Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-29T20:36:24 tomcat: Apache Tomcat: Cross-Site Scripting vulnerability in number guess example 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CWE-79

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

A flaw was found in Apache Tomcat. This vulnerability, known as Cross-Site Scripting (XSS), allows a remote attacker to inject malicious scripts into the 'number guess example' web page. When other users view the compromised page, these scripts can execute in their web browsers. This could lead to unauthorized access to sensitive information or allow an attacker to alter the content of the website.

A flaw was found in Apache Tomcat. A Cross-Site Scripting (XSS) vulnerability exists in the "number guess" example web application shipped with Tomcat. An attacker can inject malicious scripts into the example page, which execute in other users' browsers when they view the page. This vulnerability only affects the example web application, not the Tomcat servlet container itself. Red Hat Tomcat packages do not deploy example applications by default — they are in separate optional packages (e.g., tomcat-webapps) that are not installed in production environments. Remove or disable the Tomcat example web applications if they are deployed. Example applications are not needed for production use and should not be accessible in production environments. Red Hat Hardened Images 2026-06-29T00:00:00Z RHSA-2026:32960 tomcat11-main-11.0.23-0.1.hum1 Red Hat Enterprise Linux 10 Fix deferred tomcat Red Hat Enterprise Linux 10 Fix deferred tomcat9 Red Hat Enterprise Linux 6 Fix deferred tomcat6 Red Hat Enterprise Linux 7 Fix deferred tomcat Red Hat Enterprise Linux 8 Fix deferred pki-deps:10.6/pki-servlet-engine Red Hat Enterprise Linux 8 Fix deferred tomcat Red Hat Enterprise Linux 9 Fix deferred pki-servlet-engine Red Hat Enterprise Linux 9 Fix deferred tomcat Red Hat Hardened Images Not affected tomcat10 Red Hat JBoss Web Server 5 Fix deferred jws5-tomcat Red Hat JBoss Web Server 6 Not affected tomcat-websocket Red Hat JBoss Web Server 7 Not affected tomcat-websocket https://www.cve.org/CVERecord?id=CVE-2026-50229 https://nvd.nist.gov/vuln/detail/CVE-2026-50229 https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0