CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
[Impact] Incomplete fix for CVE-2026-29146 allows attackers to bypass the EncryptInterceptor, leading to the transmission of sensitive session data in plaintext across the network
[Mitigation] Immediately upgrade to patched Apache Tomcat versions 11.0.21, 10.1.54, or 9.0.117
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing EncryptInterceptor with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
[Impact] Remote attackers can intercept encrypted cluster traffic and perform a padding oracle attack to decrypt sensitive session data or cluster control messages without knowing the encryption key.
[Mitigation] Upgrade to fixed versions (11.0.19, 10.1.53, or 9.0.116) immediately, or configure the EncryptInterceptor to use secure authenticated encryption (e.g., GCM mode).
Apache Tomcat Default Servlet Path Equivalence Vulnerability Leading to Remote Code Execution and Information Disclosure (CVE-2025-24813)
[Affected Scope] Apache Tomcat versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, 9.0.0.M1 through 9.0.98, and EOL 8.5.0 through 8.5.100.
[Impact] Attackers can bypass path validation via internal dot path equivalence, allowing them to inject malicious content into sensitive files or trigger remote code execution (RCE) via session deserialization.
[Mitigation] Immediately upgrade to patched versions (11.0.3, 10.1.35, or 9.0.99) and ensure the Default Servlet's 'readonly' parameter is set to 'true'.
Apache Tomcat JmxRemoteLifecycleListener Deserialization Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2016-8735)
[Affected Scope] Apache Tomcat versions before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12, when JmxRemoteLifecycleListener is enabled
[Impact] Remote attackers with network access to JMX ports can trigger untrusted deserialization without authentication, leading to arbitrary Remote Code Execution (RCE) with system privileges
[Mitigation] Upgrade Apache Tomcat to the latest secure release, or disable JmxRemoteLifecycleListener in server.xml and restrict network access to JMX ports using firewalls