Apache Tomcat

The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.

Apache Tomcat DoS with unexpected TLS packet

An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.

DoS after non-blocking IO error

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

Unknown vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 allows attackers to access servlet resources. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this issue is already covered by other CVE identifiers.

Apache Tomcat: HTTP/2 excess header handling DoS

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

Apache Tomcat: h2 DoS - Made You Reset

Apache Tomcat: Security constraint bypass for pre/post-resources

Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

Apache Tomcat: HTTP request smuggling via malformed trailer headers

Apache Tomcat: JsonErrorReportValve escaping

Apache Tomcat: DoS via integer overflow in multipart file upload

Apache Tomcat: DoS via excessive h2 streams at connection start

Apache Tomcat: APR/Native Connector crash leading to DoS

Apache Tomcat request smuggling via malformed content-length

Apache Tomcat: AJP response header mix-up

Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Apache Tomcat: DoS via WebSocket chat example

Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

Apache Tomcat: LockOutRealm treats user names as case-sensitive

Apache Tomcat: Request smuggling via invalid chunk extension

Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

Apache Tomcat: Incomplete escaping of JSON access logs

Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

Apache Tomcat: TLS cipher order is not preserved

Apache Tomcat: Security constraint bypass for CGI scripts

Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind

Apache Tomcat: WebSocket authentication header exposure

Apache Tomcat: Bad ornext processing in RewriteValve

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.

Incomplete fix for CVE-2020-9484

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.

Local privilege escalation with FileStore

Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.