VulnerableCode Package Details - pkg:apache/tomcat@10.1.43

Search for packages

Vulnerability	Summary	Fixed by
VCID-1e6p-cppr-2bh2 Aliases: CVE-2025-48989 GHSA-gqp3-2cvr-x8m3	Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.	10.1.44 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 11.0.10 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-1e6p-cppr-2bh2
Aliases:
CVE-2025-48989
GHSA-gqp3-2cvr-x8m3

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

10.1.44
Affected by 2 other vulnerabilities.

11.0.10
Affected by 2 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-fpgj-82wf-ykbw	Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.	CVE-2025-53506 GHSA-25xr-qj8w-c4vf
VCID-k59r-wjt3-wqe5	For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.	CVE-2025-52520 GHSA-wr62-c79q-cv37

Vulnerability

Summary

Aliases

VCID-fpgj-82wf-ykbw

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

CVE-2025-53506
GHSA-25xr-qj8w-c4vf

VCID-k59r-wjt3-wqe5

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

CVE-2025-52520
GHSA-wr62-c79q-cv37

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:04.908718+00:00	Apache Tomcat Importer	Fixing	VCID-fpgj-82wf-ykbw	https://tomcat.apache.org/security-10.html	38.0.0
2026-04-01T12:38:04.882154+00:00	Apache Tomcat Importer	Fixing	VCID-k59r-wjt3-wqe5	https://tomcat.apache.org/security-10.html	38.0.0
2026-04-01T12:38:04.851897+00:00	Apache Tomcat Importer	Affected by	VCID-1e6p-cppr-2bh2	https://tomcat.apache.org/security-10.html	38.0.0