Product by Debian

    Tomcat9

    58 known vulnerabilities in Tomcat9 (Debian), 2 of them actively exploited (CISA KEV).

    Key figures

    58

    Vulnerabilities

    2

    Actively exploited (KEV)

    0

    Used by ransomware

    11

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Tomcat9 (Debian)
    CriticalCVE-2025-24813

    Apache Tomcat Path Equivalence Vulnerability

    In CISA KEValso in 12 other products

    		9.8
    CriticalCVE-2023-44487

    HTTP/2 Rapid Reset Attack Vulnerability

    In CISA KEValso in 158 other products

    		7.5
    CriticalCVE-2024-50379

    Apache Tomcat: RCE due to TOCTOU issue in JSP compilation

    also in 4 other products

    		9.8
    CriticalCVE-2025-55754

    Apache Tomcat: console manipulation via escape sequences in log messages

    also in 4 other products

    		9.6
    CriticalCVE-2024-56337

    Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete

    also in 5 other products

    		9.8
    HighCVE-2025-55752

    Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

    also in 4 other products

    		7.5
    HighCVE-2026-29146

    Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

    also in 4 other products

    		7.5
    CriticalCVE-2024-52316

    Apache Tomcat: Authentication bypass when using Jakarta Authentication API

    also in 4 other products

    		9.8
    HighCVE-2025-31650

    Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

    also in 9 other products

    		7.5
    HighCVE-2025-48976

    Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

    also in 7 other products

    		7.5
    HighCVE-2025-48988

    Apache Tomcat: FileUpload large number of parts with headers DoS

    also in 5 other products

    		7.5
    CriticalCVE-2025-31651

    Apache Tomcat: Bypass of rules in Rewrite Valve

    also in 9 other products

    		9.8
    HighCVE-2025-46701

    Apache Tomcat: Security constraint bypass for CGI scripts

    also in 10 other products

    		7.3
    HighCVE-2024-24549

    Apache Tomcat: HTTP/2 header handling DoS

    also in 5 other products

    		7.5
    HighCVE-2023-24998

    Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

    also in 6 other products

    		7.5
    HighCVE-2022-29885

    EncryptInterceptor does not provide complete protection on insecure networks

    also in 4 other products

    		7.5
    HighCVE-2020-17527

    Apache Tomcat: Request header mix-up between HTTP/2 streams

    also in 12 other products

    		7.5
    CriticalCVE-2026-41293

    Apache Tomcat: HTTP/2 request headers not validated

    also in 5 other products

    		9.8
    HighCVE-2021-25122

    Apache Tomcat h2c request mix-up

    also in 13 other products

    		7.5
    HighCVE-2021-42340

    DoS via memory leak with WebSocket connections

    also in 18 other products

    		7.5
    HighCVE-2024-34750

    Apache Tomcat: HTTP/2 excess header handling DoS

    also in 5 other products

    		7.5
    HighCVE-2025-49125

    Apache Tomcat: Security constraint bypass for pre/post-resources

    also in 4 other products

    		7.5
    HighCVE-2021-41079

    Apache Tomcat DoS with unexpected TLS packet

    also in 4 other products

    		7.5
    HighCVE-2021-25329

    Incomplete fix for CVE-2020-9484

    also in 13 other products

    		7.0
    CriticalCVE-2026-43512

    Apache Tomcat: Digest authenticator will authenticate any unknown user

    also in 5 other products

    		9.8

    All vulnerabilities in search

    News

    All products by Debian