Maven (Java)

org.apache.tomcat:tomcat Security Analysis

org.apache.tomcat:tomcat has 17 known security vulnerabilities in Maven (Java). Upgrade to version 11.0.22 or later to resolve all known issues. Data sourced from OSV, enriched with EPSS exploit probability and CISA KEV.

17 Vulnerabilities

Actively Exploited

CISA has confirmed this package has vulnerabilities under active exploitation. Prioritize updating immediately.

Recommended safe version: 11.0.22

Upgrading to 11.0.22 or later resolves all 17 known vulnerabilities in org.apache.tomcat:tomcat. Update your pom.xml or build.gradle to version 11.0.22.

Is org.apache.tomcat:tomcat in your project?

Check if you're affected and upgrade to 11.0.22 to stay secure.

Start Free Scan Get Alerted When New CVEs Drop

Total

Critical

High

Medium

Low

Active Exploitation Warning

One or more vulnerabilities in this package are known to be actively exploited in the wild. Immediate action is recommended.

Vulnerabilities

17 unique vulnerabilities — sorted by exploitation risk (KEV → EPSS → CVSS). Click a CVE/GHSA ID for full details.

CVE / GHSA	Severity	CVSS	EPSS	Summary	Affected	Fixed In
CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data vulnerability	HIGH	7.5	—	Apache Tomcat Missing Encryption of Sensitive Data vulnerability	11.0.20, 10.1.53, 9.0.116	11.0.21, 10.1.54, 9.0.117
CVE-2026-43512 Apache Tomcat - Digest authenticator will authenticate any unknown user	CRITICAL	9.8	—	Apache Tomcat - Digest authenticator will authenticate any unknown user	7.0.100, 7.0.103, 7.0.104, 7.0.105 (+397 more)	9.0.118, 10.1.55, 11.0.22
CVE-2026-41293 Apache Tomcat - HTTP/2 request headers not validated	CRITICAL	9.8	—	Apache Tomcat - HTTP/2 request headers not validated	7.0.100, 7.0.103, 7.0.104, 7.0.105 (+397 more)	9.0.118, 10.1.55, 11.0.22
CVE-2026-43515 Apache Tomcat - Security constraints not correctly applied	CRITICAL	9.1	—	Apache Tomcat - Security constraints not correctly applied	7.0.100, 7.0.103, 7.0.104, 7.0.105 (+397 more)	9.0.118, 10.1.55, 11.0.22
CVE-2026-29145 Apache Tomcat: CLIENT_CERT authentication does not fail as expected	CRITICAL	9.1	—	Apache Tomcat: CLIENT_CERT authentication does not fail as expected	9.0.100, 9.0.102, 9.0.104, 9.0.105 (+119 more)	9.0.116, 10.1.53, 11.0.20
CVE-2009-3555 Apache Tomcat affected by vulnerability in TLS and SSL protocol	CRITICAL	9.8	—	Apache Tomcat affected by vulnerability in TLS and SSL protocol	All versions	7.0.10, 6.0.32, 5.5.33
CVE-2026-29146 Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor	HIGH	7.5	—	Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor	9.0.100, 9.0.102, 9.0.104, 9.0.105 (+187 more)	9.0.116, 10.1.53, 11.0.20
CVE-2026-43513 Apache Tomcat: LockOutRealm treats user names as case-sensitive	HIGH	7.5	—	Apache Tomcat: LockOutRealm treats user names as case-sensitive	7.0.100, 7.0.103, 7.0.104, 7.0.105 (+397 more)	9.0.118, 10.1.55, 11.0.22
CVE-2026-41284 Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling	HIGH	7.5	—	Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling	7.0.100, 7.0.103, 7.0.104, 7.0.105 (+397 more)	9.0.118, 10.1.55, 11.0.22
CVE-2025-55752 Apache Tomcat Vulnerable to Relative Path Traversal	HIGH	7.5	—	Apache Tomcat Vulnerable to Relative Path Traversal	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+270 more)	11.0.11, 10.1.45, 9.0.109
CVE-2026-34483 Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve	HIGH	7.5	—	Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve	9.0.100, 9.0.102, 9.0.104, 9.0.105 (+161 more)	9.0.116, 10.1.54, 11.0.21
CVE-2026-34487 Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File	HIGH	7.5	—	Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File	9.0.100, 9.0.102, 9.0.104, 9.0.105 (+183 more)	9.0.117, 10.1.54, 11.0.21
CVE-2026-29129 Apache Tomcat: Configured cipher preference order not preserved	HIGH	7.5	—	Apache Tomcat: Configured cipher preference order not preserved	9.0.115, 10.1.52, 11.0.18	9.0.116, 10.1.53, 11.0.20
CVE-2026-42498 Apache Tomcat - WebSocket authentication header exposure	HIGH	7.3	—	Apache Tomcat - WebSocket authentication header exposure	7.0.100, 7.0.103, 7.0.104, 7.0.105 (+397 more)	9.0.118, 10.1.55, 11.0.22
CVE-2025-66614 Apache Tomcat - Client certificate verification bypass	MEDIUM	9.1	—	Apache Tomcat - Client certificate verification bypass	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+385 more)	11.0.15, 10.1.50, 9.0.113
CVE-2025-49124 Apache Tomcat installer for Windows has an untrusted search path vulnerability	MEDIUM	8.1	—	Apache Tomcat installer for Windows has an untrusted search path vulnerability	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+130 more)	11.0.8, 10.1.42, 9.0.106
CVE-2025-55754 Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences	LOW	9.6	—	Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+177 more)	11.0.11, 10.1.45, 9.0.109

About This Data

Vulnerability data for org.apache.tomcat:tomcat is sourced from the Open Source Vulnerability (OSV) database, aggregating reports from GitHub Advisory Database, NIST NVD, and ecosystem-specific sources.

CVSS (Common Vulnerability Scoring System) scores reflect exploitability and impact. EPSS (Exploit Prediction Scoring System) scores indicate the probability of exploitation within the next 30 days. Vulnerabilities marked with are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.