CVE-2026-50229

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50229
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50229.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50229
Aliases
Downstream
Related
Published
2026-06-29T20:36:24.683Z
Modified
2026-07-15T10:14:53.074984761Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Apache Tomcat: XSS in number guess example
Details

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-80"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50229.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "last_affected": "11.0.22"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "last_affected": "10.1.55"
                },
                {
                    "introduced": "9.0.0.M1"
                },
                {
                    "last_affected": "9.0.118"
                },
                {
                    "introduced": "8.5.0"
                },
                {
                    "last_affected": "8.5.100"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "last_affected": "7.0.109"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "fixed": "11.0.22"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "fixed": "10.1.55"
                },
                {
                    "introduced": "9.0.0.M1"
                },
                {
                    "fixed": "9.0.118"
                },
                {
                    "introduced": "8.5.0"
                },
                {
                    "fixed": "8.5.100"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "fixed": "7.0.109"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2cdef2c0241cdf70b5edd88d3733a52e6b675047
Introduced
e37b977db6f47e4380ad67114a49e8568951c953
Last affected
eddcf278ad919382608ada1898b2c5b63675c6d5
Introduced
16bf392c67833ad549733b58c350ff92b5ee782a
Fixed
36c2e40f60e3176f12c0344f40f656251448b004
Introduced
e9d17cddc285615807ec5fef09240777436b25dc
Fixed
59f3f1ab4f905f94c9c99cad579d6afb3a935b66
Introduced
56e547d387ab49f688c93fe9ca082b1b5d94deed
Fixed
b5c1bba61f2e54875bd6d538ae145fffd7b217a8
Database specific 
{
    "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0.109"
        },
        {
            "introduced": "8.5.0"
        },
        {
            "last_affected": "8.5.100"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.0.119"
        },
        {
            "introduced": "10.1.0"
        },
        {
            "fixed": "10.1.56"
        },
        {
            "introduced": "11.0.0"
        },
        {
            "fixed": "11.0.23"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

7.*
7.0.109
8.*
8.5.100

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50229.json"