Cross-site scripting in Apache Tomcat
Priority MEDIUM 61CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 7 fixed, 12 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.
Summary
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.59194 99th percentileScored 2026-11-07
Fix Partial org.apache.tomcat.embed:tomcat-embed-core (Maven): 9.0.17, 8.5.40, 7.0.94org.apache.tomcat:tomcat-catalina (Maven): 9.0.17, 8.5.40, 7.0.94+1 more productRed Hat: 4 advisoriesRed Hat: 7 fixed, 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | Apache Tomcat 9.0.0.M1 to 9.0.0.17; 8.5.0 to 8.5.39; 7.0.0 to 7.0.93 | — | No fix listed | CNA |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 9.0.0 to before 9.0.17 | 9.0.17 | Patch available | GHSA-jjpq-gp5q-8q6w |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 8.5.0 to before 8.5.40 | 8.5.40 | Patch available | GHSA-jjpq-gp5q-8q6w |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 7.0.0 to before 7.0.94 | 7.0.94 | Patch available | GHSA-jjpq-gp5q-8q6w |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 9.0.0 to before 9.0.17 | 9.0.17 | Patch available | GHSA-jjpq-gp5q-8q6w |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 8.5.0 to before 8.5.40 | 8.5.40 | Patch available | GHSA-jjpq-gp5q-8q6w |
| — | org.apache.tomcat:tomcat-catalina (Maven) | 7.0.0 to before 7.0.94 | 7.0.94 | Patch available | GHSA-jjpq-gp5q-8q6w |
| — | org.apache.tomcat:tomcat (Maven) | 9.0.0 to before 9.0.17 | 9.0.17 | Patch available | GHSA-jjpq-gp5q-8q6w |
| — | org.apache.tomcat:tomcat (Maven) | 8.5.0 to before 8.5.40 | 8.5.40 | Patch available | GHSA-jjpq-gp5q-8q6w |
| — | org.apache.tomcat:tomcat (Maven) | 7.0.0 to before 7.0.94 | 7.0.94 | Patch available | GHSA-jjpq-gp5q-8q6w |
- Apache Tomcat VendorApache Affected Apache Tomcat 9.0.0.M1 to 9.0.0.17; 8.5.0 to 8.5.39; 7.0.0 to 7.0.93 Fixed in — No fix listed CNA
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0 to before 9.0.17 Fixed in 9.0.17 Patch available GHSA-jjpq-gp5q-8q6w
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.5.0 to before 8.5.40 Fixed in 8.5.40 Patch available GHSA-jjpq-gp5q-8q6w
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 7.0.0 to before 7.0.94 Fixed in 7.0.94 Patch available GHSA-jjpq-gp5q-8q6w
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 9.0.0 to before 9.0.17 Fixed in 9.0.17 Patch available GHSA-jjpq-gp5q-8q6w
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 8.5.0 to before 8.5.40 Fixed in 8.5.40 Patch available GHSA-jjpq-gp5q-8q6w
- org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 7.0.0 to before 7.0.94 Fixed in 7.0.94 Patch available GHSA-jjpq-gp5q-8q6w
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.0 to before 9.0.17 Fixed in 9.0.17 Patch available GHSA-jjpq-gp5q-8q6w
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.0 to before 8.5.40 Fixed in 8.5.40 Patch available GHSA-jjpq-gp5q-8q6w
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 7.0.0 to before 7.0.94 Fixed in 7.0.94 Patch available GHSA-jjpq-gp5q-8q6w
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 7.0.0 – 7.0.93; 8.5.0 – 8.5.39; 9.0.1 – 9.0.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* | 9.0.0 milestone1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* | 9.0.0 milestone10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* | 9.0.0 milestone11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* | 9.0.0 milestone12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* | 9.0.0 milestone13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* | 9.0.0 milestone14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* | 9.0.0 milestone15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* | 9.0.0 milestone16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* | 9.0.0 milestone17 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 7.0.0 – 7.0.93; 