Loading vulnerability…
Cross-Site Scripting in Apache Tomcat Number Guess Example
CVE-2026-50229 is a cross-site scripting vulnerability in Apache Tomcat's Number Guess example application. Improper neutralization of script-related HTML tags allows attacker-controlled input to be reflected into an HTML response and executed in a victim's browser. The affected example uses NumberGuessBean with wildcard property binding. Affected releases are 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. Other end-of-support versions may also be affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation executes attacker-controlled JavaScript in a victim's browser within the origin serving the vulnerable example. This can enable access to browser-readable information and modification of displayed content within that origin's security boundaries. The vulnerability does not establish server-side code execution or operating-system privilege escalation.
If you can’t patch tonight, do this now.
If upgrading is delayed, remove or disable the Number Guess example application, or block access to it. Restricting access to the examples application reduces exposure but does not correct the underlying input-neutralization flaw.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.23, 10.1.56, or 9.0.119, or a later fixed release in the corresponding branch. Migrate affected 7.0.x, 8.5.x, and other unsupported deployments to a supported, fixed release.
1 exploit validated by Mallory's analysis. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.