Maven (Java)

org.apache.tomcat.embed:tomcat-embed-core Known Vulnerabilities &...

org.apache.tomcat.embed:tomcat-embed-core has 29 known security vulnerabilities in Maven (Java). Upgrade to version 11.0.25 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.

29 Vulnerabilities

Actively Exploited

CISA has confirmed this package has vulnerabilities under active exploitation. Prioritize updating immediately.

Recommended safe version: 11.0.25

Upgrading to 11.0.25 or later resolves all 29 known vulnerabilities in org.apache.tomcat.embed:tomcat-embed-core. Update your pom.xml or build.gradle to version 11.0.25.

Is org.apache.tomcat.embed:tomcat-embed-core in your project?

Check if you're affected and upgrade to 11.0.25 to stay secure.

Start Free Scan Get Alerted When New CVEs Drop

Total

Critical

High

Medium

Low

Active Exploitation Warning

One or more vulnerabilities in this package are known to be actively exploited in the wild. Immediate action is recommended.

Security Summary

105 affected version ranges have been identified across these 29 advisories.
100% of known issues have a published fixed version.
Remediation: Update the org.apache.tomcat.embed:tomcat-embed-core version in your pom.xml or build.gradle

Vulnerabilities

29 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details. First disclosed Oct 17, 2018, most recently Aug 26, 2026 (2869 days apart).

