Apache Tomcat vulnerabilities
274 published vulnerabilities in Apache Tomcat, 7 of them exploited in the wild. The most were published in 2026 (39), and 39 so far in 2026.
Apache Tomcat vulnerabilities by year
2000
2001
2002
2003
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
Most exploited Apache Tomcat vulnerabilities
- CVE-2025-24813 Apache Tomcat Path Equivalence
- CVE-2020-1938 Apache Tomcat Improper Privilege Management
- CVE-2016-8735 Apache Tomcat Remote Code Execution
- CVE-2017-12617 Apache Tomcat Remote Code Execution
- CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution
- CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data
- CVE-2023-44487 HTTP/2 Rapid Reset Attack
- CVE-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete
- CVE-2026-65905 Apache Tomcat: Limited replay attack possible with DIGEST authentication
- CVE-2026-41293 Apache Tomcat: HTTP/2 request headers not validated
- CVE-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user
- CVE-2025-31651 Apache Tomcat: Bypass of rules in Rewrite Valve
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.