Loading story…
Apache has warned that Tomcat 5.0.x and 5.5.x are unsupported and will receive no further security fixes; the final 5.5 branch fixes ended at 5.5.36. Its security index documents historical flaws spanning authentication bypass, session and information disclosure, arbitrary file access or overwrite, denial of service, cross-site scripting, privilege escalation, and insecure default credentials. Organizations running these releases remain exposed to any subsequently discovered defects and to known vulnerabilities where they have not applied the final available updates.
High-impact historical issues include a blank Windows-installer administrator password (CVE-2009-3548), unsafe WAR deployment that can bypass authentication or overwrite files (CVE-2009-2901, CVE-2009-2693), AJP request spoofing (CVE-2011-3190), and HTTP Digest authentication weaknesses (CVE-2011-1184, CVE-2011-5063, CVE-2011-5064). Older deployments may also leak or expose session identifiers through cookie handling and insecure SSO cookies (CVE-2007-3382, CVE-2008-0128). Apache recommends migrating to a supported Tomcat release—its current advisory page specifies Tomcat 9.0.x or later—and removing exposed Manager, Host Manager, example applications, and unnecessary AJP or WebDAV services during the transition.
Map this exposure pattern across your cloud, code, and identities.
41 events from the most recent confirmed update back to the earliest known activity.
CVE-2012-3439 was rejected because it duplicated CVE-2012-5885, CVE-2012-5886, and CVE-2012-5887. Its descriptions and references were removed to prevent accidental use.
The Apache Tomcat Project modified its Tomcat 5.x security-vulnerabilities documentation, primarily reformatting it and changing referenced Subversion links to HTTPS.
A CVE candidate identified as CVE-2012-3439 was assigned by Red Hat and published.
CVE-2012-0022 was published for inefficient request-parameter processing in Tomcat. Requests containing many parameters and values could consume excessive CPU and cause denial of service.
CVE-2011-3375 was published for improper caching and recycling of Tomcat request objects. Under opportunistic conditions, remote attackers could obtain IP-address and HTTP-header information from TCP data.
CVE-2011-5064 was published for a hard-coded, publicly known "Catalina" server secret in DigestAuthenticator.java, weakening Tomcat digest-authentication cryptographic protection.
CVE-2011-5063 was published for Tomcat's HTTP Digest Authentication implementation failing to check realm values, potentially allowing access-control bypass through a weaker protection space.
CVE-2011-1184 was published for missing replay-attack protections in Tomcat HTTP Digest Access Authentication, including improper server nonce and nonce-count validation.
CVE-2011-3190 was published for AJP connector request-body handling that could interpret a request body as a separate request, enabling AJP request spoofing, authentication bypass, and information disclosure.
CVE-2011-2729 was published for Linux jsvc failing to drop capabilities, permitting remote attackers to bypass file read-permission restrictions through an application request.
CVE-2011-2526 was published for unvalidated request attributes when sendfile was enabled on HTTP APR or NIO connectors. A local user leveraging an untrusted application could bypass file restrictions or crash the JVM.
CVE-2011-2204 was published for Tomcat's MemoryUserDatabase component logging passwords during JMX user-creation errors, exposing credentials to local users able to read the logs.
CVE-2011-0013 was published for multiple XSS vulnerabilities in Tomcat's HTML Manager Interface, including injection through a display-name tag.
CVE-2010-3718 was published for Tomcat under a Java SecurityManager failing to make a ServletContext attribute read-only. A local web application could read or write files outside its intended working directory.
CVE-2011-0534 was published for the NIO HTTP connector's failure to enforce maxHttpHeaderSize, allowing crafted requests to cause an OutOfMemoryError and denial of service.
Apache released Tomcat 7.0.8, addressing failure by the NIO HTTP connector to enforce maxHttpHeaderSize, which could permit a crafted request to cause an OutOfMemoryError denial of service.
