p PatchFirst

CVE-2026-50229

CVE-2026-50229 · Apache Tomcat: XSS in number guess example

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

CVSS 6.1 · Medium · EPSS 4.1% · Public exploit · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache tomcat

    Versions
    • ≥ 11.0.0-M1, ≤ 11.0.22: Affected (semver)
    • ≥ 10.1.0-M1, ≤ 10.1.55: Affected (semver)
    • ≥ 9.0.0.M1, ≤ 9.0.118: Affected (semver)
    • ≥ 8.5.0, ≤ 8.5.100: Affected (semver)
    • ≥ 7.0.0, ≤ 7.0.109: Affected (semver)
    • ≥ 0, < 7.0.0: Unknown (semver)

    No fix published

  • tomcat10 Debian:12

    Versions
    • 10.1.10-1
    • 10.1.13-1
    • 10.1.14-1
    • 10.1.15-1
    • 10.1.16-1
    • 10.1.20-1
    • 10.1.23-1
    • 10.1.25-1
    • 10.1.25-1~bpo12+1
    • 10.1.25-2
    • 10.1.30-1
    • 10.1.30-1~bpo12+1
    • 10.1.31-1
    • 10.1.33-1
    • 10.1.33-1~bpo12+1
    • 10.1.34-0+deb12u1
    • 10.1.34-0+deb12u2
    • 10.1.34-1
    • 10.1.35-1
    • 10.1.40-1
    • 10.1.40-1~bpo12+1
    • 10.1.46-1
    • 10.1.52-1
    • 10.1.52-1~deb12u1
    • 10.1.52-1~deb13u1
    • 10.1.52-2
    • 10.1.54-1
    • 10.1.55-1
    • 10.1.55-1~deb12u1
    • 10.1.55-1~deb13u1
    • 10.1.6-1
    • 10.1.6-1+deb12u1
    • 10.1.6-1+deb12u2
    • 10.1.60-1
    • 10.1.7-1
    • 10.1.8-1
    • 10.1.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Debian:13

    Versions
    • 10.1.40-1
    • 10.1.46-1
    • 10.1.52-1
    • 10.1.52-1~deb12u1
    • 10.1.52-1~deb13u1
    • 10.1.52-2
    • 10.1.54-1
    • 10.1.55-1
    • 10.1.55-1~deb12u1
    • 10.1.55-1~deb13u1
    • 10.1.60-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Debian:14

    Versions
    • 10.1.40-1
    • 10.1.46-1
    • 10.1.52-1
    • 10.1.52-1~deb12u1
    • 10.1.52-1~deb13u1
    • 10.1.52-2
    • 10.1.54-1
    • 10.1.55-1
    • 10.1.55-1~deb12u1
    • 10.1.55-1~deb13u1
    Affected ranges
    • ECOSYSTEM: < 10.1.60-1

    Update to 10.1.60-1

  • tomcat11 Debian:13

    Versions
    • 11.0.11-1
    • 11.0.15-1
    • 11.0.15-1~deb13u1
    • 11.0.18-1
    • 11.0.21-1
    • 11.0.22-1
    • 11.0.22-1~deb13u1
    • 11.0.22-2
    • 11.0.24-1
    • 11.0.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat11 Debian:14

    Versions
    • 11.0.11-1
    • 11.0.15-1
    • 11.0.15-1~deb13u1
    • 11.0.18-1
    • 11.0.21-1
    • 11.0.22-1
    • 11.0.22-1~deb13u1
    • 11.0.22-2
    • 11.0.6-1
    Affected ranges
    • ECOSYSTEM: < 11.0.24-1

    Update to 11.0.24-1

  • tomcat9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.0.70-2

    Update to 9.0.70-2

  • tomcat6 Ubuntu:Pro:14.04:LTS

    Versions
    • 6.0.37-1
    • 6.0.39-1
    • 6.0.39-1ubuntu0.1
    • 6.0.39-1ubuntu0.1+esm1
    • 6.0.39-1ubuntu0.1+esm2
    • 6.0.39-1ubuntu0.1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat7 Ubuntu:Pro:14.04:LTS

    Versions
    • 7.0.42-1
    • 7.0.47-1
    • 7.0.50-1
    • 7.0.52-1
    • 7.0.52-1ubuntu0.1
    • 7.0.52-1ubuntu0.3
    • 7.0.52-1ubuntu0.6
    • 7.0.52-1ubuntu0.7
    • 7.0.52-1ubuntu0.8
    • 7.0.52-1ubuntu0.9
    • 7.0.52-1ubuntu0.10
    • 7.0.52-1ubuntu0.11
    • 7.0.52-1ubuntu0.13
    • 7.0.52-1ubuntu0.14
    • 7.0.52-1ubuntu0.15
    • 7.0.52-1ubuntu0.16
    • 7.0.52-1ubuntu0.16+esm1
    • 7.0.52-1ubuntu0.16+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat8 Ubuntu:Pro:16.04:LTS

    Versions
    • 8.0.26-1
    • 8.0.28-1
    • 8.0.30-1
    • 8.0.32-1
    • 8.0.32-1ubuntu1
    • 8.0.32-1ubuntu1.1
    • 8.0.32-1ubuntu1.2
    • 8.0.32-1ubuntu1.3
    • 8.0.32-1ubuntu1.4
    • 8.0.32-1ubuntu1.5
    • 8.0.32-1ubuntu1.6
    • 8.0.32-1ubuntu1.7
    • 8.0.32-1ubuntu1.8
    • 8.0.32-1ubuntu1.9
    • 8.0.32-1ubuntu1.10
    • 8.0.32-1ubuntu1.11
    • 8.0.32-1ubuntu1.13
    • 8.0.32-1ubuntu1.13+esm1
    Affected ranges
    • ECOSYSTEM: < 8.0.32-1ubuntu1.13+esm2

