Loading story…
Apache disclosed CVE-2026-50229, a basic cross-site scripting vulnerability in the Number Guess example application shipped with Apache Tomcat. The issue is classified as CWE-80, improper neutralization of script-related HTML tags, allowing attacker-supplied script content to be rendered in a victim’s browser when the vulnerable example is exposed.
Affected supported release lines include Tomcat versions through 11.0.22, 10.1.55, 9.0.118, 8.5.100, and 7.0.109. Organizations using the example application should remove or restrict it where unnecessary and upgrade to Tomcat 11.0.23, 10.1.56, or 9.0.119; end-of-support releases may also be affected.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
CVE-2026-50229 was published for a CWE-80 basic cross-site scripting vulnerability in Apache Tomcat's number guess example application. The issue affects supported Tomcat release lines through 11.0.22, 10.1.55, and 9.0.118; Apache Tomcat 11.0.23, 10.1.56, and 9.0.119 remediate it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple legacy Apache Tomcat releases are affected by vulnerabilities including HTTP request smuggling (`CVE-2005-2090`), insecure default SSL cipher suites (`CVE-2007-1858`), and cross-site scripting in the bundled calendar example (`CVE-2006-7196`). The request-smuggling flaw affects Tomcat 5.0.19 with Coyote/1.1 and Tomcat 4.1.24 with Coyote/1.0 when conflicting `Transfer-Encoding: chunked` and `Content-Length` headers cause request-body data to be forwarded and interpreted as a separate downstream request. Affected SSL configurations in Tomcat 4.1.28–4.1.31, 5.0.0–5.0.30, and 5.5.0–5.5.17 permit anonymous and other insecure cipher suites, potentially exposing sensitive information. Separately, the `cal2.jsp` calendar example allows script injection through its `time` parameter in several Tomcat 4.x, 5.0.x, and 5.5.x releases. Organizations operating these obsolete versions should remove vulnerable example applications, disable weak SSL ciphers, and upgrade to supported Tomcat releases to mitigate cache poisoning, security-control bypass, data exposure, and XSS risks.
Aug 29, 2026
Apache disclosed **CVE-2026-59083**, a vulnerability in Tomcat's `RewriteValve` caused by incorrect URL decoding of hex-encoded characters that can let attackers bypass security controls in some configurations. The issue is classified as **CWE-177** and was described as low severity by Apache, though the CVE record notes network attackability with low attack complexity, no privileges required, and no user interaction. Apache said the flaw affects supported Tomcat branches **11.0.0-M1 through 11.0.23**, **10.1.0-M1 through 10.1.56**, and **9.0.0.M1 through 9.0.119**, with reports also listing **8.5.0 through 8.5.100** as affected. Apache and downstream advisories urged users to upgrade to fixed releases **11.0.24**, **10.1.57**, or **9.0.120**, while warning that older unsupported versions may also be vulnerable; versions before **8.0.0** were noted as unaffected in the oss-security disclosure. The vulnerability was published through Apache security pages, the Apache mailing list, and `oss-security`, with the CVE entry updated to include affected-version details, a CVSS v3.1 vector, and a CISA SSVC assessment.
Aug 28, 2026
Apache Tomcat has remediated **CVE-2026-65182**, a critical improper authorization and access-control flaw (**CVSS 9.1**) that can let an unauthenticated remote attacker bypass configured security constraints. The issue arises when a constraint for a longer URL path is declared before a more restrictive constraint for a shorter subpath, causing Tomcat to apply access controls incorrectly. No public exploitation was known at the time of the notices. Affected releases include Tomcat 7.0.0–7.0.109, 8.5.0–8.5.100, 9.0.0.M1–9.0.120, 10.1.0-M1–10.1.57, and 11.0.0-M1–11.0.24, including deployments using embedded Tomcat libraries. Organizations should identify exposed instances and update to fixed releases—Tomcat 9.0.121, 10.1.58 or later, and 11.0.25 or later—while validating URL security-constraint ordering after remediation.
Sep 3, 2026