Description
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Apache Tomcat | Apache Software Foundation / Apache Tomcat | >= 10.0.0-M1, <= 10.0.27 | unknown |
| Apache Tomcat | Apache Software Foundation / Apache Tomcat | >= 10.1.0-M1, <= 10.1.34 | affected |
| Apache Tomcat | Apache Software Foundation / Apache Tomcat | >= 11.0.0-M1, <= 11.0.2 | affected |
| Apache Tomcat | Apache Software Foundation / Apache Tomcat | >= 3, < 8.5.0 | unknown |
| Apache Tomcat | Apache Software Foundation / Apache Tomcat | >= 8.5.0, <= 8.5.100 | affected |
| Apache Tomcat | Apache Software Foundation / Apache Tomcat | >= 9.0.0.M1, <= 9.0.98 | affected |