Apache Tomcat information disclosure
Priority MEDIUM 53CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 5 fixed, 8 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.22852 97th percentileScored 2026-11-07
Fix Partial Apache Tomcat (Apache Software Foundation): 10.0.0-M10, 9.0.40, 8.5.60 +1org.apache.tomcat.embed:tomcat-embed-core (Maven): 10.0.0-M10, 9.0.40, 8.5.60 +1Red Hat: 4 advisoriesRed Hat: 5 fixed, 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | Apache Tomcat 10 to before 10.0.0-M10; Apache Tomcat 9 to before 9.0.40; Apache Tomcat 8.5 to before 8.5.60; Apache Tomcat 7 to before 7.0.106 | 10.0.0-M10, 9.0.40, 8.5.60, 7.0.106 | Patch available | CNA |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 10.0.0-M1 to before 10.0.0-M10 | 10.0.0-M10 | Patch available | GHSA-2rvv-w9r2-rg7m |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 9.0.0 to before 9.0.40 | 9.0.40 | Patch available | GHSA-2rvv-w9r2-rg7m |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 8.5.0 to before 8.5.60 | 8.5.60 | Patch available | GHSA-2rvv-w9r2-rg7m |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 7.0.0 to before 7.0.107 | 7.0.107 | Patch available | GHSA-2rvv-w9r2-rg7m |
- Apache Tomcat VendorApache Affected Apache Tomcat 10 to before 10.0.0-M10; Apache Tomcat 9 to before 9.0.40; Apache Tomcat 8.5 to before 8.5.60; Apache Tomcat 7 to before 7.0.106 Fixed in 10.0.0-M10, 9.0.40, 8.5.60, 7.0.106 Patch available CNA
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 10.0.0-M1 to before 10.0.0-M10 Fixed in 10.0.0-M10 Patch available GHSA-2rvv-w9r2-rg7m
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0 to before 9.0.40 Fixed in 9.0.40 Patch available GHSA-2rvv-w9r2-rg7m
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.5.0 to before 8.5.60 Fixed in 8.5.60 Patch available GHSA-2rvv-w9r2-rg7m
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 7.0.0 to before 7.0.107 Fixed in 7.0.107 Patch available GHSA-2rvv-w9r2-rg7m
CPE configurations NVD · 40
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 7.0.0 – 7.0.106; 8.5.0 – 8.5.59; 9.0.1 – 9.0.39 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* | 9.0.0 milestone1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* | 9.0.0 milestone10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* | 9.0.0 milestone11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* | 9.0.0 milestone12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* | 9.0.0 milestone13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* | 9.0.0 milestone14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* | 9.0.0 milestone15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* | 9.0.0 milestone16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* | 9.0.0 milestone17 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 7.0.0 – 7.0.106; 8.5.0 – 8.5.59; 9.0.1 – 9.0.39 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:* Versions 9.0.0 milestone1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
Show 30 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* | 9.0.0 milestone18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* | 9.0.0 milestone19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* | 9.0.0 milestone2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* | 9.0.0 milestone20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* | 9.0.0 milestone21 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* | 9.0.0 milestone22 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* | 9.0.0 milestone23 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* | 9.0.0 milestone24 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* | 9.0.0 milestone25 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* | 9.0.0 milestone26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* | 9.0.0 milestone27 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* | 9.0.0 milestone3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* | 9.0.0 milestone4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* | 9.0.0 milestone5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* | 9.0.0 milestone6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* | 9.0.0 milestone7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* | 9.0.0 milestone8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* | 9.0.0 milestone9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:* | 10.0.0 milestone1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:* | 10.0.0 milestone2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:* | 10.0.0 milestone3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:* | 10.0.0 milestone4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:* | 10.0.0 milestone5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:* | 10.0.0 milestone6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:* | 10.0.0 milestone7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:* | 10.0.0 milestone8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:* | 10.0.0 milestone9 | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:* | 9.3.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* | 9.3.6 | Vulnerable | Oracle |
- cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* Versions 9.0.0 milestone19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:* Versions 9.0.0 milestone2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* Versions 9.0.0 milestone20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* Versions 9.0.0 milestone21 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* Versions 9.0.0 milestone22 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* Versions 9.0.0 milestone23 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* Versions 9.0.0 milestone24 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* Versions 9.0.0 milestone25 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* Versions 9.0.0 milestone26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* Versions 9.0.0 milestone27 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:* Versions 9.0.0 milestone3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:* Versions 9.0.0 milestone4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:* Versions 9.0.0 milestone5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone6:*:*:*:*:*:* Versions 9.0.0 milestone6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone7:*:*:*:*:*:* Versions 9.0.0 milestone7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone8:*:*:*:*:*:* Versions 9.0.0 milestone8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:* Versions 10.0.0 milestone1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:* Versions 10.0.0 milestone2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:* Versions 10.0.0 milestone3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:* Versions 10.0.0 milestone4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:* Versions 10.0.0 milestone5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:* Versions 10.0.0 milestone6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:* Versions 10.0.0 milestone7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:* Versions 10.0.0 milestone8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:* Versions 10.0.0 milestone9 Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:* Versions 9.3.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
Remediation
- Fix · CNA Apache Tomcat (Apache Software Foundation) Fixed in 10.0.0-M10, 9.0.40, 8.5.60, 7.0.106
- Fix · GHSA-2rvv-w9r2-rg7m org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 10.0.0-M10 Advisory →
- Fix · GHSA-2rvv-w9r2-rg7m org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.40 Advisory →
- Fix · GHSA-2rvv-w9r2-rg7m org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.60 Advisory →
- Fix · GHSA-2rvv-w9r2-rg7m org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 7.0.107 Advisory →
Red Hat 4 advisories
- RHSA-2022:5532 Released 2022-07-07 · Red Hat rating ImportantRed Hat Fuse 7.11.0 release and security update
- Red Hat Fuse 7.11
- RHSA-2021:3425 Released 2021-09-09 · Red Hat rating ImportantRed Hat support for Spring Boot 2.3.10 security update
- Red Hat support for Spring Boot 2.3.10
- RHSA-2021:0494 Released 2021-02-11 · Red Hat rating ModerateRed Hat JBoss Web Server 5.4.1 Security Update
- Red Hat JBoss Web Server 5.4 for RHEL 7 Server jws5-tomcat-9.0.36-9.redhat_8.1.el7jws, jws5-tomcat-admin-webapps-9.0.36-9.redhat_8.1.el7jws, jws5-tomcat-docs-webapp-9.0.36-9.redhat_8.1.el7jws +8
- Red Hat JBoss Web Server 5.4 for RHEL 8 jws5-tomcat-9.0.36-9.redhat_8.1.el8jws, jws5-tomcat-admin-webapps-9.0.36-9.redhat_8.1.el8jws, jws5-tomcat-docs-webapp-9.0.36-9.redhat_8.1.el8jws +8
Show 1 more Red Hat advisories
- RHSA-2021:0495 Released 2021-02-11 · Red Hat rating ModerateRed Hat JBoss Web Server 5.4.1 Security Update
- Red Hat JBoss Web Server 5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Data Grid 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Virtualization 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Web Server 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat support for Spring Boot | Affected | No fix yet |
| Red Hat Fuse 7.11 | Fixed | RHSA-2022:5532 |
| Red Hat JBoss Web Server 5 | Fixed | RHSA-2021:0495 |
| Red Hat JBoss Web Server 5.4 for RHEL 7 Server | Fixed | RHSA-2021:0494 |
| Red Hat JBoss Web Server 5.4 for RHEL 8 | Fixed | RHSA-2021:0494 |
| Red Hat support for Spring Boot 2.3.10 | Fixed | RHSA-2021:3425 |
Not affected: 6 products
- Red Hat Decision Manager 7
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24122
- 2026-10-03 Alias added: GHSA-2rvv-w9r2-rg7m
- 2026-10-08 CISA SSVC decision points changed
References
Advisory 6
- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E
- [oss-security] 20210114 [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure
- [debian-lts-announce] 20210316 [SECURITY] [DLA 2596-1] tomcat8 security update
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://security.netapp.com/advisory/ntap-20210212-0008/
- https://nvd.nist.gov/vuln/detail/CVE-2021-24122
Other 23
- [tomcat-dev] 20210114 svn commit: r1885488 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml
- [tomee-dev] 20210114 Re: Releases?
- [announce] 20210114 [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure
- [tomcat-dev] 20210114 [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure
- [tomcat-users] 20210114 [SECURITY] CVE-2021-24122 Apache Tomcat Information Disclosure
- [tomee-dev] 20210115 CVE-2021-24122 NTFS Information Disclosure Bug
- https://github.com/apache/tomcat/commit/7f004ac4531c45f9a2a2d1470561fe135cf27bc2
- https://github.com/apache/tomcat/commit/800b03140e640f8892f27021e681645e8e320177
- https://github.com/apache/tomcat/commit/920dddbdb981f92e8d5872a4bb126a10af5ca8a9
- https://github.com/apache/tomcat/commit/935fc5582dc25ae10bab6f9d5629ff8d996cb533
- https://tomcat.apache.org/security-9.html
- https://tomcat.apache.org/security-8.html
- https://tomcat.apache.org/security-7.html
- https://tomcat.apache.org/security-10.html
- https://security.netapp.com/advisory/ntap-20210212-0008
- https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rb32a73b7cb919d4f44a2596b6b951274c0004fc8b0e393d6829a45f9@%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r7e0bb9ea415724550e2b325e143b23e269579e54d66fcd7754bd0c20@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r776c64337495bf28b7d5597268114a888e3fad6045c40a0da0c66d4d@%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r7382e1e35b9bc7c8f320b90ad77e74c13172d08034e20c18000fe710@%3Cdev.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52@%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52@%3Cannounce.apache.org%3E
- https://github.com/apache/tomcat
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2021-24122 · CVE Program
- CVE-2021-24122 · NVD
- FIRST EPSS
- GHSA-2rvv-w9r2-rg7m · GitHub Advisory Database · CC BY 4.0
- CVE-2021-24122 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences