Sign in
Deutsch English Español Polski
High

Apache Tomcat has an Improper Input Validation vulnerability

  • Disclosed: 17.02.2026
  • Updated: 11.10.2026 13:20

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.

The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.18, >= 10.1.0-M7, < 10.1.52, >= 9.0.83, < 9.0.115 11.0.18, 10.1.52, 9.0.115
Java / Kotlin (Maven) org.apache.tomcat:tomcat-coyote >= 11.0.0-M1, < 11.0.18, >= 10.1.0-M7, < 10.1.52, >= 9.0.83, < 9.0.115 11.0.18, 10.1.52, 9.0.115

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness (CWE)
CWE-20
Platform
Java / Kotlin (Maven)
Package
org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote
Disclosed
17.02.2026
Updated
11.10.2026 13:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-mgp5-rv84-w37q - CC BY 4.0

Vulnerability history: org.apache.tomcat:tomcat-coyote

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (33) in the archive
Total entries
33
First → latest
06.2020 05.2026
Without a fix
0
Exploited in attacks
1

Severity breakdown

  • Critical 2
  • High 17
  • Medium 13
  • Low 1

Disclosures per year

Severity:
  1. Apache Tomcat - HTTP/2 request headers not validated
    Critical · 9.8 CVE-2026-41293 >= 8.5.0, < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  2. Apache Tomcat has an HTTP Request/Response Smuggling vulnerability
    High · 7.5 CVE-2026-24880 >= 7.0.0, < 9.0.116, >= 10.1.0-M1, < 10.1.52, >= 11.0.0-M1, < 11.0.20 9.0.116, 10.1.52, 11.0.20
  3. Apache Tomcat: Configured cipher preference order not preserved
    High · 7.5 CVE-2026-29129 >= 9.0.114, < 9.0.116, >= 10.1.51, < 10.1.53, >= 11.0.16, < 11.0.20 9.0.116, 10.1.53, 11.0.20
  4. Apache Tomcat has an Improper Input Validation vulnerability this entry
    High · 7.5 CVE-2026-24734 >= 11.0.0-M1, < 11.0.18, >= 10.1.0-M7, < 10.1.52, >= 9.0.83, < 9.0.115 11.0.18, 10.1.52, 9.0.115
  5. Apache Tomcat Improper Resource Shutdown or Release vulnerability
    High · 7.5 CVE-2025-48989 >= 11.0.0-M1, < 11.0.10, >= 10.1.0-M1, < 10.1.44, >= 9.0.0.M1, < 9.0.108 11.0.10, 10.1.44, 9.0.108
  6. Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams
    High · 7.5 CVE-2025-53506 >= 11.0.0-M1, < 11.0.9, >= 10.1.0-M1, < 10.1.43, >= 9.0.0.M1, < 9.0.107, >= 8.5.0, <= 8.5.100 11.0.9, 10.1.43, 9.0.107
  7. Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability
    High · 8.6 CVE-2024-38286 >= 11.0.0-M1, < 11.0.0-M21, >= 10.1.0-M1, < 10.1.25, >= 9.0.13, < 9.0.90, >= 8.5.35, <= 8.5.100, >= 7.0.92, <= 7.0.109 11.0.0-M21, 10.1.25, 9.0.90
  8. Apache Tomcat - Denial of Service
    High · 7.5 CVE-2024-34750 >= 11.0.0-M1, < 11.0.0-M21, >= 10.1.0-M1, < 10.1.25, >= 9.0.0-M1, < 9.0.90, >= 8.5.0, <= 8.5.100 11.0.0-M21, 10.1.25, 9.0.90
  9. Apache Tomcat Improper Input Validation vulnerability
    High · 7.5 CVE-2023-46589 >= 11.0.0-M1, < 11.0.0-M11 11.0.0-M11
  10. Apache Tomcat - Fix for CVE-2023-24998 was incomplete
    High · 7.5 CVE-2023-28709 >= 8.5.85, < 8.5.88 8.5.88
  11. Apache Tomcat vulnerable to information leak
    High · 7.5 CVE-2023-34981 >= 8.5.88, < 8.5.89 8.5.89
  12. Apache Commons FileUpload denial of service vulnerability
    High · 7.5 CVE-2023-24998 >= 10.1.0-M1, < 10.1.5, >= 11.0.0-M2, < 11.0.0-M5, >= 8.5.85, < 8.5.88, >= 9.0.0-M1, < 9.0.71 10.1.5, 11.0.0-M5, 8.5.88, 9.0.71
  13. Apache Tomcat may reject request containing invalid Content-Length header
    High · 7.5 CVE-2022-42252 >= 9.0.0-M1, < 9.0.68, >= 10.0.0-M1, < 10.0.27, >= 10.1.0-M1, < 10.1.1 9.0.68, 10.0.27, 10.1.1
  14. Expected Behavior Violation in Apache Tomcat
    Critical · 9.8 CVE-2017-5651 >= 9.0.0.M1, < 9.0.0.M19, >= 8.5.0, < 8.5.13 9.0.0.M19, 8.5.13
  15. Improper Input Validation in Apache Tomcat
    High · 7.1 CVE-2016-6816 >= 9.0.0.M1, < 9.0.0.M12, >= 8.5.0, < 8.5.8, >= 8.0.0RC1, < 8.0.39, >= 7.0.0, < 7.0.73, >= 6.0.0, < 6.0.48 9.0.0.M12, 8.5.8, 8.0.39, 7.0.73, 6.0.48
  16. Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
    High · 7.5 CVE-2020-17527 >= 10.0.0-M1, < 10.0.0-M10, >= 9.0.0-M1, < 9.0.40, >= 8.5.0, < 8.5.60 10.0.0-M10, 9.0.40, 8.5.60
  17. Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
    High · 7.5 CVE-2020-13934 >= 10.0.0-M1, < 10.0.0-M6, >= 9.0.0.M5, < 9.0.36, >= 8.5.1, < 8.5.56 10.0.0-M6, 9.0.36, 8.5.56
  18. Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
    High · 7.5 CVE-2021-25122 >= 10.0.0-M1, < 10.0.2 10.0.2
  19. Apache Tomcat Denial of Service vulnerability
    High · 7.5 CVE-2019-0199 >= 9.0.0, < 9.0.16, >= 8.0.0, < 8.5.38 9.0.16, 8.5.38

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.