CVE / GHSA	Severity	CVSS	EPSS	Summary	Affected	Fixed In
CVE-2025-24813 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT	CRITICAL	9.8	—	Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+251 more)	11.0.3, 10.1.35, 9.0.99
CVE-2023-44487 HTTP/2 Stream Cancellation Attack	MEDIUM	5.3	—	HTTP/2 Stream Cancellation Attack	11.0.0-M1, 11.0.0-M10, 11.0.0-M11, 11.0.0-M3 (+195 more)	11.0.0-M12, 10.1.14, 9.0.81 (+1 more)
CVE-2026-65905 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability	CRITICAL	9.8	—	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+365 more)	11.0.25, 10.1.58, 9.0.121
CVE-2026-43512 Apache Tomcat - Digest authenticator will authenticate any unknown user	CRITICAL	9.8	—	Apache Tomcat - Digest authenticator will authenticate any unknown user	7.0.0, 7.0.100, 7.0.103, 7.0.104 (+421 more)	9.0.118, 10.1.55, 11.0.22
CVE-2026-41293 Apache Tomcat - HTTP/2 request headers not validated	CRITICAL	9.8	—	Apache Tomcat - HTTP/2 request headers not validated	8.5.0, 8.5.100, 8.5.11, 8.5.12 (+300 more)	9.0.118, 10.1.55, 11.0.22
CVE-2026-65182 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability	CRITICAL	9.1	—	Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+385 more)	11.0.25, 10.1.58, 9.0.121
CVE-2026-68525 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability	CRITICAL	9.1	—	Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+385 more)	11.0.25, 10.1.58, 9.0.121
CVE-2026-43515 Apache Tomcat - Security constraints not correctly applied	CRITICAL	9.1	—	Apache Tomcat - Security constraints not correctly applied	7.0.0, 7.0.100, 7.0.103, 7.0.104 (+421 more)	9.0.118, 10.1.55, 11.0.22
CVE-2017-5648 Exposure of Resource to Wrong Sphere in Apache Tomcat	CRITICAL	9.1	—	Exposure of Resource to Wrong Sphere in Apache Tomcat	9.0.0.M1, 9.0.0.M10, 9.0.0.M11, 9.0.0.M13 (+97 more)	9.0.0.M18, 8.5.13, 8.0.42 (+1 more)
CVE-2017-5651 Expected Behavior Violation in Apache Tomcat	CRITICAL	9.8	—	Expected Behavior Violation in Apache Tomcat	9.0.0.M1, 9.0.0.M10, 9.0.0.M11, 9.0.0.M13 (+18 more)	9.0.0.M19, 8.5.13
CVE-2018-8014 The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins	CRITICAL	9.8	—	The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins	9.0.0.M1, 9.0.0.M10, 9.0.0.M11, 9.0.0.M13 (+122 more)	9.0.9, 8.5.32, 8.0.53 (+1 more)
CVE-2024-50379 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability	HIGH	9.8	—	Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+248 more)	11.0.2, 10.1.34, 9.0.98
CVE-2024-38286 Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability	HIGH	8.6	—	Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability	11.0.0-M1, 11.0.0-M10, 11.0.0-M11, 11.0.0-M12 (+184 more)	11.0.0-M21, 10.1.25, 9.0.90
CVE-2024-56337 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability	HIGH	9.3	—	Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+163 more)	11.0.2, 10.1.34, 9.0.98
CVE-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive	HIGH	7.5	—	Apache Tomcat: LockOutRealm treats user names as case-sensitive	7.0.0, 7.0.100, 7.0.103, 7.0.104 (+421 more)	9.0.118, 10.1.55, 11.0.22
CVE-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling	HIGH	7.5	—	Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling	7.0.0, 7.0.100, 7.0.103, 7.0.104 (+421 more)	9.0.118, 10.1.55, 11.0.22
CVE-2025-55752 Apache Tomcat Vulnerable to Relative Path Traversal	HIGH	7.5	—	Apache Tomcat Vulnerable to Relative Path Traversal	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+270 more)	11.0.11, 10.1.45, 9.0.109
CVE-2026-34483 Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve	HIGH	7.5	—	Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve	9.0.100, 9.0.102, 9.0.104, 9.0.105 (+161 more)	9.0.116, 10.1.54, 11.0.21
CVE-2026-34487 Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File	HIGH	7.5	—	Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File	9.0.100, 9.0.102, 9.0.104, 9.0.105 (+183 more)	9.0.117, 10.1.54, 11.0.21
CVE-2026-29129 Apache Tomcat: Configured cipher preference order not preserved	HIGH	7.5	—	Apache Tomcat: Configured cipher preference order not preserved	9.0.115, 10.1.52, 11.0.18	9.0.116, 10.1.53, 11.0.20
CVE-2026-42498 Apache Tomcat - WebSocket authentication header exposure	HIGH	7.3	—	Apache Tomcat - WebSocket authentication header exposure	7.0.0, 7.0.100, 7.0.103, 7.0.104 (+421 more)	9.0.118, 10.1.55, 11.0.22
CVE-2025-53506 Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams	HIGH	7.5	—	Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams	8.5.0, 8.5.100, 8.5.11, 8.5.12 (+269 more)	9.0.107, 10.1.43, 11.0.9
CVE-2025-52520 Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits	HIGH	7.5	—	Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+269 more)	11.0.9, 10.1.43, 9.0.107
CVE-2026-24880 Apache Tomcat has an HTTP Request/Response Smuggling vulnerability	HIGH	7.5	—	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability	7.0.0, 7.0.100, 7.0.103, 7.0.104 (+414 more)	9.0.116, 10.1.52, 11.0.20
CVE-2026-24734 Apache Tomcat has an Improper Input Validation vulnerability	HIGH	7.5	—	Apache Tomcat has an Improper Input Validation vulnerability	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+116 more)	11.0.18, 10.1.52, 9.0.115
CVE-2025-31650 Apache Tomcat Denial of Service via invalid HTTP priority header	MEDIUM	7.5	—	Apache Tomcat Denial of Service via invalid HTTP priority header	9.0.100, 9.0.102, 9.0.76, 9.0.78 (+157 more)	9.0.104, 10.1.40, 11.0.6
CVE-2025-66614 Apache Tomcat - Client certificate verification bypass	MEDIUM	9.1	—	Apache Tomcat - Client certificate verification bypass	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+288 more)	11.0.15, 10.1.50, 9.0.113
CVE-2025-49124 Apache Tomcat installer for Windows has an untrusted search path vulnerability	MEDIUM	8.1	—	Apache Tomcat installer for Windows has an untrusted search path vulnerability	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+130 more)	11.0.8, 10.1.42, 9.0.106
CVE-2025-55754 Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences	LOW	9.6	—	Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+177 more)	11.0.11, 10.1.45, 9.0.109

About This Data

Vulnerability data for org.apache.tomcat.embed:tomcat-embed-core is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.

CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.