Product by Debian
Tomcat11
30 known vulnerabilities in Tomcat11 (Debian), 0 of them actively exploited (CISA KEV).
Key figures
30
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-55754 | Apache Tomcat: console manipulation via escape sequences in log messages | 9.6 | |
| High | CVE-2025-55752 | Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled | 7.5 | |
| High | CVE-2026-29146 | Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default | 7.5 | |
| High | CVE-2025-48976 | Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers | 7.5 | |
| High | CVE-2025-48988 | Apache Tomcat: FileUpload large number of parts with headers DoS | 7.5 | |
| High | CVE-2025-46701 | Apache Tomcat: Security constraint bypass for CGI scripts | 7.3 | |
| Critical | CVE-2026-41293 | Apache Tomcat: HTTP/2 request headers not validated | 9.8 | |
| High | CVE-2025-48989 | Apache Tomcat: h2 DoS - Made You Reset | 7.5 | |
| High | CVE-2025-49125 | Apache Tomcat: Security constraint bypass for pre/post-resources | 7.5 | |
| Critical | CVE-2026-43512 | Apache Tomcat: Digest authenticator will authenticate any unknown user | 9.8 | |
| High | CVE-2025-52520 | Apache Tomcat: DoS via integer overflow in multipart file upload | 7.5 | |
| High | CVE-2025-53506 | Apache Tomcat: DoS via excessive h2 streams at connection start | 7.5 | |
| Critical | CVE-2026-43515 | Apache Tomcat: Security constraints not correctly applied | 9.1 | |
| Critical | CVE-2026-29145 | Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled | 9.1 | |
| High | CVE-2026-41284 | Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling | 7.5 | |
| Medium | CVE-2025-55668 | Apache Tomcat: session fixation via rewrite valve | 6.5 | |
| Medium | CVE-2025-61795 | Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS | 5.3 | |
| High | CVE-2026-24880 | Apache Tomcat: Request smuggling via invalid chunk extension | 7.5 | |
| High | CVE-2026-42498 | Apache Tomcat: WebSocket authentication header exposure | 7.3 | |
| High | CVE-2026-24734 | Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass | 7.5 | |
| High | CVE-2026-43513 | Apache Tomcat: LockOutRealm treats user names as case-sensitive | 7.5 | |
| High | CVE-2026-34483 | Apache Tomcat: Incomplete escaping of JSON access logs | 7.5 | |
| High | CVE-2026-34487 | Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token | 7.5 | |
| Critical | CVE-2025-66614 | Apache Tomcat: Client certificate verification bypass due to virtual host mapping | 9.1 | |
| Medium | CVE-2026-25854 | Apache Tomcat: Occasionally open redirect | 6.1 |