CVE-2023-41080: tomcat-coyote fixed in 10.1.12, 9.0.79 and 8.5.92

CVE-2023-41080 PUBLISHED CVSS 6.099999904632568 MEDIUM

Apache Tomcat Open Redirect vulnerability

Record from NVD · Published August 25, 2023

tomcat-coyote is fixed in 10.1.12, 9.0.79 and 8.5.92 (Maven Central)

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.

EPSS 6.46% · 93.7th percentile

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
tomcat:catalina	Maven Central	10.1.12, 9.0.79, 8.5.92
org.apache.tomcat:tomcat-coyote	Maven Central	10.1.12, 9.0.79, 8.5.92
org.apache.tomcat:tomcat-util	Maven Central	10.1.12, 9.0.79, 8.5.92
org.apache.tomcat.embed:tomcat-embed-core	Maven Central	11.0.0-M11, 10.1.13, 9.0.80, 8.5.93
org.apache.tomcat:coyote	Maven Central	10.1.12, 9.0.79, 8.5.92
org.apache.tomcat:tomcat	Maven Central	11.0.0-M11, 10.1.13, 9.0.80, 8.5.93
org.apache.tomcat.embed:tomcat-embed-websocket	Maven Central	10.1.12, 9.0.79, 8.5.92
org.apache.tomcat:tomcat-catalina	Maven Central	10.1.13, 10.1.12, 9.0.80, 9.0.79, 8.5.93, 8.5.92
tomcat:jasper-runtime	Maven Central	10.1.12, 9.0.79, 8.5.92
tomcat-8.5.87	Chainguard	8.5.87-r3
tomcat9-el-3.0-api	Amazon Linux	1:9.0.71-1.amzn2023.0.5
tomcat9-webapps	Amazon Linux	1:9.0.71-1.amzn2023.0.5

11 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

6.099999904632568

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

6.46%

93.7th percentile

Affected products

Vendor	Product	Versions
debian	debian_linux	10.0, 11.0
apache	tomcat	9.0.0, 10.1.0, 11.0.0

Timeline

Aug 25, 2023 CVE Published
Aug 26, 2023 EPSS Score (30 in total, the first dated here)
Oct 16, 2025 CVE Updated
Feb 6, 2026 Distribution Patch (25 in total, the first dated here)
Feb 6, 2026 Security Advisory (30 in total, the first dated here)
Aug 4, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2023-41080
vulnetix vdb fixes CVE-2023-41080

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-41080/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →