Search for packages
| purl | pkg:apache/tomcat@11.0.0-M11 |
| Next non-vulnerable version | 11.0.0-M12 |
| Latest non-vulnerable version | 11.0.21 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-5781-s1ny-q7ey
Aliases: CVE-2023-44487 GHSA-2m7v-gc89-fjqf GHSA-qppj-fm5r-hxr3 GHSA-vx74-f528-fxqg GHSA-xpw8-rcwv-8f8p GMS-2023-3377 VSV00013 |
Affected by 0 other vulnerabilities. |
|
|
VCID-n9yk-e49f-n7e7
Aliases: CVE-2023-42795 GHSA-g8pj-r55q-5c2v |
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. |
Affected by 0 other vulnerabilities. |
|
VCID-rzj2-4kcj-43dq
Aliases: CVE-2023-45648 GHSA-r6j3-px5g-cq3x |
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-b3bb-9ajg-sfc9 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue. |
CVE-2023-46589
GHSA-fccv-jmmp-qg76 |
| VCID-j6cj-ftyd-3ffa | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application. |
CVE-2023-41080
GHSA-q3mw-pvr8-9ggc |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T12:38:04.526604+00:00 | Apache Tomcat Importer | Fixing | VCID-b3bb-9ajg-sfc9 | https://tomcat.apache.org/security-11.html | 38.0.0 |
| 2026-04-01T12:38:04.494221+00:00 | Apache Tomcat Importer | Fixing | VCID-j6cj-ftyd-3ffa | https://tomcat.apache.org/security-11.html | 38.0.0 |
| 2026-04-01T12:38:04.461588+00:00 | Apache Tomcat Importer | Affected by | VCID-n9yk-e49f-n7e7 | https://tomcat.apache.org/security-11.html | 38.0.0 |
| 2026-04-01T12:38:04.431497+00:00 | Apache Tomcat Importer | Affected by | VCID-5781-s1ny-q7ey | https://tomcat.apache.org/security-11.html | 38.0.0 |
| 2026-04-01T12:38:04.400246+00:00 | Apache Tomcat Importer | Affected by | VCID-rzj2-4kcj-43dq | https://tomcat.apache.org/security-11.html | 38.0.0 |