Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@10.0.4
purl pkg:apache/tomcat@10.0.4
Next non-vulnerable version 10.0.7
Latest non-vulnerable version 11.0.21
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-dtvw-92bk-wbcf
Aliases:
CVE-2021-30639
GHSA-44qp-qhfv-c7f6
A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.
10.0.5
Affected by 1 other vulnerability.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-dy6m-zt6r-9ubd Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service. CVE-2021-41079
GHSA-59g9-7gfx-c72p

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T12:38:06.329747+00:00 Apache Tomcat Importer Fixing VCID-dy6m-zt6r-9ubd https://tomcat.apache.org/security-10.html 38.0.0
2026-04-01T12:38:06.295519+00:00 Apache Tomcat Importer Affected by VCID-dtvw-92bk-wbcf https://tomcat.apache.org/security-10.html 38.0.0