Loading story…
Multiple legacy Apache Tomcat releases are affected by vulnerabilities including HTTP request smuggling (CVE-2005-2090), insecure default SSL cipher suites (CVE-2007-1858), and cross-site scripting in the bundled calendar example (CVE-2006-7196). The request-smuggling flaw affects Tomcat 5.0.19 with Coyote/1.1 and Tomcat 4.1.24 with Coyote/1.0 when conflicting Transfer-Encoding: chunked and Content-Length headers cause request-body data to be forwarded and interpreted as a separate downstream request.
Affected SSL configurations in Tomcat 4.1.28–4.1.31, 5.0.0–5.0.30, and 5.5.0–5.5.17 permit anonymous and other insecure cipher suites, potentially exposing sensitive information. Separately, the cal2.jsp calendar example allows script injection through its time parameter in several Tomcat 4.x, 5.0.x, and 5.5.x releases. Organizations operating these obsolete versions should remove vulnerable example applications, disable weak SSL ciphers, and upgrade to supported Tomcat releases to mitigate cache poisoning, security-control bypass, data exposure, and XSS risks.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2007-1858 was published for insecure default SSL cipher-suite configurations in Apache Tomcat. Affected releases enabled anonymous ciphers that could allow remote attackers to obtain sensitive information or cause other unspecified impacts.
CVE-2006-7196 was published for a cross-site scripting vulnerability in Apache Tomcat's calendar application example. Remote attackers could inject script or HTML through the time parameter supplied to cal2.jsp.
CVE-2005-2090 was published for an HTTP request-smuggling flaw affecting Jakarta Tomcat 5.0.19 with Coyote/1.1 and Tomcat 4.1.24 with Coyote/1.0. Requests containing both Transfer-Encoding: chunked and Content-Length headers could cause request-body data to be forwarded and interpreted as a separate request.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
5 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcecve.mitre.org
Open sourcecve.mitre.org
Open sourcesupport.avaya.com
Open sourcesupport.avaya.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Tomcat’s security documentation continues to catalogue numerous historical vulnerabilities in the end-of-life 4.0.x and 4.1.x branches, including information disclosure, denial of service, cross-site scripting, session hijacking, directory traversal, access-control bypass, and a Security Manager bypass. The flaws can expose JSP source, `WEB-INF` resources, prior-request data, session identifiers, and arbitrary files, or enable request-thread exhaustion and proxy-context bypasses. Apache will issue no further security fixes for Tomcat 4.x; some listed defects, including `CVE-2005-4836`, were explicitly not fixed in 4.1.x. The project notes that `CVE-2008-2938` stemmed from JVM UTF-8 URL-decoding behavior, with Tomcat 4.1.39 adding a workaround, and advises organizations still operating Tomcat 4.x to migrate to a supported release—currently Tomcat 9.0.x or later—to receive security updates.
Aug 29, 2026
Apache has warned that **Tomcat 5.0.x and 5.5.x are unsupported** and will receive no further security fixes; the final 5.5 branch fixes ended at 5.5.36. Its security index documents historical flaws spanning authentication bypass, session and information disclosure, arbitrary file access or overwrite, denial of service, cross-site scripting, privilege escalation, and insecure default credentials. Organizations running these releases remain exposed to any subsequently discovered defects and to known vulnerabilities where they have not applied the final available updates. High-impact historical issues include a blank Windows-installer administrator password (`CVE-2009-3548`), unsafe WAR deployment that can bypass authentication or overwrite files (`CVE-2009-2901`, `CVE-2009-2693`), AJP request spoofing (`CVE-2011-3190`), and HTTP Digest authentication weaknesses (`CVE-2011-1184`, `CVE-2011-5063`, `CVE-2011-5064`). Older deployments may also leak or expose session identifiers through cookie handling and insecure SSO cookies (`CVE-2007-3382`, `CVE-2008-0128`). Apache recommends migrating to a supported Tomcat release—its current advisory page specifies Tomcat 9.0.x or later—and removing exposed Manager, Host Manager, example applications, and unnecessary AJP or WebDAV services during the transition.
Aug 29, 2026
Apache Tomcat released security updates addressing several vulnerabilities across supported branches, including **CVE-2026-59083**, an incorrect URL decoding flaw in `RewriteValve` that can let attackers bypass security constraints in some configurations, and **CVE-2026-59084**, a documentation-related weakness that left `EncryptInterceptor` deployments without clearly defined secure configuration requirements. Apache said affected versions span Tomcat 11, 10.1, 9.0, and 8.5 releases, with some unsupported end-of-life versions potentially exposed as well. Separate Tomcat advisories also described additional patched issues, including **CVE-2026-53434**, an invalid CRL configuration vulnerability rated **CVSS 9.1**, **CVE-2026-50229**, a cross-site scripting flaw in the Number Guess example, and other fixes tracked as **CVE-2026-53404**, **CVE-2026-55276**, **CVE-2026-55955**, and **CVE-2026-55956**. Organizations were urged to test and deploy updated releases, with Apache recommending upgrades to **11.0.24**, **10.1.57**, and **9.0.120** to remediate the newly disclosed issues.
Aug 28, 2026