8.5.0 – 8.5.39; 9.0.1 – 9.0.17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* Versions 9.0.0 milestone1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* | 9.0.0 milestone18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* | 9.0.0 milestone19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* | 9.0.0 milestone2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* | 9.0.0 milestone20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* | 9.0.0 milestone21 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* | 9.0.0 milestone22 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* | 9.0.0 milestone23 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* | 9.0.0 milestone24 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* | 9.0.0 milestone25 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* | 9.0.0 milestone26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* | 9.0.0 milestone27 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* | 9.0.0 milestone3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* | 9.0.0 milestone4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* | 9.0.0 milestone5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* | 9.0.0 milestone6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* | 9.0.0 milestone7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* | 9.0.0 milestone8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* | 9.0.0 milestone9 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* Versions 9.0.0 milestone19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* Versions 9.0.0 milestone2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* Versions 9.0.0 milestone20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* Versions 9.0.0 milestone21 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* Versions 9.0.0 milestone22 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* Versions 9.0.0 milestone23 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* Versions 9.0.0 milestone24 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* Versions 9.0.0 milestone25 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* Versions 9.0.0 milestone26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* Versions 9.0.0 milestone27 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* Versions 9.0.0 milestone3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* Versions 9.0.0 milestone4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
Remediation
- Fix · GHSA-jjpq-gp5q-8q6w org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.17 Advisory →
- Fix · GHSA-jjpq-gp5q-8q6w org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.40 Advisory →
- Fix · GHSA-jjpq-gp5q-8q6w org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 7.0.94 Advisory →
- Fix · GHSA-jjpq-gp5q-8q6w org.apache.tomcat:tomcat-catalina (Maven) Fixed in 9.0.17 Advisory →
- Fix · GHSA-jjpq-gp5q-8q6w org.apache.tomcat:tomcat-catalina (Maven) Fixed in 8.5.40 Advisory →
- Fix · GHSA-jjpq-gp5q-8q6w org.apache.tomcat:tomcat-catalina (Maven) Fixed in 7.0.94 Advisory →
- Fix · GHSA-jjpq-gp5q-8q6w org.apache.tomcat:tomcat (Maven) Fixed in 9.0.17 Advisory →
- Fix · GHSA-jjpq-gp5q-8q6w org.apache.tomcat:tomcat (Maven) Fixed in 8.5.40 Advisory →
- Fix · GHSA-jjpq-gp5q-8q6w org.apache.tomcat:tomcat (Maven) Fixed in 7.0.94 Advisory →
Red Hat 4 advisories
- RHSA-2020:0861 Released 2020-03-17 · Red Hat rating ImportantRed Hat JBoss Web Server 3.1 Service Pack 8 security update
- Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat-native-1.2.23-21.redhat_21.ep7.el6, tomcat7-7.0.70-38.ep7.el6, tomcat7-admin-webapps-7.0.70-38.ep7.el6 +22
- Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat-native-1.2.23-21.redhat_21.ep7.el7, tomcat7-7.0.70-38.ep7.el7, tomcat7-admin-webapps-7.0.70-38.ep7.el7 +22
