypass of rules in Rewrite Valve | 9.8 | |
| Critical | CVE-2017-5651 | Apache Tomcat: security vulnerability | 9.8 | |
| Critical | CVE-2017-5648 | Apache Tomcat: security vulnerability | 9.1 | |
| High | CVE-2025-46701 | Apache Tomcat: Security constraint bypass for CGI scripts | 7.3 | |
| Critical | CVE-2016-5018 | Apache Tomcat: security vulnerability | 9.1 | |
| High | CVE-2024-24549 | Apache Tomcat: HTTP/2 header handling DoS | 7.5 | |
| High | CVE-2023-28709 | Apache Tomcat: Fix for CVE-2023-24998 is incomplete | 7.5 | |
| High | CVE-2023-24998 | Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts | 7.5 | |
| High | CVE-2022-29885 | EncryptInterceptor does not provide complete protection on insecure networks | 7.5 | |
| High | CVE-2020-13935 | Apache Tomcat: Infinite Loop | 7.5 |
News
- CISA Adds Five CVEs to Known Exploited Vulnerabilities Catalogsans-newsbites-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 27sans-atrisk-mail,
- June Patch Tuesday marks a ‘new normal’ with over 200 CVEs, 32 rated ‘critical’csoonline,