PT-2026-40069 · Apache · Apache Tomcat

Dawit Jeong · Published 2026-05-12 · Updated 2026-06-01 · CVE-2026-41293

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.21 Apache Tomcat versions 10.1.0-M1 through 10.1.54 Apache Tomcat versions 9.0.0.M1 through 9.0.117 Apache Tomcat versions 10.0.0-M1 through 10.0.27

Description Improper Input Validation occurs in Apache Tomcat, which can lead to security issues when the software fails to properly validate input data.

Recommendations Upgrade to version [FIXED VERSION].

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-TOMCAT-2026-41293

CVE-2026-41293

GHSA-R29C-68GH-XP6X

OESA-2026-2296

OPENSUSE-SU-2026:10925-1

OPENSUSE-SU-2026:10926-1

OPENSUSE-SU-2026:10927-1

Affected Products

Apache Tomcat

References · 42

• https://nvd.nist.gov/vuln/detail/CVE-2026-43512 · Security Note
• https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41293 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41293 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10927-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r29c-68gh-xp6x · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41293 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41293 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41293 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tomcat-2026-41293 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42498 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43513 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-43514 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10926-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41284 · Security Note