The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 5.5.27Upgrade Apache Tomcat to 4.1.39Upgrade Apache Tomcat to 6.0.18 | May 17, 2012 | Aug 4, 2008 |
| Apple Osx Tomcat | — | Apply OS X security update 2008-007 | Dec 16, 2011 | Aug 3, 2008 |
| Centos_linux | — | Upgrade tomcat5Upgrade tomcat5-servlet-2.4-apiUpgrade tomcat5-jasperUpgrade tomcat5-jasper-javadocUpgrade tomcat5-admin-webappsUpgrade tomcat5-server-libUpgrade tomcat5-webappsUpgrade tomcat5-common-libUpgrade tomcat5-jsp-2.0-apiUpgrade tomcat5-servlet-2.4-api-javadocUpgrade tomcat5-jsp-2.0-api-javadoc | Dec 1, 2016 | Aug 3, 2008 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 25, 2013 |
| Oracle_linux | — | Upgrade tomcat5-server-libUpgrade tomcat5-jasper-javadocUpgrade tomcat5-common-libUpgrade tomcat5-jasperUpgrade tomcat5-jsp-2.0-apiUpgrade tomcat5Upgrade tomcat5-servlet-2.4-apiUpgrade tomcat5-admin-webappsUpgrade tomcat5-jsp-2.0-api-javadocUpgrade tomcat5-servlet-2.4-api-javadocUpgrade tomcat5-webapps | Oct 16, 2024 | Aug 4, 2008 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 1, 2008 |
| Suse | — | Upgrade tomcat6-docs-webappUpgrade tomcat6-javadocUpgrade tomcat6-libUpgrade tomcat6-jsp-2_1-apiUpgrade tomcat6-admin-webappsUpgrade tomcat6-servlet-2_5-apiUpgrade tomcat6Upgrade tomcat6-webapps | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade tomcat5.5 | Nov 19, 2024 | Aug 4, 2008 |
| Vmsa 2009 0002 | — | Upgrade VMware ESX 3.5 to build number 199239 | Dec 17, 2012 | Aug 3, 2008 |
| Vmsa 2009 0016 5 Update Apache Tomcat Version | — | Upgrade VMware ESX 4.0 to build number 208167Upgrade VMware ESX 3.5 to build number 226117 | Sep 2, 2010 | Aug 4, 2008 |
| Vmsa 2010 0005 | — | Apply ESX350-201003403-SG. | Feb 16, 2011 | Aug 4, 2008 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub