Patchfirst
Patchfirst
ChainApache TomcatMaven:org.apache.tomcat:tomcat-catalina

Apache Tomcat: incomplete fixes (2008–2025)

10 CVEs over 6 generations, 13 Aug 2008 to 27 Oct 2025.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2008-293813 Aug 2008 First in the chain
  2. CVE-2015-534625 Feb 2016 related to CVE-2008-2938
  3. CVE-2023-2499820 Feb 2023 No direct link to an earlier CVE
  4. CVE-2023-2870922 May 2023 incomplete fix for CVE-2023-24998
  5. CVE-2023-4279510 Oct 2023 related to CVE-2015-5346
  6. CVE-2023-4658928 Nov 2023 related to CVE-2023-42795related to CVE-2015-5346and 2 more
  7. CVE-2025-3165128 Apr 2025 related to CVE-2008-2938related to CVE-2015-5346
  8. CVE-2025-5252010 Jul 2025 related to CVE-2023-24998related to CVE-2023-46589
  9. CVE-2025-5575227 Oct 2025 related to CVE-2025-31651next fix after CVE-2025-52520
  10. CVE-2025-6179527 Oct 2025 related to CVE-2023-24998related to CVE-2023-46589and 2 more
200820112013201620182020202320242025 CVE-2023-24998 → CVE-2023-28709: incomplete fix (high confidence)CVE-2023-42795 → CVE-2023-46589: related (high confidence)CVE-2008-2938 → CVE-2015-5346: related (medium confidence)CVE-2008-2938 → CVE-2025-31651: related (medium confidence)CVE-2015-5346 → CVE-2023-42795: related (medium confidence)CVE-2015-5346 → CVE-2023-46589: related (medium confidence)CVE-2015-5346 → CVE-2025-31651: related (medium confidence)CVE-2023-24998 → CVE-2023-46589: related (medium confidence)CVE-2023-24998 → CVE-2025-52520: related (medium confidence)CVE-2023-24998 → CVE-2025-61795: related (medium confidence)CVE-2023-28709 → CVE-2023-46589: related (medium confidence)CVE-2023-46589 → CVE-2025-52520: related (medium confidence)CVE-2023-46589 → CVE-2025-61795: related (medium confidence)CVE-2025-31651 → CVE-2025-55752: related (medium confidence)CVE-2025-52520 → CVE-2025-61795: related (medium confidence)CVE-2025-55752 → CVE-2025-61795: Next fix in the same package (medium confidence)CVE-2025-52520 → CVE-2025-55752: Next fix in the same package (low confidence) CVE-2008-2938 13 Aug 2008 CVE-2015-5346 25 Feb 2016 CVE-2023-24998 20 Feb 2023 CVE-2023-28709 22 May 2023 CVE-2023-42795 10 Oct 2023 CVE-2023-46589 28 Nov 2023 CVE-2025-31651 28 Apr 2025 CVE-2025-52520 10 Jul 2025 CVE-2025-55752 27 Oct 2025 CVE-2025-61795 27 Oct 2025 20082010201120122013201420152016201720182019202020212022202320242025 CVE-2023-24998 → CVE-2023-28709: incomplete fix (high confidence)CVE-2023-42795 → CVE-2023-46589: related (high confidence)CVE-2008-2938 → CVE-2015-5346: related (medium confidence)CVE-2008-2938 → CVE-2025-31651: related (medium confidence)CVE-2015-5346 → CVE-2023-42795: related (medium confidence)CVE-2015-5346 → CVE-2023-46589: related (medium confidence)CVE-2015-5346 → CVE-2025-31651: related (medium confidence)CVE-2023-24998 → CVE-2023-46589: related (medium confidence)CVE-2023-24998 → CVE-2025-52520: related (medium confidence)CVE-2023-24998 → CVE-2025-61795: related (medium confidence)CVE-2023-28709 → CVE-2023-46589: related (medium confidence)CVE-2023-46589 → CVE-2025-52520: related (medium confidence)CVE-2023-46589 → CVE-2025-61795: related (medium confidence)CVE-2025-31651 → CVE-2025-55752: related (medium confidence)CVE-2025-52520 → CVE-2025-61795: related (medium confidence)CVE-2025-55752 → CVE-2025-61795: Next fix in the same package (medium confidence)CVE-2025-52520 → CVE-2025-55752: Next fix in the same package (low confidence) CVE-2008-2938 13 Aug 2008 CVE-2015-5346 25 Feb 2016 CVE-2023-24998 20 Feb 2023 CVE-2023-28709 22 May 2023 CVE-2023-42795 10 Oct 2023 CVE-2023-46589 28 Nov 2023 CVE-2025-31651 28 Apr 2025 CVE-2025-52520 10 Jul 2025 CVE-2025-55752 27 Oct 2025 CVE-2025-61795 27 Oct 2025
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2008-2938 13 Aug 2008 Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through… · fixed in 6.0.18 First in chain 27.6
CVE-2015-5346 25 Feb 2016 Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when… · fixed in 9.0.0.M2 CVE-2008-2938 · related · Medium 24.2
CVE-2023-24998 20 Feb 2023 Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts · fixed in 11.0.0-M5 First in chain 30.0
CVE-2023-28709 22 May 2023 Apache Tomcat: Fix for CVE-2023-24998 is incomplete · fixed in 11.0.0-M5 CVE-2023-24998 · incomplete fix · High 19.8
CVE-2023-42795 10 Oct 2023 Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests · fixed in 11.0.0-M12 CVE-2015-5346 · related · Medium 20.7
CVE-2023-46589 28 Nov 2023 Apache Tomcat: HTTP request smuggling via malformed trailer headers · fixed in 11.0.0-M11 CVE-2023-42795 · related · High 22.4
CVE-2025-31651 28 Apr 2025 Apache Tomcat: Bypass of rules in Rewrite Valve · fixed in 11.0.6 CVE-2008-2938 · related · Medium 30.1
CVE-2025-52520 10 Jul 2025 Apache Tomcat: DoS via integer overflow in multipart file upload · fixed in 11.0.9 CVE-2023-24998 · related · Medium 21.8
CVE-2025-55752 27 Oct 2025 Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled · fixed in 11.0.11 CVE-2025-31651 · related · Medium 30.1
CVE-2025-61795 27 Oct 2025 Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS · fixed in 11.0.12 CVE-2023-24998 · related · Medium 17.6
↑ ↓ chooseEnter openEsc close