TI-2025-22812 CVE-2025-31650 · GHSA-3p2h-wqq4-wf4h
Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
Priority HIGH 74
Improper Input Validation vulnerability in Apache Tomcat.
RHSA-2026:18537
tomcat security update
Released 2026-05-19 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 10) tomcat-1:10.1.49-1.el10, tomcat-admin-webapps-1:10.1.49-1.el10, tomcat-docs-webapp-1:10.1.49-1.el10 +5
Fixes 5 records
TI-2025-35174 CVE-2025-55754 · GHSA-vfww-5hm6-hx2j
Apache Tomcat: console manipulation via escape sequences in log messages
Priority MEDIUM 55
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.
TI-2026-40363 CVE-2026-55957 · GHSA-7895-gffq-w6jq
Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
Priority MEDIUM 45
Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password.
TI-2025-29372 CVE-2025-46701 · GHSA-h2fw-rfh5-95r3
Apache Tomcat: Security constraint bypass for CGI scripts
Priority MEDIUM 44
Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.
TI-2025-35099 CVE-2025-55668 · GHSA-23hv-mwm6-g8jf
Apache Tomcat: session fixation via rewrite valve
Priority LOW 31
Session Fixation vulnerability in Apache Tomcat via rewrite valve.