Iniciar sesión
Deutsch English Español Polski
Baja

Apache Tomcat Vulnerable to Improper Resource Shutdown or Release

  • Publicada: 27.10.2025
  • Actualizado: 11.10.2026 13:20

If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Java / Kotlin (Maven) org.apache.tomcat.embed:tomcat-embed-core >= 11.0.0-M1, < 11.0.12, >= 10.1.0-M1, < 10.1.47, >= 9.0.0.M1, < 9.0.110, >= 8.5.0, <= 8.5.100 11.0.12, 10.1.47, 9.0.110
Java / Kotlin (Maven) org.apache.tomcat:tomcat >= 11.0.0-M1, < 11.0.12, >= 10.1.0-M1, < 10.1.47, >= 9.0.0.M1, < 9.0.110, >= 8.5.0, <= 8.5.100 11.0.12, 10.1.47, 9.0.110
Java / Kotlin (Maven) org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, < 11.0.12, >= 10.1.0-M1, < 10.1.47, >= 9.0.0.M1, < 9.0.110, >= 8.5.0, <= 8.5.100 11.0.12, 10.1.47, 9.0.110

Referencias

Puntuación CVSS 5.3/10
Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Debilidad (CWE)
CWE-404
Plataforma
Java / Kotlin (Maven)
Paquete
org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat, org.apache.tomcat:tomcat-catalina
Publicada
27.10.2025
Actualizado
11.10.2026 13:20

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-hgrr-935x-pq79 - CC BY 4.0

Historial de vulnerabilidades: org.apache.tomcat:tomcat

Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (162) en el archivo
Entradas en total
162
Primera → última
12.2018 08.2026
Sin corrección
20
Explotada en ataques
1

Distribución por gravedad

  • Crítica 8
  • Alta 40
  • Media 102
  • Baja 12

Divulgaciones por año

Gravedad:
  1. Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
    Crítica · 9.8 CVE-2026-65905 >= 11.0.0-M1, < 11.0.25, >= 10.1.0-M1, < 10.1.58, >= 9.0.0.M1, < 9.0.121, >= 8.5.0, <= 8.5.100, >= 7.0.30, <= 7.0.109 11.0.25, 10.1.58, 9.0.121
  2. Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
    Crítica · 9.1 CVE-2026-65182 >= 11.0.0-M1, < 11.0.25, >= 10.1.0-M1, < 10.1.58, >= 9.0.0-M1, < 9.0.121, >= 8.5.0, <= 8.5.100, >= 7.0.0, <= 7.0.109 11.0.25, 10.1.58, 9.0.121
  3. Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
    Crítica · 9.1 CVE-2026-68525 >= 11.0.0-M1, < 11.0.25, >= 10.1.0-M1, < 10.1.58, >= 9.0.0-M1, < 9.0.121, >= 8.5.0, <= 8.5.100, >= 7.0.0, <= 7.0.109 11.0.25, 10.1.58, 9.0.121
  4. Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
    Alta · 7.5 CVE-2026-41284 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  5. Apache Tomcat - Digest authenticator will authenticate any unknown user
    Crítica · 9.8 CVE-2026-43512 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  6. Apache Tomcat: LockOutRealm treats user names as case-sensitive
    Alta · 7.5 CVE-2026-43513 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  7. Apache Tomcat - Security constraints not correctly applied
    Crítica · 9.1 CVE-2026-43515 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  8. Apache Tomcat - WebSocket authentication header exposure
    Alta · 7.3 CVE-2026-42498 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  9. Apache Tomcat - HTTP/2 request headers not validated
    Crítica · 9.8 CVE-2026-41293 >= 8.5.0, < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  10. Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File
    Alta · 7.5 CVE-2026-34487 >= 9.0.13, < 9.0.117, >= 10.1.0-M1, < 10.1.54, >= 11.0.0-M1, < 11.0.21 9.0.117, 10.1.54, 11.0.21
  11. Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve
    Alta · 7.5 CVE-2026-34483 >= 9.0.40, < 9.0.116, >= 10.1.0-M1, < 10.1.54, >= 11.0.0-M1, < 11.0.21 9.0.116, 10.1.54, 11.0.21
  12. Apache Tomcat Missing Encryption of Sensitive Data vulnerability
    Alta · 7.5 Explotada en ataques CVE-2026-34486 >= 11.0.20, < 11.0.21, >= 10.1.53, < 10.1.54, >= 9.0.116, < 9.0.117 11.0.21, 10.1.54, 9.0.117
  13. Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor
    Alta · 7.5 CVE-2026-29146 >= 9.0.13, < 9.0.116, >= 10.1.50, < 10.1.53, >= 11.0.0-M1, < 11.0.20, >= 8.5.38, <= 8.5.100, >= 7.0.100, <= 7.0.109 9.0.116, 10.1.53, 11.0.20
  14. Apache Tomcat: CLIENT_CERT authentication does not fail as expected
    Crítica · 9.1 CVE-2026-29145 >= 9.0.83, < 9.0.116, >= 10.1.0-M7, < 10.1.53, >= 11.0.0-M1, < 11.0.20 9.0.116, 10.1.53, 11.0.20
  15. Apache Tomcat: Configured cipher preference order not preserved
    Alta · 7.5 CVE-2026-29129 >= 9.0.114, < 9.0.116, >= 10.1.51, < 10.1.53, >= 11.0.16, < 11.0.20 9.0.116, 10.1.53, 11.0.20
  16. Apache Tomcat Vulnerable to Relative Path Traversal
    Alta · 7.5 CVE-2025-55752 >= 11.0.0-M1, < 11.0.11, >= 10.1.0-M1, < 10.1.45, >= 9.0.0-M11, < 9.0.109, >= 8.5.6, <= 8.5.100 11.0.11, 10.1.45, 9.0.109
  17. Apache Tomcat Vulnerable to Improper Resource Shutdown or Release esta entrada
    Baja · 5.3 CVE-2025-61795 >= 11.0.0-M1, < 11.0.12, >= 10.1.0-M1, < 10.1.47, >= 9.0.0.M1, < 9.0.110, >= 8.5.0, <= 8.5.100 11.0.12, 10.1.47, 9.0.110
  18. Deserialization of Untrusted Data in Apache Tomcat
    Alta CVE-2013-2185 < 7.0.39 7.0.39
  19. Improper Neutralization of Input During Web Page Generation in Apache Tomcat
    Alta · 8.1 CVE-2015-5346 >= 9.0.0.M1, < 9.0.0.M2, >= 8.0.0.RC1, < 8.0.31, >= 7.0.0, < 7.0.66 9.0.0.M2, 8.0.31, 7.0.66
  20. Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token
    Alta · 8.8 CVE-2015-5351 < 7.0.68, >= 8.0.0, < 8.0.31, >= 9.0.0.M0, < 9.0.0.M2 7.0.68, 8.0.31, 9.0.0.M2
  21. Apache Tomcat does not enforce the maxHttpHeaderSize limit
    Alta · 7.5 CVE-2011-0534 >= 6.0.0, < 6.0.32, >= 7.0.0, < 7.0.8 6.0.32, 7.0.8
  22. Apache Tomcat Allows Remote Attackers to Spoof AJP Requests
    Alta CVE-2011-3190 >= 7.0.0, < 7.0.21, >= 6.0.0, < 6.0.34, >= 5.0.0, < 5.5.34 7.0.21, 6.0.34, 5.5.34
  23. Uncontrolled Resource Consumption in Apache Tomcat
    Alta CVE-2014-0230 >= 6.0.0, < 6.0.44, >= 7.0.0, < 7.0.55, >= 8.0.0, < 8.0.9 6.0.44, 7.0.55, 8.0.9
