Apache Tomcat AJP Connector Information Leak

Uncontrolled Resource Consumption in Apache Tomcat

Apache Tomcat DoS via Malicious Get Request

Apache Tomcat has an Improper Input Validation vulnerability

Improper socket reuse in Apache Tomcat

Jenkins secure flag not set on session cookies

Apache Tomcat - Fix for CVE-2023-24998 was incomplete

The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.

Apache Tomcat: CLIENT_CERT authentication does not fail as expected

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.

Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability

Jenkins HttpOnly flag not Set for session cookies

Apache Tomcat Missing Encryption of Sensitive Data vulnerability

Infinite loop in Tomcat due to parsing error

Apache Tomcat Directory Traversal

The host name verification missing in Apache Tomcat

The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.

Information Disclosure in Apache Tomcat

ELSA-2026-26323: tomcat security update (IMPORTANT)

ELSA-2026-25341: tomcat9 update (IMPORTANT)