Apache Software Foundation Vulnerabilities and Affected Products

Products

Apache Airflow148 vulnerabilities
Apache HTTP Server119 vulnerabilities
Apache Tomcat111 vulnerabilities
Apache Traffic Server95 vulnerabilities
Apache Superset65 vulnerabilities
Apache OFBiz51 vulnerabilities
Apache CXF45 vulnerabilities
Apache NiFi43 vulnerabilities
Apache Camel42 vulnerabilities
Apache ActiveMQ34 vulnerabilities
Apache CloudStack31 vulnerabilities
Apache DolphinScheduler31 vulnerabilities
Apache InLong31 vulnerabilities
Apache Thrift28 vulnerabilities
Apache OpenOffice26 vulnerabilities
Apache IoTDB25 vulnerabilities
Apache Zeppelin25 vulnerabilities
Apache Answer24 vulnerabilities
Apache Solr24 vulnerabilities
Apache Struts24 vulnerabilities
Apache APISIX23 vulnerabilities
Apache OpenMeetings23 vulnerabilities
Apache Ranger23 vulnerabilities
Apache JSPWiki22 vulnerabilities
Apache Fineract20 vulnerabilities

Apache Software Foundation vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-66299HIGH	Apache Tomcat: DoS via WebSocket chat example Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue. CWE-400Jul 28, 2026	CVSS7.5v3.1	EPSS0.451%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-59084CRITICAL	Apache Tomcat: EncryptInterceptor requirements not clearly documented Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which… CWE-1059Jul 14, 2026	CVSS9.1v3.1	EPSS0.506%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-59083CRITICAL	Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue. CWE-177Jul 14, 2026	CVSS9.1v3.1	EPSS0.37%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-55957HIGH	Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue. CWE-304Jun 29, 2026	CVSS7.3v3.1	EPSS2.86%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-55956MEDIUM	Apache Tomcat: Security constraints for default servlet ignored method Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0… CWE-285Jun 29, 2026	CVSS6.5v3.1	EPSS1.53%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-55955MEDIUM	Apache Tomcat: EncryptInterceptor not protected against replay attacks Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue. CWE-287Jun 29, 2026	CVSS6.5v3.1	EPSS0.467%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-55276CRITICAL	Apache Tomcat: Logged effective web.xml is incomplete Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which… CWE-670Jun 29, 2026	CVSS9.1v3.1	EPSS0.543%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-53434CRITICAL	Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue. CWE-390Jun 29, 2026	CVSS9.1v3.1	EPSS0.525%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-53404HIGH	Apache Tomcat: Bad ornext processing in RewriteValve Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which… CWE-670Jun 29, 2026	CVSS7.3v3.1	EPSS0.58%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-50229MEDIUM	Apache Tomcat: XSS in number guess example Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue. CWE-80Jun 29, 20261 related artifact	CVSS6.1v3.1	EPSS4.25%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2026-43515CRITICAL	Apache Tomcat: Security constraints not correctly applied Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue. CWE-285May 12, 2026	CVSS9.1v3.1	EPSS1.14%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-43514LOW	Apache Tomcat: AJP secret compared in non-constant time Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue. CWE-208May 12, 2026	CVSS3.7v3.1	EPSS0.352%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-43513HIGH	Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue. CWE-178May 12, 2026	CVSS7.5v3.1	EPSS0.467%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-43512CRITICAL	Apache Tomcat: Digest authenticator will authenticate any unknown user DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue. CWE-287 CWE-592May 12, 2026	CVSS9.8v3.1	EPSS1.23%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-41293CRITICAL	Apache Tomcat: HTTP/2 request headers not validated Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27. Older, end of support versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. CWE-20May 12, 2026	CVSS9.8v3.1	EPSS1.56%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-42498HIGH	Apache Tomcat: WebSocket authentication header exposure Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue. CWE-200May 12, 2026	CVSS7.3v3.1	EPSS0.6%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-41284HIGH	Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. CWE-770May 12, 2026	CVSS7.5v3.1	EPSS0.78%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-34500MEDIUM	Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue. CWE-287Apr 9, 2026	CVSS6.5v3.1	EPSS0.469%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-34487HIGH	Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.13 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue. CWE-532Apr 9, 2026	CVSS7.5v3.1	EPSS0.447%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-34486HIGH	Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue. CWE-311 CWE-807Apr 9, 20261 related artifact	CVSS7.5v3.1	EPSS82.9%	PoCs6	SignalsListed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2026-34483HIGH	Apache Tomcat: Incomplete escaping of JSON access logs Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue. CWE-116Apr 9, 2026	CVSS7.5v3.1	EPSS0.461%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-32990	Apache Tomcat: Fix for CVE-2025-66614 is incomplete Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue. CWE-20Apr 9, 2026	CVSS-v4.0	EPSS0.307%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-29146	Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue. CWE-1240 CWE-209 CWE-642Apr 9, 2026	CVSS-v4.0	EPSS6.26%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-29145CRITICAL	Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.… CWE-287Apr 9, 2026	CVSS9.1v3.1	EPSS0.715%	PoCs3	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-29129HIGH	Apache Tomcat: TLS cipher order is not preserved Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue. CWE-327Apr 9, 2026	CVSS7.5v3.1	EPSS0.259%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX