ORG.APACHE.TOMCAT:TOMCAT · CVE-2026-50229 · Package
FIX → 11.0.23 · 10.1.56 · 9.0.119
The bundled number guess example page in Apache Tomcat does not neutralize script-related HTML tags, enabling cross-site scripting. An attacker can run script in a victim's browser when the page is opened with a crafted input.
first public Jun 29, 2026 · 1 source
Running Org.apache.tomcat:tomcat? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only servers that run the bundled example web applications are exposed, since the flaw is in the number guess example page and not the core server. Production deployments that remove the examples webapp can skip it. Versions 8.5.x and 7.0.x have no stated fix in the sources.
Not affected if examples-webapp-removed, managed-hosting
Who cares cwe-80, java, self-hosted, tomcat
catalina.sh version or the tomcat Maven dependency versionImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
examples/num_guess under the Tomcat webapps directoryUpgrade to 11.0.23 · 10.1.56 · 9.0.119
11.0.2310.1.569.0.119This page as .md · .json · in your agent: get_signal("CVE-2026-50229") · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.