    Update to 8.0.32-1ubuntu1.13+esm2

  • tomcat7 Ubuntu:Pro:16.04:LTS

    Versions
    • 7.0.64-1
    • 7.0.68-1
    • 7.0.68-1ubuntu0.1
    • 7.0.68-1ubuntu0.3
    • 7.0.68-1ubuntu0.4
    • 7.0.68-1ubuntu0.4+esm1
    • 7.0.68-1ubuntu0.4+esm2
    • 7.0.68-1ubuntu0.4+esm3
    • 7.0.68-1ubuntu0.4+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat8 Ubuntu:Pro:18.04:LTS

    Versions
    • 8.5.21-1ubuntu1
    • 8.5.29-1
    • 8.5.30-1
    • 8.5.30-1ubuntu1
    • 8.5.30-1ubuntu1.2
    • 8.5.30-1ubuntu1.3
    • 8.5.30-1ubuntu1.4
    • 8.5.39-1ubuntu1~18.04.1
    • 8.5.39-1ubuntu1~18.04.2
    • 8.5.39-1ubuntu1~18.04.3
    • 8.5.39-1ubuntu1~18.04.3+esm1
    • 8.5.39-1ubuntu1~18.04.3+esm2
    • 8.5.39-1ubuntu1~18.04.3+esm3
    • 8.5.39-1ubuntu1~18.04.3+esm4
    • 8.5.39-1ubuntu1~18.04.3+esm5
    Affected ranges
    • ECOSYSTEM: < 8.5.39-1ubuntu1~18.04.3+esm6

    Update to 8.5.39-1ubuntu1~18.04.3+esm6

  • tomcat9 Ubuntu:Pro:18.04:LTS

    Versions
    • 9.0.16-3~18.04.1
    • 9.0.16-3ubuntu0.18.04.1
    • 9.0.16-3ubuntu0.18.04.2
    • 9.0.16-3ubuntu0.18.04.2+esm1
    • 9.0.16-3ubuntu0.18.04.2+esm2
    • 9.0.16-3ubuntu0.18.04.2+esm3
    • 9.0.16-3ubuntu0.18.04.2+esm4
    • 9.0.16-3ubuntu0.18.04.2+esm5
    • 9.0.16-3ubuntu0.18.04.2+esm6
    • 9.0.16-3ubuntu0.18.04.2+esm7
    • 9.0.16-3ubuntu0.18.04.2+esm8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:Pro:20.04:LTS

    Versions
    • 9.0.24-1
    • 9.0.27-1
    • 9.0.31-1
    • 9.0.31-1ubuntu0.1
    • 9.0.31-1ubuntu0.2
    • 9.0.31-1ubuntu0.3
    • 9.0.31-1ubuntu0.4
    • 9.0.31-1ubuntu0.5
    • 9.0.31-1ubuntu0.6
    • 9.0.31-1ubuntu0.7
    • 9.0.31-1ubuntu0.8
    • 9.0.31-1ubuntu0.9
    • 9.0.31-1ubuntu0.9+esm1
    • 9.0.31-1ubuntu0.9+esm2
    • 9.0.31-1ubuntu0.9+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:Pro:22.04:LTS

    Versions
    • 9.0.43-3
    • 9.0.54-1
    • 9.0.55-1
    • 9.0.58-1
    • 9.0.58-1ubuntu0.1
    • 9.0.58-1ubuntu0.1+esm1
    • 9.0.58-1ubuntu0.1+esm2
    • 9.0.58-1ubuntu0.1+esm3
    • 9.0.58-1ubuntu0.1+esm4
    • 9.0.58-1ubuntu0.2
    • 9.0.58-1ubuntu0.2+esm1
    • 9.0.58-1ubuntu0.2+esm2
    • 9.0.58-1ubuntu0.2+esm3
    • 9.0.58-1ubuntu0.2+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Ubuntu:24.04:LTS

    Versions
    • 10.1.10-1
    • 10.1.14-1
    • 10.1.15-1
    • 10.1.16-1
    • 10.1.16-1ubuntu0.1~esm1
    • 10.1.16-1ubuntu0.1~esm2
    • 10.1.16-1ubuntu0.1~esm3
    • 10.1.16-1ubuntu0.1~esm4
    • 10.1.55-1ubuntu2~24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:24.04:LTS

    Versions
    • 9.0.70-1ubuntu1
    • 9.0.70-2
    • 9.0.70-2ubuntu0.1
    • 9.0.70-2ubuntu0.1+esm1
    • 9.0.70-2ubuntu0.1+esm2
    • 9.0.70-2ubuntu0.1+esm3
    • 9.0.118-1~24.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Ubuntu:25.10

    Versions
    • 10.1.35-1
    • 10.1.40-1
    • 10.1.40-1ubuntu1
    • 10.1.40-1ubuntu1.25.10.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat11 Ubuntu:25.10

    Versions
    • 11.0.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat9 Ubuntu:25.10

    Versions
    • 9.0.70-2ubuntu1.1
    • 9.0.70-2ubuntu2
    • 9.0.70-2ubuntu3
    • 9.0.95-1ubuntu1
    • 9.0.95-1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat10 Ubuntu:26.10

    Versions
    • 10.1.40-1ubuntu1
    • 10.1.54-1
    • 10.1.54-1ubuntu1
    • 10.1.54-1ubuntu2
    • 10.1.55-1ubuntu1
    • 10.1.55-1ubuntu2
    • 10.1.57~us1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • tomcat11 Ubuntu:26.10

    Versions
    • 11.0.18-1
    • 11.0.22-2
    • 11.0.22-2ubuntu1
    • 11.0.22-2ubuntu2
    • 11.0.24-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →