Org.apache.tomcat:tomcat-catalina
30 CVEs tracked. 3 of them are in CISA KEV.
This hub aggregates every CVE we track for Org.apache.tomcat:tomcat-catalina, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Org.apache.tomcat:tomcat-catalina CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 1 |
| 2024-12 | 2 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 1 |
| 2025-04 | 1 |
| 2025-05 | 1 |
| 2025-06 | 3 |
| 2025-07 | 1 |
| 2025-08 | 1 |
| 2025-09 | 0 |
| 2025-10 | 3 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 30 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical8
- High13
- Medium9
Latest CVEs
The 15 most recently published vulnerabilities affecting Org.apache.tomcat:tomcat-catalina.
- CVE-2025-61795Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS5.3
- CVE-2025-55752Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled7.5
- CVE-2025-55754Apache Tomcat: console manipulation via escape sequences in log messages9.6
- CVE-2025-55668Apache Tomcat: session fixation via rewrite valve6.5
- CVE-2025-52520Apache Tomcat: DoS via integer overflow in multipart file upload7.5
- CVE-2025-49124Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows8.4
- CVE-2025-49125Apache Tomcat: Security constraint bypass for pre/post-resources7.5
- CVE-2025-48988Apache Tomcat: FileUpload large number of parts with headers DoS7.5
- CVE-2025-46701Apache Tomcat: Security constraint bypass for CGI scripts7.3
- CVE-2025-31651Apache Tomcat: Bypass of rules in Rewrite Valve9.8
- CVE-2025-24813Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT9.8
- CVE-2024-56337Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete9.8
- CVE-2024-50379Apache Tomcat: RCE due to TOCTOU issue in JSP compilation9.8
- CVE-2024-52316Apache Tomcat: Authentication bypass when using Jakarta Authentication API9.8
- CVE-2023-46589Apache Tomcat: HTTP request smuggling via malformed trailer headers7.5
Product grouping is registry-driven, with AI assist and human review. How it works