Product by Debian

    Tomcat10

    45 known vulnerabilities in Tomcat10 (Debian), 2 of them actively exploited (CISA KEV).

    Key figures

    45

    Vulnerabilities

    2

    Actively exploited (KEV)

    0

    Used by ransomware

    11

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Tomcat10 (Debian)
    CriticalCVE-2025-24813

    Apache Tomcat Path Equivalence Vulnerability

    In CISA KEValso in 12 other products

    		9.8
    CriticalCVE-2023-44487

    HTTP/2 Rapid Reset Attack Vulnerability

    In CISA KEValso in 158 other products

    		7.5
    CriticalCVE-2024-50379

    Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

    also in 4 other products

    		9.8
    CriticalCVE-2025-55754

    Apache Tomcat: console manipulation via escape sequences in log messages

    also in 4 other products

    		9.6
    CriticalCVE-2024-56337

    Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

    also in 5 other products

    		9.8
    HighCVE-2025-55752

    Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

    also in 4 other products

    		7.5
    HighCVE-2026-29146

    Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

    also in 4 other products

    		7.5
    CriticalCVE-2024-52316

    Apache Tomcat: Authentication bypass when using Jakarta Authentication API

    also in 4 other products

    		9.8
    HighCVE-2025-48976

    Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

    also in 7 other products

    		7.5
    HighCVE-2025-48988

    Apache Tomcat: FileUpload large number of parts with headers DoS

    also in 5 other products

    		7.5
    HighCVE-2025-46701

    Apache Tomcat: Security constraint bypass for CGI scripts

    also in 10 other products

    		7.3
    HighCVE-2024-24549

    Apache Tomcat: HTTP/2 header handling DoS

    also in 5 other products

    		7.5
    HighCVE-2023-28709

    Apache Tomcat: Fix for CVE-2023-24998 is incomplete

    also in 4 other products

    		7.5
    CriticalCVE-2026-41293

    Apache Tomcat: HTTP/2 request headers not validated

    also in 5 other products

    		9.8
    HighCVE-2025-48989

    Apache Tomcat: h2 DoS - Made You Reset

    also in 9 other products

    		7.5
    HighCVE-2024-34750

    Apache Tomcat: HTTP/2 excess header handling DoS

    also in 5 other products

    		7.5
    HighCVE-2025-49125

    Apache Tomcat: Security constraint bypass for pre/post-resources

    also in 4 other products

    		7.5
    CriticalCVE-2026-43512

    Apache Tomcat: Digest authenticator will authenticate any unknown user

    also in 5 other products

    		9.8
    MediumCVE-2023-41080

    Apache Tomcat: Open redirect with FORM authentication

    also in 5 other products

    		6.1
    HighCVE-2025-52520

    Apache Tomcat: DoS via integer overflow in multipart file upload

    also in 4 other products

    		7.5
    HighCVE-2025-53506

    Apache Tomcat: DoS via excessive h2 streams at connection start

    also in 4 other products

    		7.5
    CriticalCVE-2026-43515

    Apache Tomcat: Security constraints not correctly applied

    also in 5 other products

    		9.1
    HighCVE-2023-46589

    Apache Tomcat: HTTP request smuggling via malformed trailer headers

    also in 3 other products

    		7.5
    MediumCVE-2023-45648

    Apache Tomcat: Trailer header parsing too lenient

    also in 4 other products

    		5.3
    HighCVE-2024-38286

    Apache Tomcat: Denial of Service

    also in 4 other products

    		8.6

    All vulnerabilities in search

    News

    All products by Debian