CVE-2026-50229
published 2026-06-29CVE-2026-50229: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects…
PriorityP345medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
2.57%
83.4th percentile
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | <= 7.0.109 | — |
| apache | tomcat | — | — |
| apache | tomcat | >= 10.1.0 < 10.1.56 | 10.1.56 |
| apache | tomcat | >= 11.0.0 < 11.0.23 | 11.0.23 |
| apache | tomcat | 8.5.0 – 8.5.100 | — |
| apache | tomcat | >= 9.0.0 < 9.0.119 | 9.0.119 |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.55 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.22 | — |
| apache_software_foundation | apache_tomcat | 7.0.0 – 7.0.109 | — |
| apache_software_foundation | apache_tomcat | 8.5.0 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.0.M1 – 9.0.118 | — |
| debian | tomcat11 | — | — |
| debian | tomcat9 | — | — |
| pki-deps_10.6 | pki-servlet-engine | — | — |
| ubuntu | tomcat8 | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_ubuntu9.1CRITICAL
vendor_redhat5.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2026-07-15·CVSS 9.1
CVE-2026-50229 [CRITICAL] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat incorrectly handled authorization when
multiple method constraints defined the same HTTP method. A remote
attacker could possibly use this issue to bypass authorization
restrictions. (CVE-2026-43515)
It was discovered that the Tomcat number guess example application did
not properly sanitize user-supplied input. An attacker could possibly
use this issue to inject malicious scripts, resulting in cross-site
scripting. (CVE-2026-50229)
It was discovered that Tomcat incorrectly evaluated rewrite valve
conditions in certain configurations. An attacker could possibly use
this issue to bypass rewrite rules, resulting in unauthorized access.
(CVE-2026-53404)
It was discovered tha
Red Hat
tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example
vendor_redhat·2026-06-29·CVSS 5.4
CVE-2026-50229 [MEDIUM] CWE-79 tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example
tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example
A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting (XSS), allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to unauthorized access to sensitive information or allow an attacker to alter the content of the website.
Statement: A flaw was found in Apache Tomcat. A Cross-Site Scripting (XSS) vulnerability exists in the "number guess" example web application shipped with Tomcat. An attacker can inject malicious scripts into the example page, which execute in other users' browsers when they view the page. This vulnerability only
VulDB
Apache Tomcat up to 11.0.22 cross site scripting (EUVD-2026-40226)
vuldb·2026-06-30
CVE-2026-50229 [LOW] Apache Tomcat up to 11.0.22 cross site scripting (EUVD-2026-40226)
A vulnerability described as problematic has been identified in Apache Tomcat up to 11.0.22. This issue affects some unknown processing. Such manipulation leads to basic cross site scripting.
This vulnerability is listed as CVE-2026-50229. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.
ghsa_unreviewed·2026-06-29
CVE-2026-50229 [MEDIUM] CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
No detection rules found.
Nuclei
Apache Tomcat - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2026-50229 [MEDIUM] Apache Tomcat - Cross-Site Scripting
Apache Tomcat - Cross-Site Scripting
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
Template:
id: CVE-2026-50229
info:
name: Apache Tomcat - Cross-Site Scripting
author: yshahinzadeh,amirmsafari
severity: medium
description: |
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apac
Bugzilla
CVE-2026-50229 tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example
bugzilla·2026-06-29
CVE-2026-50229 [MEDIUM] CVE-2026-50229 tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example
CVE-2026-50229 tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
Bugzilla
CVE-2026-50229 tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example [fedora-all]
bugzilla·2026-06-29
CVE-2026-50229 [MEDIUM] CVE-2026-50229 tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example [fedora-all]
CVE-2026-50229 tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.
2026-06-29
Published