CVE-2009-2902 was published for a directory-traversal flaw in WAR filenames that could let remote attackers delete files in Tomcat's work directory.
CVE-2009-2901 was published for Tomcat autodeployment with autoDeploy enabled. Residual appBase files left after a failed undeploy could be deployed and permit authentication bypass through HTTP requests.
CVE-2009-2693 was published for directory traversal in deployed WAR entries, allowing remote attackers to create or overwrite arbitrary files outside the intended deployment directory.
CVE-2009-3548 was published for Tomcat's Windows installer using a blank default administrative password, allowing remote attackers to gain elevated privileges.
CVE-2008-5515 was published for a RequestDispatcher path-normalization flaw that permitted traversal using dot-dot sequences and WEB-INF paths to bypass intended access restrictions.
CVE-2009-0783 was published for insufficient XML-parser isolation between Tomcat web applications. A local user could deploy an earlier-loading crafted application to read or modify other applications' configuration files.
CVE-2009-0033 was published for a denial-of-service flaw affecting Tomcat deployments using the Java AJP connector and mod_jk load balancing. Invalid headers could temporarily block errored connectors and cause an outage.
CVE-2009-0781 was published for an XSS issue in the Calendar example application's jsp/cal/cal2.jsp, where the time parameter could inject script or HTML.
CVE-2008-2938 was published for a Tomcat directory-traversal flaw affecting deployments with allowLinking and UTF-8 enabled; encoded URI traversal sequences could expose arbitrary files.
CVE-2008-2370 was published for RequestDispatcher path handling that normalized paths before removing query strings, allowing remote attackers to use dot-dot sequences in request parameters to read arbitrary files.
CVE-2008-1232 was published for an XSS flaw in Tomcat where a crafted message supplied to HttpServletResponse.sendError could inject script or HTML.
CVE-2008-1947 was published for an XSS vulnerability in the Tomcat Host Manager application's host-manager/html/add endpoint, exploitable through the name or hostname parameter.
CVE-2007-5333 was published for incomplete remediation of CVE-2007-3385. Tomcat's handling of double quotes and encoded backslashes in cookies could disclose session identifiers.
CVE-2007-6286 was published for Tomcat's native APR connector, where an unauthenticated attacker could send an empty request to an SSL port and cause processing of a duplicate recent request.
CVE-2008-0128 was published for Tomcat's SingleSignOn Valve failing to mark JSESSIONIDSSO cookies Secure during HTTPS sessions, allowing their exposure in HTTP traffic and possible session hijacking.
CVE-2007-5342 was published for an overly permissive default catalina.policy configuration in Tomcat's JULI logging component, enabling logging-configuration changes and arbitrary-file overwrites.
CVE-2007-5461 was published for an absolute path traversal flaw in Tomcat's WebDAV servlet. Under certain configurations, authenticated users could read arbitrary files through a WebDAV write request containing a SYSTEM tag.
CVE-2007-3385 was published for improper handling of a double-quote sequence in cookie values, which could disclose session IDs and enable session hijacking.
CVE-2007-3382 was published for Tomcat cookie handling that treated single quotes as delimiters, potentially exposing session identifiers to remote attackers.
CVE-2007-2450 was published for XSS vulnerabilities in Tomcat Manager and Host Manager applications, including injection through parameter names supplied to manager/html/upload.
CVE-2007-2449 was published for multiple XSS flaws in Tomcat example-application JSP files, exploitable through URI data after a semicolon.
CVE-2007-1355 was published for multiple XSS vulnerabilities in Tomcat's hello.jsp example application, including injection via the test parameter.
CVE-2007-1358 was published for an XSS flaw affecting certain applications using Tomcat 4.0.0–4.0.6 and 4.1.0–4.1.34; crafted non-RFC-compliant Accept-Language headers could inject script or HTML.
CVE-2005-4838 was published for multiple XSS vulnerabilities in example web applications shipped with Jakarta Tomcat 5.5.6 and earlier. Remote attackers could inject script or HTML through several JSP example endpoints, including el/functions.jsp and jspx/textRotate.jspx.
Red Hat released Red Hat Network Satellite Server 5.1.1, rated low security impact, to fix CVE-2008-2369 and vulnerabilities in mod_perl, JFreeChart, perl-Crypt-CBC, and bundled Apache Tomcat. CVE-2008-2369 involved a hard-coded XML-RPC authentication key that could expose limited Satellite Server user information to a reachable remote party.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
40 references tracked. Mallory keeps watching after this page renders.
rhn.redhat.com
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourcetomcat.apache.org
Open sourcecve.mitre.org
Open sourcelists.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Tomcat’s security documentation continues to catalogue numerous historical vulnerabilities in the end-of-life 4.0.x and 4.1.x branches, including information disclosure, denial of service, cross-site scripting, session hijacking, directory traversal, access-control bypass, and a Security Manager bypass. The flaws can expose JSP source, `WEB-INF` resources, prior-request data, session identifiers, and arbitrary files, or enable request-thread exhaustion and proxy-context bypasses. Apache will issue no further security fixes for Tomcat 4.x; some listed defects, including `CVE-2005-4836`, were explicitly not fixed in 4.1.x. The project notes that `CVE-2008-2938` stemmed from JVM UTF-8 URL-decoding behavior, with Tomcat 4.1.39 adding a workaround, and advises organizations still operating Tomcat 4.x to migrate to a supported release—currently Tomcat 9.0.x or later—to receive security updates.
Aug 29, 2026
Multiple legacy Apache Tomcat releases are affected by vulnerabilities including HTTP request smuggling (`CVE-2005-2090`), insecure default SSL cipher suites (`CVE-2007-1858`), and cross-site scripting in the bundled calendar example (`CVE-2006-7196`). The request-smuggling flaw affects Tomcat 5.0.19 with Coyote/1.1 and Tomcat 4.1.24 with Coyote/1.0 when conflicting `Transfer-Encoding: chunked` and `Content-Length` headers cause request-body data to be forwarded and interpreted as a separate downstream request. Affected SSL configurations in Tomcat 4.1.28–4.1.31, 5.0.0–5.0.30, and 5.5.0–5.5.17 permit anonymous and other insecure cipher suites, potentially exposing sensitive information. Separately, the `cal2.jsp` calendar example allows script injection through its `time` parameter in several Tomcat 4.x, 5.0.x, and 5.5.x releases. Organizations operating these obsolete versions should remove vulnerable example applications, disable weak SSL ciphers, and upgrade to supported Tomcat releases to mitigate cache poisoning, security-control bypass, data exposure, and XSS risks.
Aug 29, 2026
Apache Tomcat remediated a group of vulnerabilities affecting multiple supported release lines. **CVE-2026-55957** allows authentication bypass in `JNDIRealm` deployments that use GSSAPI-authenticated binds, while **CVE-2026-55956** can cause Default Servlet security constraints to incorrectly handle specified HTTP methods or method omissions. **CVE-2026-55955** permits replay attacks against the cluster-component `EncryptionInterceptor`, and **CVE-2026-43514** exposes a timing discrepancy in AJP secret comparison that may aid secret-value inference. Tomcat also corrected **CVE-2026-53434**, in which invalid certificate-revocation-list configuration for an FFM-based connector might not produce an error, and **CVE-2026-55276**, where effective `web.xml` logging could omit special roles and empty authorization constraints. Organizations should upgrade affected deployments to supported fixed releases: generally Tomcat **11.0.23**, **10.1.56**, or **9.0.119** for the June issues; the JNDIRealm authentication-bypass advisory specifies **11.0.5**, **10.1.37**, or **9.0.101**. Tomcat 8.0 and 8.5 are end of life and should be migrated to a supported branch rather than retained without security fixes.
Aug 28, 2026