- RHSA-2020:0860 Released 2020-03-17 · Red Hat rating ImportantRed Hat JBoss Web Server 3.1 Service Pack 8 security update
- Red Hat JBoss Web Server 3.1
- RHSA-2019:3929 Released 2019-11-20 · Red Hat rating ImportantRed Hat JBoss Web Server 5.2 security release
- Red Hat JBoss Web Server 5.2 for RHEL 6 Server jws5-ecj-4.12.0-1.redhat_1.1.el6jws, jws5-javapackages-tools-3.4.1-5.15.11.el6jws, jws5-jboss-logging-3.3.2-1.Final_redhat_00001.1.el6jws +16
- Red Hat JBoss Web Server 5.2 for RHEL 7 Server jws5-ecj-4.12.0-1.redhat_1.1.el7jws, jws5-javapackages-tools-3.4.1-5.15.11.el7jws, jws5-jboss-logging-3.3.2-1.Final_redhat_00001.1.el7jws +16
- Red Hat JBoss Web Server 5.2 for RHEL 8 jws5-ecj-4.12.0-1.redhat_1.1.el8jws, jws5-javapackages-tools-3.4.1-5.15.11.el8jws, jws5-jboss-logging-3.3.2-1.Final_redhat_00001.1.el8jws +16
Show 1 more Red Hat advisories
- RHSA-2019:3931 Released 2019-11-20 · Red Hat rating ImportantRed Hat JBoss Web Server 5.2 security release
- Red Hat JBoss Web Server 5
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat BPM Suite 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Operations Network 3 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Web Server 3.1 | Fixed | RHSA-2020:0860 |
| Red Hat JBoss Web Server 3.1 for RHEL 6 | Fixed | RHSA-2020:0861 |
| Red Hat JBoss Web Server 3.1 for RHEL 7 | Fixed | RHSA-2020:0861 |
| Red Hat JBoss Web Server 5 | Fixed | RHSA-2019:3931 |
| Red Hat JBoss Web Server 5.2 for RHEL 6 Server | Fixed | RHSA-2019:3929 |
| Red Hat JBoss Web Server 5.2 for RHEL 7 Server | Fixed | RHSA-2019:3929 |
| Red Hat JBoss Web Server 5.2 for RHEL 8 | Fixed | RHSA-2019:3929 |
Not affected: 2 products
- Red Hat Fuse 7
- Red Hat JBoss Data Grid 7
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0221
- 2026-10-03 Alias added: GHSA-jjpq-gp5q-8q6w
- 2026-11-02 CISA SSVC decision points changed
References
Advisory 12
Other 41
- [debian-lts-announce] 20190530 [SECURITY] [DLA 1810-1] tomcat7 security update
- [debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update
- 20191229 [SECURITY] [DSA 4596-1] tomcat8 security update
- [announce] 20200131 Apache Software Foundation Security Report: 2019
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c%40%3Cannounce.tomcat.apache.org%3E
- https://security.netapp.com/advisory/ntap-20190606-0001/
- https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221/
- https://support.f5.com/csp/article/K13184144?utm_source=f5support&%3Butm_medium=RSS
- http://packetstormsecurity.com/files/163457/Apache-Tomcat-9.0.0.M1-Cross-Site-Scripting.html
- https://github.com/apache/tomcat/commit/15fcd166ea2c1bb79e8541b8e1a43da9c452ceea
- https://github.com/apache/tomcat/commit/44ec74c44dcd05cd7e90967c04d40b51440ecd7e
- https://github.com/apache/tomcat/commit/4fcdf706f3ecf35912a600242f89637f5acb32da
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46
- https://lists.fedoraproject.org/archives/list/[email protected]/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46
- https://security.netapp.com/advisory/ntap-20190606-0001
- https://support.f5.com/csp/article/K13184144?utm_source=f5support&utm_medium=RSS
- https://tomcat.apache.org/security-7.html
- https://tomcat.apache.org/security-8.html
- https://tomcat.apache.org/security-9.html
- https://usn.ubuntu.com/4128-1
- https://usn.ubuntu.com/4128-2
- https://web.archive.org/web/20200227055048/http://www.securityfocus.com/bid/108545
- https://wwws.nightwatchcybersecurity.com/2019/05/27/xss-in-ssi-printenv-command-apache-tomcat-cve-2019-0221
- https://github.com/apache/tomcat
- https://lists.apache.org/thread.html/6e6e9eacf7b28fd63d249711e9d3ccd4e0a83f556e324aee37be5a8c@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2019-0221 · CVE Program
- CVE-2019-0221 · NVD
- FIRST EPSS
- GHSA-jjpq-gp5q-8q6w · GitHub Advisory Database · CC BY 4.0
- CVE-2019-0221 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences