Apache Tomcat

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. Tomcat qualifies at Tier 2 through its OSS-Fuzz integration, so the ceiling is $5,000 and not the $15,000 Tier 1 headline. A committer has to accept the change, patches must be one to twelve months old, it is rate-limited to three submissions a month, and sanctions and territory exclusions apply. CVE history 34 Last 12 months 265 Lifetime Access control 30 % Parsing/validation 25 % Code execution 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Tomcat is the default servlet container of the Java world. It is embedded inside Spring Boot, which makes it the actual HTTP server for the overwhelming majority of modern Java services, and it is repackaged inside vendor products from Atlassian to Oracle across a wide swathe of on-prem enterprise software. So many instances are internet-facing and slow to patch that Tomcat CVEs are among the most reliably exploited in the wild: Ghostcat, CVE-2020-1938, reached any deployment that left the AJP connector open. The recent rate is high, 265 lifetime with 34 in the last twelve months. The ASF pays nothing for a vulnerability report sent to [email protected] , so sorona.xyz pays you directly on qualified, reproduced findings. In scope The Tomcat security team takes reports at [email protected] for a defect in Tomcat itself on a supported branch. Application code deployed into the container is the application's problem, the 7.x and 8.5.x lines are end of life, and everything below sits inside what remains The Coyote connectors in full: HTTP/1.1, HTTP/2 and AJP, and the protocol handlers underneath them Request parsing end to end, covering the request line, headers and chunked encoding, plus any framing disagreement between Tomcat and a fronting proxy such as httpd or nginx The default servlet and the whole static-resource path, including the resources and WEB-INF boundary that separates served content from application internals Session management in full: identifier generation, the SessionManager and every persistence backend, where deserialization gadgets surface JSP compilation and the Jasper engine The authentication and authorisation layer Tomcat ships, including the realm implementations that decide who a request is The bundled Manager and Host-Manager web applications and the authentication boundary in front of them Out of scope Application code deployed into Tomcat rather than a defect in Tomcat itself Deserialization gadgets that require an unsafe application classpath the reporter supplied End-of-life branches, specifically 7.x and 8.5.x Configuration errors such as exposing the Manager application to the internet One-liner fixes for non-exploitable crashes, excluded by name in the Patch Rewards rules The Tier 1 ceiling, which Tomcat cannot reach: it qualifies at Tier 2 through OSS-Fuzz, not as a named Tier 1 project Most-valued findings Authorisation or path bypass that reaches WEB-INF , the Manager application or another resource the container is meant to protect, the highest-value class here because access control is 30 percent of the record and every Spring Boot service inherits the boundary Anything in the connectors reaching remote code execution, the Ghostcat (CVE-2020-1938) shape and the shape of the 2025 partial-PUT chain, which is the class Tomcat is most reliably exploited for in the wild Request smuggling between Tomcat and a fronting proxy, where the two disagree on message framing and the front-end's access rules stop applying Deserialization reachable through session persistence using only classes Tomcat itself ships, rather than a gadget chain assumed onto the classpath Defects in the default servlet's path resolution that disclose source or configuration, since the same code path serves every static resource in every deployment Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report to [email protected] with the request sequence and the server.xml or connector configuration it needs Show the bug in Tomcat itself rather than in application code deployed into it. A vulnerable webapp running on Tomcat is the webapp's problem Work against a supported branch; the end-of-life 7.x and 8.5.x lines are explicitly out of scope Deserialization findings need a gadget chain reachable from Tomcat's own shipped classes, not one that assumes an unsafe application classpath If you also want the Google patch money, land the fix upstream yourself and keep it merged without reverts for one month. That is a separate pathway capped at $5,000 for Tomcat, which qualifies at Tier 2 through OSS-Fuzz rather than as a named Tier 1 project Google cannot pay anyone on a sanctions list, in a sanctioned territory, or located in Russia or Belarus Disclosure Coordinated with the Tomcat security team through [email protected] . The project runs one of the most disciplined security processes in open source, with fast advisories and clear affected-version tables at tomcat.apache.org/security.html, and it pays nothing for the report. Patch Rewards adds no embargo term of its own, so hold the detail until the advisory and the fixed release are out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability