PatchTheCVEApache Tomcat vulnerabilities and fixes
CVEs that mention Apache Tomcat, ranked by priority. 2 tracked.
Apache Tomcat has 2 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-07-28. Highest priority: CVE-2026-66713 (score 67/100).
- CVE-2026-66713 CRITICAL 9.8 UPGRADE Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Fou
- CVE-2026-66299 MEDIUM 5.3 UPGRADE Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects
FAQ
How do I fix Apache Tomcat vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is Apache Tomcat being exploited right now?
None of the tracked Apache Tomcat CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which Apache Tomcat CVE should I patch first?
CVE-2026-66713 currently ranks highest (67/100): Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Fou.
Newest Apache Tomcat CVEs
- CVE-2026-66713 CRITICAL 9.8 2026-07-28: Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in
- CVE-2026-66299 MEDIUM 5.3 2026-07-28: Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.