CVE-2026-50229: Apache Tomcat Example App XSS Vulnerability—Patch Guidance

Technical summary

This is a reflected XSS flaw (CWE-80) in Tomcat's example application that fails to properly sanitize user-controlled input before embedding it in HTML responses. The vulnerability exists in the number guessing example component and allows an unauthenticated attacker to craft malicious URLs containing script payloads. When a victim visits such a URL, the injected JavaScript executes in their browser context with the privileges of the current user session, potentially enabling session hijacking, credential theft, or defacement.

Business impact

Organizations running Tomcat with example applications enabled in production environments face a direct risk of account compromise and data exfiltration. Even in development or testing environments, this can be an entry point for lateral movement or supply chain attacks if those systems are networked with production infrastructure. The vulnerability is particularly concerning in shared hosting or multi-tenant scenarios where example applications may inadvertently remain accessible.

Affected systems

Vulnerable versions span multiple Tomcat release lines: 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0-M1 through 9.0.118, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. Versions 11.0.23, 10.1.56, and 9.0.119 contain the fix. End-of-life branches (7.x and 8.5.x) receive no further updates, making patching impossible for organizations constrained to those versions.

Exploitability

This vulnerability has a CVSS 3.1 score of 6.1 (Medium severity) with a network-based attack vector requiring no authentication but mandating user interaction. Exploitation is straightforward—an attacker crafts a URL and tricks or socially engineers a user into visiting it. No special tools or significant technical barriers exist; basic HTML/JavaScript knowledge suffices. The vulnerability is not listed in CISA's KEV catalog, suggesting no active widespread exploitation has been formally documented, though the low barrier to exploitation means defensive action should not be delayed.

Remediation

Upgrade to patched versions: 11.0.23 or later for the 11.x branch, 10.1.56 or later for 10.1.x, or 9.0.119 or later for 9.0.x. For organizations on 8.5.x or 7.x branches that have reached end-of-support, immediate migration to a supported version is essential. As an interim mitigation, disable or remove example applications from all Tomcat instances, especially those accessible over the network. Verify via application inventories and network scans that example directories are not exposed.

Patch guidance

Apply vendor updates as specified: consult the Apache Tomcat security advisory for exact patch availability and installation procedures for your specific version. Test patched versions in a staging environment mirroring production configuration before production deployment. For unsupported branches (7.x, 8.5.x), upgrade the entire Tomcat installation to a supported version. Document patch application and removal of example applications as part of your change management process.

Detection guidance

Monitor web server logs for suspicious patterns in HTTP requests targeting example application paths (typically /examples/ or similar). Look for URL-encoded or obfuscated script tags, angle brackets, or JavaScript keywords in GET/POST parameters. Implement Web Application Firewall (WAF) rules to block requests containing <script>, javascript:, onerror=, and other XSS payloads sent to Tomcat instances. Conduct regular scanning of Tomcat servers to identify whether example applications remain deployed and accessible from the network.

Why prioritize this

Although rated Medium severity, this vulnerability warrants prompt attention because: (1) exploitation is trivial and requires only social engineering, (2) it affects multiple actively-supported Tomcat branches, (3) example applications are often overlooked in security assessments, and (4) compromise of web application users can cascade into broader infrastructure breaches. Organizations should prioritize patching or removal of examples within their next patch cycle.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects the network attack vector, lack of authentication requirement, and low attack complexity, balanced against the requirement for user interaction and limited impact scope (confidentiality and integrity, not availability). The score appropriately captures the risk as moderate rather than critical, but organizations handling sensitive data or operating in regulated industries may wish to treat it with higher priority.

Frequently asked questions