Apache Tomcat: multiple vulnerabilities | 09/29
HKCERT lists security issues in Apache Tomcat, with potential impacts including service disruption, compromised data integrity and security control bypass.
Basis: the headline or summary mentions a vulnerability, malware or a data incident; check applicability. GDMME follow-up priority uses official ratings and headline/summary rules. It is not a CVSS score or official vulnerability rating, and does not confirm that your business is affected.
Source severity
中度風險（HKCERT）
Affected scope
Scope listed in the advisory: Apache Tomcat 9.0.0.M1 to 9.0.121; Apache Tomcat 10.1.0-M1 to 10.1.59; Apache Tomcat 11.0.0-M1 to 11.0.25.
Official recommendations
Automatically extracted recommendation passages from the official source, retained in the source language. Check the complete advisory.
- 在安裝軟體之前 請先瀏覽供應商之網站 以獲得更多詳細資料
- 安裝供應商提供的修補程式：
- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.122
- https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.60
- https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.26
The last successful extraction is used here. Check the official source for the latest content.
Source text collected (Hong Kong time)：2026/10/12 02:44 HKT
官方原文建議自動摘錄 未作逐篇人工分析或翻譯；請核對完整公告、現行版本及適用性
GDMME recommended actions
GDMME recommendations · automatically organised from explicit products and source signals, without individual human analysis. Confirm applicability against vendor guidance and your environment.
- Locate Apache / Tomcat deployments, running versions and service owners in your inventory or management console; compare them with the vendor applicability criteria. A named product does not mean every deployment is affected.
- Map websites, databases and dependent services using Apache / Tomcat. Verify backups and test updates before agreeing a maintenance window, rollback steps and post-change business tests.
- Once Apache / Tomcat applicability is confirmed, check the official excerpt and complete vendor patch/mitigation instructions. Record before/after versions, test results and rollback steps; do not install updates solely from a news headline.
- Retain access, application and administrative logs for Apache / Tomcat and compare them with recent deployments and account changes. If compromise is suspected, isolate affected services under the incident procedure and preserve evidence.
Automatically organised (Hong Kong time)：2026/10/12 23:05 HKT
Educational information only. Confirm affected versions, mitigations and exploitation status with the original vendor advisory. Reports do not imply that GDMME equipment blocks every vulnerability.