CVE-2026-50229 Overview
CVE-2026-50229 is a Cross-Site Scripting (XSS) vulnerability affecting the number guess example application shipped with Apache Tomcat. The flaw exists because the example fails to properly neutralize script-related HTML tags rendered back to the user in a web page [CWE-80]. An attacker who convinces a user to click a crafted link can inject script content that executes in the victim's browser session. The issue impacts Apache Tomcat versions 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. The Apache Tomcat project has released fixed versions 11.0.23, 10.1.56, and 9.0.119.
Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session token theft, credential harvesting, and unauthorized actions against Tomcat-hosted applications.
Affected Products
- Apache Tomcat 11.0.0-M1 through 11.0.22
- Apache Tomcat 10.1.0-M1 through 10.1.55
- Apache Tomcat 9.0.0.M1 through 9.0.118, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109
Discovery Timeline
- 2026-06-29 - CVE-2026-50229 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-50229
Vulnerability Analysis
The vulnerability resides in the number guess example web application bundled with Apache Tomcat installations. This example accepts user-supplied input and reflects portions of it back into the generated HTML response. Because the example does not perform sufficient output encoding, script-related HTML tags submitted by an attacker survive processing and reach the rendered page. When a victim loads the crafted response, the browser interprets the injected markup as executable script. The Apache Tomcat security team classifies the issue as a basic reflected XSS [CWE-80]. Bundled example applications are commonly left enabled on development and staging systems, expanding the attack surface beyond production deployments.
Root Cause
The root cause is improper neutralization of script-related HTML tags in output produced by the number guess example. The application echoes attacker-controlled parameters into the response without applying context-appropriate HTML entity encoding. As a consequence, characters such as <, >, and quote characters retain their markup significance in the browser.
Attack Vector
Exploitation requires an attacker to craft a URL targeting the vulnerable number guess endpoint with a malicious payload embedded in a request parameter. The attacker then delivers the URL to a victim through phishing, chat, or a hosted redirect. When the victim clicks the link, the injected script executes in the origin of the Tomcat server, granting access to cookies, DOM contents, and any authenticated session state associated with other applications on the same host. No authentication is required to trigger the reflection. The Apache Tomcat advisory and the Openwall OSS Security Update describe the vulnerable component in detail.
Detection Methods for CVE-2026-50229
Indicators of Compromise
- HTTP access log entries targeting the /examples/ path, particularly the number guess servlet, containing encoded <script>, onerror=, or javascript: tokens in query parameters.
- Referrer headers pointing to external phishing domains followed by requests to the Tomcat examples web application.
- Outbound requests from user browsers to attacker-controlled hosts immediately after visiting the vulnerable Tomcat instance.
Detection Strategies
- Search web server and reverse proxy logs for request URIs containing /examples/ combined with URL-encoded angle brackets or common XSS payload keywords.
- Deploy Web Application Firewall (WAF) signatures that flag reflected XSS payloads directed at Apache Tomcat example applications.
- Inventory all Tomcat deployments and identify hosts where the bundled examples context is still deployed and reachable.
Monitoring Recommendations
- Alert on any HTTP 200 responses from /examples/ endpoints where the request query string contains script markup.
- Monitor for anomalous spikes in traffic to the number guess example, which is rarely used in production workflows.
- Track user reports of unexpected browser prompts or redirects following interaction with internal Tomcat-hosted URLs.
How to Mitigate CVE-2026-50229
Immediate Actions Required
- Upgrade Apache Tomcat to version 11.0.23, 10.1.56, or 9.0.119 as recommended in the Apache Mailing List Discussion.
- Remove or disable the bundled examples web application on all production and internet-facing Tomcat servers.
- Review reverse proxy configurations to block external access to /examples/ paths where the context cannot be immediately removed.
Patch Information
The Apache Tomcat project addressed CVE-2026-50229 in versions 11.0.23, 10.1.56, and 9.0.119. End-of-life branches 8.5.x and 7.0.x remain affected and will not receive fixes; operators on those branches must migrate to a supported release. Details are published in the Apache Mailing List Discussion.
Workarounds
- Delete the webapps/examples directory from the Tomcat installation to eliminate the vulnerable code path.
- Restrict access to the examples context using a RemoteAddrValve entry or equivalent network-level access controls.
- Enforce a strict Content-Security-Policy response header that disallows inline script execution on Tomcat-hosted applications.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
