---
id: "CVE-2026-50229"
kind: "vulnerability"
aliases: ["CVE-2026-50229", "GHSA-pg42-rg8c-j886"]
title: "Apache Tomcat has a Cross-site Scripting vulnerability"
severity: "medium"
cvss: 6.1
epss: 0.04091
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.tomcat:tomcat", "fixed": ["11.0.23"], "affected": ">= 11.0.0-M1, < 11.0.23", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["10.1.56"], "affected": ">= 10.1.0-M1, < 10.1.56", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["9.0.119"], "affected": ">= 9.0.0.M1, < 9.0.119", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": [], "affected": "<= 7.0.109", "ecosystem": "maven"}, {"name": "apache tomcat", "fixed": [], "affected": "<= 7.0.109", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["9.0.119"], "affected": ">= 9.0.0, < 9.0.119", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["10.1.56"], "affected": ">= 10.1.0, < 10.1.56", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["11.0.23"], "affected": ">= 11.0.0, < 11.0.23", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["cwe-80", "java", "package", "self-hosted", "tomcat"]
not_affected_if: ["examples-webapp-removed", "managed-hosting"]
published_at: "2026-06-29T21:16:44+00:00"
first_seen_at: "2026-11-04T16:49:52+00:00"
updated_at: "2026-11-04T16:58:12+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-pg42-rg8c-j886", "first_seen_at": "2026-11-04T16:49:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50229", "first_seen_at": "2026-11-04T16:58:12+00:00"}]
---

# Apache Tomcat has a Cross-site Scripting vulnerability

The bundled number guess example page in Apache Tomcat does not neutralize script-related HTML tags, enabling cross-site scripting. An attacker can run script in a victim's browser when the page is opened with a crafted input.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.tomcat:tomcat affected >= 11.0.0-M1, < 11.0.23 fixed 11.0.23
- maven:org.apache.tomcat:tomcat affected >= 10.1.0-M1, < 10.1.56 fixed 10.1.56
- maven:org.apache.tomcat:tomcat affected >= 9.0.0.M1, < 9.0.119 fixed 9.0.119
- maven:org.apache.tomcat:tomcat affected >= 8.5.0, <= 8.5.100 fixed ?
- maven:org.apache.tomcat:tomcat affected <= 7.0.109 fixed ?
- vendor:apache tomcat affected <= 7.0.109 fixed ?
- vendor:apache tomcat affected >= 8.5.0, <= 8.5.100 fixed ?
- vendor:apache tomcat affected >= 9.0.0, < 9.0.119 fixed 9.0.119
- vendor:apache tomcat affected >= 10.1.0, < 10.1.56 fixed 10.1.56
- vendor:apache tomcat affected >= 11.0.0, < 11.0.23 fixed 11.0.23

## How to check

- Check the Tomcat version with `catalina.sh version` or the `tomcat` Maven dependency version
- Look for the example web app `examples/num_guess` under the Tomcat webapps directory
- Confirm whether the examples webapp is deployed in production

## Fix

- Apache Tomcat 11.x: upgrade to `11.0.23`
- Apache Tomcat 10.1.x: upgrade to `10.1.56`
- Apache Tomcat 9.0.x: upgrade to `9.0.119`
- Versions 8.5.x and 7.0.x: unknown, no fixed version stated

## Timeline

- 2026-11-04T16:49:52+00:00 ghsa https://github.com/advisories/GHSA-pg42-rg8c-j886
- 2026-11-04T16:58:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-50229

## Documents

- [advisory] Vendor advisory: lists.apache.org https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0
- [advisory] Third-party advisory: www.openwall.com http://www.openwall.com/lists/oss-security/2026/06/29/20
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/0d5bdd5b0dd964e9f73e530b7d753462b9bfd1d0
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/1fe95d841e9d461a16069974142d12c3ef68819a
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/de5a950415fc67713f17fab63d0c7809e0fca80b

## From the sources

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_