Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2019-17563

CVE-2019-17563HIGH

Apache Software Foundation Apache Tomcat — When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where…

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   H   N   R  U  H  H  H    7.5   .1069   95.8     —

AFFECTED
  Product        Versions              Fixed
  Apache Tomcat  9.0.0.M1 to 9.0.29 –  —

TIMELINE
  Oct 14  Reserved by apache
  Dec 23  Published (CNA: apache)
  Oct 8   ENRICHED — CVE-2019-17563 (Apache Software Foundation Apache Tomcat). Received CVSS 7.5 and CPE data from NVD.

CWE-384 · CNA: apache · CVSS v3.1 · 19 references · NVD status: Modified

Description

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
October 14, 2019	Reserved	Reserved by apache
December 23, 2019	Published	Published (CNA: apache)
October 8, 2026	ENRICHED	ENRICHED — CVE-2019-17563 (Apache Software Foundation Apache Tomcat). Received CVSS 7.5 and CPE data from NVD.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Apache Software Foundation	Apache Tomcat	—	9.0.0.M1 to 9.0.29	—

Weaknesses

CWE-384

References (19)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html [Third Party Advisory]
https://lists.apache.org/thread.html/8b4c1db8300117b28a0f3f743c0b9e3f964687a690cdf9662a884bbd%40%3Cannounce.tomcat.apache.org%3E [Mailing List, Vendor Advisory]
https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E
https://lists.apache.org/thread.html/reb9a66f176df29b9a832caa95ebd9ffa3284e8f4922ec4fa3ad8eb2e%40%3Cissues.cxf.apache.org%3E
https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html [Third Party Advisory]
https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html [Mailing List, Third Party Advisory]
https://seclists.org/bugtraq/2019/Dec/43 [Mailing List, Third Party Advisory]
https://security.gentoo.org/glsa/202003-43 [Third Party Advisory]
https://security.netapp.com/advisory/ntap-20200107-0001/ [Third Party Advisory]
https://usn.ubuntu.com/4251-1/ [Third Party Advisory]
https://www.debian.org/security/2019/dsa-4596 [Third Party Advisory]
https://www.debian.org/security/2020/dsa-4680 [Third Party Advisory]
https://www.oracle.com/security-alerts/cpuapr2020.html [Patch, Third Party Advisory]
https://www.oracle.com/security-alerts/cpujan2021.html [Patch, Third Party Advisory]
https://www.oracle.com/security-alerts/cpujul2020.html [Patch, Third Party Advisory]

Authoritative record: CVE-2019-17563 at cve.org

Vendors: apache

Weaknesses: CWE-384

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2019-17563 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.