{"id":"CVE-2026-50229","kind":"vulnerability","aliases":["CVE-2026-50229","GHSA-pg42-rg8c-j886"],"related":[],"title":"Apache Tomcat has a Cross-site Scripting vulnerability","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.","summary":"The bundled number guess example page in Apache Tomcat does not neutralize script-related HTML tags, enabling cross-site scripting. An attacker can run script in a victim's browser when the page is opened with a crafted input.","severity":"medium","cvss":6.1,"epss":0.04091,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.tomcat:tomcat","fixed":["11.0.23"],"affected":">= 11.0.0-M1, < 11.0.23","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["10.1.56"],"affected":">= 10.1.0-M1, < 10.1.56","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["9.0.119"],"affected":">= 9.0.0.M1, < 9.0.119","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":[],"affected":"<= 7.0.109","ecosystem":"maven"},{"name":"apache tomcat","fixed":[],"affected":"<= 7.0.109","ecosystem":"vendor"},{"name":"apache tomcat","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["9.0.119"],"affected":">= 9.0.0, < 9.0.119","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["10.1.56"],"affected":">= 10.1.0, < 10.1.56","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["11.0.23"],"affected":">= 11.0.0, < 11.0.23","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["cwe-80","java","package","self-hosted","tomcat"],"not_affected_if":["examples-webapp-removed","managed-hosting"],"how_to_check":"- Check the Tomcat version with `catalina.sh version` or the `tomcat` Maven dependency version\n- Look for the example web app `examples/num_guess` under the Tomcat webapps directory\n- Confirm whether the examples webapp is deployed in production","fix":"- Apache Tomcat 11.x: upgrade to `11.0.23`\n- Apache Tomcat 10.1.x: upgrade to `10.1.56`\n- Apache Tomcat 9.0.x: upgrade to `9.0.119`\n- Versions 8.5.x and 7.0.x: unknown, no fixed version stated","status":"open","published_at":"2026-06-29T21:16:44+00:00","first_seen_at":"2026-11-04T16:49:52+00:00","triaged_at":"2026-11-04T16:51:23+00:00","updated_at":"2026-11-04T16:58:12+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T16:51:23Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Tomcat 11.x: upgrade to `11.0.23`\n- Apache Tomcat 10.1.x: upgrade to `10.1.56`\n- Apache Tomcat 9.0.x: upgrade to `9.0.119`\n- Versions 8.5.x and 7.0.x: unknown, no fixed version stated","reach":"internet","title":"Apache Tomcat: number guess example lets attackers inject script into pages","impact":"medium","summary":"The bundled number guess example page in Apache Tomcat does not neutralize script-related HTML tags, enabling cross-site scripting. An attacker can run script in a victim's browser when the page is opened with a crafted input.","audience":"businesses","category":"package","nicknames":[],"who_cares":["tomcat","java","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Script runs in a user's browser on the Tomcat site","analyst_note":"","how_to_check":"- Check the Tomcat version with `catalina.sh version` or the `tomcat` Maven dependency version\n- Look for the example web app `examples/num_guess` under the Tomcat webapps directory\n- Confirm whether the examples webapp is deployed in production","plain_action":"","needs_analyst":false,"not_affected_if":["examples-webapp-removed","managed-hosting"],"who_is_affected":"Only servers that run the bundled example web applications are exposed, since the flaw is in the number guess example page and not the core server. Production deployments that remove the examples webapp can skip it. Versions 8.5.x and 7.0.x have no stated fix in the sources.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4517,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,19A '-50229':12A,20A '-80':42B '10.1.0':124C '10.1.55':127C '10.1.56':161C '11.0.0':119C '11.0.22':122C '11.0.23':160C '7.0.0':138C '7.0.109':140C '8.5.0':134C '8.5.100':136C '9.0.0':129C '9.0.118':132C '9.0.119':163C 'affect':115C,152C 'also':150C 'apach':1A,56B,111C,116C 'apache':31A,33A,35A,37A,39A 'attack':72B 'basic':102C 'browser':80B 'bundl':50B 'craft':88B 'cross':6A,68B 'cross-sit':5A,67B 'cve':10A,18A 'cwe':41B 'enabl':66B 'end':146C 'exampl':53B,109C 'fix':165C 'ghsa':14A 'ghsa-pg42-rg8c-j886':13A 'guess':52B,108C 'host':47B 'html':64B,96C 'improp':90C 'input':89B 'issu':114C,167C 'j886':17A 'java':43B 'm1':120C,125C,130C 'may':149C 'neutral':60B,91C 'number':51B,107C 'open':85B 'org.apache.tomcat':21A,23A,25A,27A,29A 'packag':44B 'page':54B,83B,101C 'pg42':15A 'reach':145C 'recommend':155C 'relat':63B,95C 'rg8c':16A 'run':74B 'script':8A,62B,70B,75B,94C 'script-rel':61B,93C 'self':46B 'self-host':45B 'site':7A,69B 'support':148C 'tag':65B,97C 'tomcat':2A,22A,24A,26A,28A,30A,32A,34A,36A,38A,40A,48B,57B,112C,117C 'upgrad':157C 'user':153C 'version':142C,159C 'victim':78B 'vulner':9A,104C 'web':100C 'xss':103C","nicknames":[],"mitigations":[],"who_affected":"Only servers that run the bundled example web applications are exposed, since the flaw is in the number guess example page and not the core server. Production deployments that remove the examples webapp can skip it. Versions 8.5.x and 7.0.x have no stated fix in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apachetomcat","orgapachetomcattomcat","tomcat"],"ptokens":["apache","org","tomcat"],"labels":["cwe80","java","maven","medium","package","selfhosted","tomcat","vendor"],"campaign_type":null,"first_public_at":"2026-06-29T21:16:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-pg42-rg8c-j886","url":"https://github.com/advisories/GHSA-pg42-rg8c-j886","severity":"medium","published_at":"2026-06-29T21:32:15+00:00","modified_at":"2026-11-04T16:45:30+00:00","first_seen_at":"2026-11-04T16:49:52+00:00","fetched_at":"2026-11-04T16:55:01+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-50229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50229","severity":null,"published_at":"2026-06-29T21:16:44+00:00","modified_at":"2026-10-25T21:10:00+00:00","first_seen_at":"2026-11-04T16:58:12+00:00","fetched_at":"2026-11-04T16:58:12+00:00","note":null}],"documents":[{"id":68570,"url":"https://github.com/apache/tomcat/commit/0d5bdd5b0dd964e9f73e530b7d753462b9bfd1d0","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68571,"url":"https://github.com/apache/tomcat/commit/1fe95d841e9d461a16069974142d12c3ef68819a","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68572,"url":"https://github.com/apache/tomcat/commit/de5a950415fc67713f17fab63d0c7809e0fca80b","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68650,"url":"https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0","title":"Vendor advisory: lists.apache.org","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: lists.apache.org"},{"id":68651,"url":"http://www.openwall.com/lists/oss-security/2026/06/29/20","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}