CVE-2026-50229
MediumImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.
Published Jun 29, 2026 · Updated Oct 8, 2026 · Also known as BIT-tomcat-2026-50229, DEBIAN-CVE-2026-50229, EUVD-2026-40226, GHSA-pg42-rg8c-j886, TR-26-0464, UBUNTU-CVE-2026-50229, USN-8551-1
Key Facts
Routine patching- CVE-2026-50229 is a medium-severity vulnerability (CVSS 6.1 v3.1) affecting Tomcat (Apache), tomcat10 (debian), tomcat11 (debian) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 4.1% probability of exploitation in the next 30 days.
- Fixed versions are available, including Tomcat 10.1.56, Tomcat 11.0.23, Tomcat 9.0.119.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
CVSS v3.1
6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS (30-day exploit likelihood)
4.1%
Higher than 90.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-50229 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
Affected Products
246 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| TomcatApache | >= 11.0.0-M1 | 7.0.109 |
| tomcat10debian | See advisory | 10.1.60-1 |
| tomcat11debian | See advisory | 11.0.24-1 |
| tomcat9debian | See advisory | 9.0.70-2 |
| libservlet3.1-javaubuntu | See advisory | 8.0.32-1ubuntu1.13+esm2 |
Patched Releases
Tomcat
10.1.56, 11.0.23, 9.0.119, 1:9.0.120-1.el8_10, 1:9.0.120-2.el9_8, 10.1.37, 11.0.5, 9.0.101, 9.0.119-1.1, 9.0.119-150200.111.1, 9.0.119-160000.1.1, 9.0.119-3.169.1
libservlet3.1-java
8.0.32-1ubuntu1.13+esm2
libservlet3.1-java-doc
8.0.32-1ubuntu1.13+esm2
libtomcat8-embed-java
8.5.39-1ubuntu1~18.04.3+esm6
libtomcat8-java
8.0.32-1ubuntu1.13+esm2, 8.5.39-1ubuntu1~18.04.3+esm6
tomcat-admin-webapps
9.0.119-1.1, 9.0.119-150200.111.1, 9.0.119-160000.1.1, 9.0.119-3.169.1
tomcat-docs-webapp
9.0.119-1.1, 9.0.119-160000.1.1, 9.0.119-3.169.1
tomcat-el-3_0-api
9.0.119-1.1, 9.0.119-150200.111.1, 9.0.119-160000.1.1, 9.0.119-3.169.1
tomcat-embed
9.0.119-1.1, 9.0.119-160000.1.1
tomcat-javadoc
9.0.119-1.1, 9.0.119-160000.1.1, 9.0.119-3.169.1
tomcat-jsp-2_3-api
9.0.119-1.1, 9.0.119-150200.111.1, 9.0.119-160000.1.1, 9.0.119-3.169.1
tomcat-jsvc
9.0.119-1.1, 9.0.119-160000.1.1
tomcat-lib
9.0.119-1.1, 9.0.119-150200.111.1, 9.0.119-160000.1.1, 9.0.119-3.169.1
tomcat-servlet-4_0-api
9.0.119-1.1, 9.0.119-150200.111.1, 9.0.119-160000.1.1, 9.0.119-3.169.1
tomcat-webapps
9.0.119-1.1, 9.0.119-150200.111.1, 9.0.119-160000.1.1, 9.0.119-3.169.1
tomcat10
1:10.1.57-1.amzn2023.0.1, 10.1.56-1.1, 10.1.56-150200.5.70.1, 10.1.56-160000.1.1, 10.1.60-1
tomcat10-admin-webapps
1:10.1.57-1.amzn2023.0.1, 10.1.56-1.1, 10.1.56-150200.5.70.1, 10.1.56-160000.1.1
tomcat10-doc
10.1.56-1.1, 10.1.56-160000.1.1
tomcat10-docs-webapp
1:10.1.57-1.amzn2023.0.1, 10.1.56-1.1, 10.1.56-160000.1.1
tomcat10-el-5_0-api
10.1.56-1.1, 10.1.56-150200.5.70.1, 10.1.56-160000.1.1
tomcat10-el-5.0-api
1:10.1.57-1.amzn2023.0.1
tomcat10-embed
10.1.56-1.1, 10.1.56-160000.1.1
tomcat10-jsp-3_1-api
10.1.56-1.1, 10.1.56-150200.5.70.1, 10.1.56-160000.1.1
tomcat10-jsp-3.1-api
1:10.1.57-1.amzn2023.0.1
tomcat10-jsvc
10.1.56-1.1, 10.1.56-160000.1.1
Timeline
Publicly disclosed
Jun 29, 2026
Last updated
Oct 8, 2026
Weakness Type
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
References
- advisoryRHSA-2026:32960
- advisoryhttps://github.com/apache/tomcat/commit/0d5bdd5b0dd964e9f73e530b7d753462b9bfd1d0
- advisoryhttps://github.com/apache/tomcat/commit/1fe95d841e9d461a16069974142d12c3ef68819a
- advisoryhttps://github.com/apache/tomcat/commit/de5a950415fc67713f17fab63d0c7809e0fca80b
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50229.json
FAQ
Common Questions.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.
Affected: Tomcat (Apache) versions >= 11.0.0-M1; tomcat10 (debian); tomcat11 (debian), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Tomcat 10.1.56, Tomcat 11.0.23, Tomcat 9.0.119.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2026-50229 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo