Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@11.0.0-M11
purl pkg:apache/tomcat@11.0.0-M11
Next non-vulnerable version 11.0.0-M12
Latest non-vulnerable version 11.0.21
Risk 10.0
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-5781-s1ny-q7ey
Aliases:
CVE-2023-44487
GHSA-2m7v-gc89-fjqf
GHSA-qppj-fm5r-hxr3
GHSA-vx74-f528-fxqg
GHSA-xpw8-rcwv-8f8p
GMS-2023-3377
VSV00013
11.0.0-M12
Affected by 0 other vulnerabilities.
VCID-n9yk-e49f-n7e7
Aliases:
CVE-2023-42795
GHSA-g8pj-r55q-5c2v
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
11.0.0-M12
Affected by 0 other vulnerabilities.
VCID-rzj2-4kcj-43dq
Aliases:
CVE-2023-45648
GHSA-r6j3-px5g-cq3x
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.
11.0.0-M12
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (2)
Vulnerability Summary Aliases
VCID-b3bb-9ajg-sfc9 Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue. CVE-2023-46589
GHSA-fccv-jmmp-qg76
VCID-j6cj-ftyd-3ffa URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application. CVE-2023-41080
GHSA-q3mw-pvr8-9ggc

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T12:38:04.526604+00:00 Apache Tomcat Importer Fixing VCID-b3bb-9ajg-sfc9 https://tomcat.apache.org/security-11.html 38.0.0
2026-04-01T12:38:04.494221+00:00 Apache Tomcat Importer Fixing VCID-j6cj-ftyd-3ffa https://tomcat.apache.org/security-11.html 38.0.0
2026-04-01T12:38:04.461588+00:00 Apache Tomcat Importer Affected by VCID-n9yk-e49f-n7e7 https://tomcat.apache.org/security-11.html 38.0.0
2026-04-01T12:38:04.431497+00:00 Apache Tomcat Importer Affected by VCID-5781-s1ny-q7ey https://tomcat.apache.org/security-11.html 38.0.0
2026-04-01T12:38:04.400246+00:00 Apache Tomcat Importer Affected by VCID-rzj2-4kcj-43dq https://tomcat.apache.org/security-11.html 38.0.0