  24. Improper Access Control in Apache Tomcat
    Alta · 8.8 CVE-2016-0714 >= 9.0.0.M1, < 9.0.0.M2, >= 8.0.0.RC1, < 8.0.32, >= 7.0.0, < 7.0.70, >= 6.0.0, < 6.0.46 9.0.0.M2, 8.0.32, 7.0.70, 6.0.46
  25. Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
    Alta · 7.5 CVE-2016-6817 >= 9.0.0.M1, < 9.0.0.M12, >= 8.5.0, < 8.5.8 9.0.0.M12, 8.5.8
  26. Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
    Alta · 7.5 CVE-2017-5647 >= 9.0.0.M1, < 9.0.0.M19, >= 8.5.0, < 8.5.13, >= 8.0.0, < 8.0.43, >= 7.0.0, < 7.0.77, >= 6.0.0, < 6.0.53 9.0.0.M19, 8.5.13, 8.0.43, 7.0.77, 6.0.53
  27. Apache Tomcat allows remote attackers to read data that was intended to be associated with a different request
    Alta · 7.5 CVE-2016-8747 >= 8.5.7, < 8.5.10, >= 9.0.0.M11, < 9.0.0.M16 8.5.10, 9.0.0.M16
  28. Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
    Alta · 7.5 CVE-2017-7675 >= 9.0.0.M1, < 9.0.0.M22, >= 8.5.0, < 8.5.16 9.0.0.M22, 8.5.16
  29. Improper socket reuse in Apache Tomcat
    Alta · 8.6 CVE-2022-25762 >= 8.5.0, < 8.5.75, >= 9.0.0M1, < 9.0.20 8.5.75, 9.0.20
  30. Improper Handling of Exceptional Conditions in Apache Tomcat
    Alta · 7.5 CVE-2017-5664 >= 9.0.0.M1, < 9.0.0.M21, >= 8.5.0, < 8.5.15, >= 8.0.0, < 8.0.44, >= 7.0.0, < 7.0.78 9.0.0.M21, 8.5.15, 8.0.44, 7.0.78
  31. Improper Resource Shutdown or Release in Apache Tomcat
    Alta · 7.5 CVE-2017-5650 >= 9.0.0.M1, < 9.0.0.M19, >= 8.5.0, < 8.5.13 9.0.0.M19, 8.5.13
  32. Apache Tomcat vulnerable to SecurityManager bypass
    Alta · 7.5 CVE-2016-6796 >= 9.0.0.M1, < 9.0.0.M10, >= 8.5.0, < 8.5.5, >= 8.0.0.RC1, < 8.0.37, >= 7.0.0, < 7.0.71, >= 6.0.0, < 6.0.46 9.0.0.M10, 8.5.5, 8.0.37, 7.0.71, 6.0.46
  33. Incorrect Authorization in Apache Tomcat
    Alta · 7.5 CVE-2016-6797 >= 9.0.0.M1, < 9.0.0.M10, >= 8.5.0, < 8.5.5, >= 8.0.0, < 8.0.37, >= 7.0.0, < 7.0.72 9.0.0.M10, 8.5.5, 8.0.37, 7.0.72
  34. Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption
    Alta · 7.5 CVE-2022-29885 >= 10.1.0-M1, < 10.1.0-M15, >= 10.0.0-M1, < 10.0.21, >= 9.0.13, < 9.0.63, >= 8.5.38, < 8.5.79 10.1.0-M15, 10.0.21, 9.0.63, 8.5.79
  35. Apache Tomcat affected by vulnerability in TLS and SSL protocol
    Crítica · 9.8 CVE-2009-3555 >= 7.0.0, < 7.0.10, >= 6.0.0, < 6.0.32, >= 5.0.0, < 5.5.33 7.0.10, 6.0.32, 5.5.33
  36. Apache Tomcat Buffer Over-Read
    Alta CVE-2006-7197 <= 5.5.15 sin corrección
  37. Apache Tomcat allows remote attackers to read JSP source files
    Alta CVE-2005-4836 >= 4.1.15, <= 4.1.40 sin corrección
  38. Apache Tomcat Vulnerable to Denial of Service (DoS) via Simultaneous Requests
    Alta CVE-2005-3510 >= 5.5.0, < 5.5.12 5.5.12
  39. Apache Tomcat DoS via Malicious Get Request
    Alta CVE-2002-2272 >= 4.0.0, <= 4.1.12 sin corrección
  40. Apache Tomcat Source Code Disclosure
    Alta CVE-2002-1394 < 4.0.6 4.0.6
  41. Apache Tomcat may be started without proper security settings
    Alta CVE-2002-0493 < 4.0b7 4.0b7
  42. Uncontrolled Resource Consumption in Apache Tomcat
    Alta · 7.5 CVE-2020-11996 >= 10.0.0-M1, < 10.0.0-M5, >= 9.0.0.M1, < 9.0.35, >= 8.5.0, < 8.5.55 10.0.0-M5, 9.0.35, 8.5.55
  43. Infinite Loop in Apache Tomcat
    Alta · 7.5 CVE-2020-13935 >= 10.0.0-M1, < 10.0.0-M7, >= 9.0.0.M1, < 9.0.37, >= 8.5.0, < 8.5.57, >= 7.0.27, < 7.0.105 10.0.0-M7, 9.0.37, 8.5.57, 7.0.105
  44. Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
    Alta · 7.5 CVE-2020-13934 >= 10.0.0-M1, < 10.0.0-M6, >= 9.0.0.M5, < 9.0.36, >= 8.5.1, < 8.5.56 10.0.0-M6, 9.0.36, 8.5.56
  45. Race condition in Apache Tomcat
    Alta · 7.0 CVE-2022-23181 >= 10.0.0, < 10.0.16, >= 9.0.0, < 9.0.58, < 8.5.75 10.0.16, 9.0.58, 8.5.75
  46. Missing Release of Resource after Effective Lifetime in Apache Tomcat
    Alta · 7.5 CVE-2021-42340 >= 10.1.0-M1, < 10.1.0-M6, >= 10.0.0-M1, < 10.0.12, >= 9.0.40, < 9.0.54, >= 8.5.60, < 8.5.72 10.1.0-M6, 10.0.12, 9.0.54, 8.5.72
  47. Infinite loop in Tomcat due to parsing error
    Alta · 7.5 CVE-2021-41079 >= 10.0.0, < 10.0.4, >= 9.0.0, < 9.0.44, >= 8.5.0, < 8.5.64 10.0.4, 9.0.44, 8.5.64
  48. Improper Handling of Exceptional Conditions in Apache Tomcat
    Alta · 7.5 CVE-2021-30639 >= 10.0.3, < 10.0.5, >= 9.0.0, < 9.0.45, < 8.5.65 10.0.5, 9.0.45, 8.5.65
  49. Commons FileUpload Denial of service vulnerability
    Alta CVE-2014-0050 >= 8.0.0-RC1, < 8.0.3, >= 7.0.0, < 7.0.52 8.0.3, 7.0.52

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.