Apache Tomcat vulnerabilities and CVEs

Known vulnerabilities affecting Apache Tomcat, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

3 vulnerabilities tracked. 1 with public exploit code.

— The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions… CVE-2019-10072 21 Jun 2019
— The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without… CVE-2019-0221 Exploit code 28 May 2019
— A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to… CVE-2017-5647 17 Apr 2017

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Apache Tomcat is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

Apache Tomcat vulnerabilities and CVEs

What this covers

Other products tracked here