Apache Tomcat vulnerabilities

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows.

In Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90, when the default servlet returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo'), a specially crafted URL could be used to cause the redirect to be generated to any URI of the attacker's choice.

The default settings for the CORS filter in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. Users are expected to configure the CORS filter appropriately for their environment rather than relying on the default configuration, so most users are not expected to be impacted.

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition, causing the constraint to be ignored and allowing unauthorised users to access protected web application resources.

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded, so depending on the order Servlets were loaded some security constraints might not be applied, exposing resources to unauthorised users.

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44, and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin, permitting client and server side cache poisoning in some circumstances.

A malicious web application running on Apache Tomcat versions from 6.0.0 to 9.0.0.M9 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.

The ResourceLinkFactory implementation in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

In Apache Tomcat, when a SecurityManager is configured, the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

In Apache Tomcat versions from 6.0.0 to 9.0.0.M9, a vulnerability allowed a malicious web application to bypass a configured SecurityManager via a Tomcat utility method accessible to web applications.

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.

Apache Tomcat versions 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43, and 7.0.0 to 7.0.77 do not process static error pages as GET requests when an error occurs. Depending on the original request, this can lead to unexpected results, including replacement or removal of custom error pages if the DefaultServlet is configured to permit writes.

In Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, a regression in send file processing was introduced. If the send file processing completed quickly, it was possible for the same Processor to be added to the processor cache twice.

In Apache Tomcat versions from 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75, there was an issue with the use of the incorrect facade object in some calls to application listeners. This allowed untrusted applications to retain a reference to the request or response object, potentially accessing or modifying information associated with another web application.

A bug in the handling of pipelined requests in Apache Tomcat causes the request to be lost when send file processing of the previous request is completed. This can lead to responses being sent for the wrong requests.

The setGlobalContext method in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, allowing remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service.

The session-persistence implementation in Apache Tomcat in versions 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes. This allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.

Apache Tomcat has a session fixation vulnerability affecting versions 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2. The issue arises when different session settings are used for deployments of multiple versions of the same web application, potentially allowing remote attackers to hijack user sessions.

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.

The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.

Apache Tomcat versions 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 do not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body. This allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader for the XML parser used with XSLT stylesheets, allowing remote attackers to read arbitrary files via XXE or files associated with different web applications on a single Tomcat instance.

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

In Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, the default servlet does not properly restrict XSLT stylesheets, allowing remote attackers to bypass security-manager restrictions and read arbitrary files via XXE.

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

Apache Tomcat before 6.0.39, 7.0.50, and 8.0.0-RC10 allows attackers to obtain Tomcat internals information by leveraging an untrusted web application with XML documents containing external entity declarations, related to an XML External Entity (XXE) issue.

Apache Tomcat before 6.0.39, 7.0.50, and 8.0.0-RC10 processes chunked transfer coding without properly handling large amounts of chunked data or whitespace characters in HTTP header values within trailer fields, allowing remote attackers to cause a denial of service by streaming data. This vulnerability exists due to an incomplete fix for CVE-2012-3544.

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers. This allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via multiple Content-Length headers or a Content-Length header and a "Transfer-Encoding: chunked" header.

The FormAuthenticator in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, allowing remote attackers to inject a request into a session by sending this request during completion of the login form. This is a variant of a session fixation attack.

Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding. This allows remote attackers to cause a denial of service by streaming data.

Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 has a vulnerability in NioEndpoint.java when the NIO connector is used with sendfile and HTTPS. A remote attacker can cause an infinite loop (denial of service) by terminating the connection during response reading.

The CsrfPreventionFilter in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials. This makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, making it easier for remote attackers to bypass authentication via vectors related to the session ID.

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce values instead of nonce and nc values, making it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests. This is a different vulnerability than CVE-2011-1184.

Incomplete cleanup in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. The issue affects versions 11.0.0-M21 through 11.0.26, 10.1.25 through 10.1.60, and 9.0.90 through 9.0.122.

Incomplete cleanup in Apache Tomcat allowed trailer information from a previous request to leak into a subsequent request. The issue affects versions 11.0.0-M23 through 11.0.26, 10.1.27 through 10.1.60, and 9.0.92 through 9.0.122.

A TOCTOU race condition in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorized local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. The issue affects versions 9.0.47 through 9.0.122.

Execution After Redirect (EAR) vulnerability in Apache Tomcat. Affects versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122; EOL versions 8.5.0-8.5.100 and 7.0.0-7.0.109 are also known to be affected.

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat: if OpenSSLLifecycleListener is configured for FIPS mode but FIPS activation fails, Tomcat logs an error but continues using JSSE in non-FIPS mode with the provided configuration. Affects versions 11.0.0-M14 through 11.0.26, 10.1.22 through 10.1.60, and 9.0.92 through 9.0.122.

Improper handling of length parameter inconsistency in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. Affects versions from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121; also known affected: 8.5.0-8.5.100 and 7.0.56-7.0.109.

A vulnerability in Apache Tomcat causes lost timeouts for asynchronous WebSocket writes, leading to denial of service (DoS). The issue affects many Tomcat versions, including 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121.

A vulnerability in Apache Tomcat related to incomplete cleanup can cause a malformed request to potentially (depending on timing) cause one request from another user to fail. Affects versions 11.0.19-11.0.25, 10.1.53-10.1.59, and 9.0.116-9.0.121.

A vulnerability in Apache Tomcat involving uncontrolled resource allocation allows an unauthenticated AJP request to pin an AJP processing thread, leading to denial of service. Affects versions 11.0.0-M1-11.0.25, 10.1.0-M1-10.1.59, and 9.0.0.M1-9.0.121.

A vulnerability in Apache Tomcat involving uncontrolled resource consumption during sending of WebSocket close message enables a DoS attack. Affects versions 11.0.0-M5-11.0.25, 10.1.8-10.1.59, and 9.0.74-9.0.121.