Exposición de Apache Tomcat

Web servers
431
score de exposición
14.239
sitios usan
6
en explotación
27
críticos
Análisis Vexday

Apache Tomcat acumula 131 CVEs catalogadas, das quais 5 estão confirmadas em exploração ativa pelo CISA KEV — representando uma taxa 8,5 vezes acima da média geral do catálogo, sinal claro de que vulnerabilidades nessa tecnologia atraem atenção consistente de agentes maliciosos. O tipo de falha mais recorrente é CWE-20 (validação de entrada imprópria), que historicamente viabiliza desde execução remota de código até desvios de controle de acesso. A CVE mais crítica atualmente ativa, CVE-2017-12617, apresenta EPSS de 0,9999 — praticamente a pontuação máxima de probabilidade de exploração —, exigindo atenção prioritária em qualquer ambiente que ainda execute versões vulneráveis. Os 17 novos registros surgidos nos últimos 90 dias, somados às 19 CVEs de severidade crítica, indicam uma superfície de ataque que segue crescendo e que demanda ciclos de patching frequentes e monitoramento contínuo.

CVEs

151 resultados
CVE-2026-43515CRITICALApache Tomcat: Security constraints not correctly appliedEPSS 1.2%CVE-2019-12418—When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacEPSS 1.2%CVE-2025-61795MEDIUMApache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoSEPSS 1.2%CVE-2023-34981HIGHApache Tomcat: AJP response header mix-upEPSS 1.1%CVE-2025-55668MEDIUMApache Tomcat: session fixation via rewrite valveEPSS 0.9%CVE-2026-41284HIGHApache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handlingEPSS 0.8%CVE-2026-68763HIGHApache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is resetEPSS 0.8%CVE-2026-65927HIGHApache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access controlEPSS 0.8%CVE-2026-65905CRITICALApache Tomcat: Limited replay attack possible with DIGEST authenticationEPSS 0.8%CVE-2026-65637CRITICALApache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteEPSS 0.8%CVE-2026-29145CRITICALApache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabledEPSS 0.7%CVE-2022-23181—Local privilege escalation with FileStoreEPSS 0.7%CVE-2026-42498HIGHApache Tomcat: WebSocket authentication header exposureEPSS 0.6%CVE-2026-68525CRITICALApache Tomcat: Redirect after FORM auth may bypass method specific constraintsEPSS 0.6%CVE-2026-53404HIGHApache Tomcat: Bad ornext processing in RewriteValveEPSS 0.6%CVE-2026-65182CRITICALApache Tomcat: Bypass longest prefix security constraintEPSS 0.6%CVE-2026-53434CRITICALApache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM ConnectorEPSS 0.6%CVE-2026-66422HIGHApache Tomcat: Servlet role references can bypass declarative role constraintsEPSS 0.6%CVE-2026-55276CRITICALApache Tomcat: Logged effective web.xml is incompleteEPSS 0.6%CVE-2026-73180MEDIUMApache Tomcat: Authenticated WebSocket session survives end of HTTP sessionEPSS 0.5%