org.apache.tomcat.embed:tomcat-embed-core vulnerabilities
CVEs whose affected-version data names the org.apache.tomcat.embed:tomcat-embed-core package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-65637Critical· 9.8Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation
Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation
▾ Midnightapache · org.apache.tomcat:tomcat-coyoteEPSS 0.61%via GHSA
CVE-2023-46589High· 7.5Apache Tomcat Improper Input Validation vulnerability
Apache Tomcat Improper Input Validation vulnerability
▾ Twilightapache · org.apache.tomcat:tomcat-catalinaEPSS 2.7%via GHSA