Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@6.0.32
purl pkg:apache/tomcat@6.0.32
Next non-vulnerable version 6.0.50
Latest non-vulnerable version 11.0.21
Risk 4.0
Vulnerabilities affecting this package (4)
Vulnerability Summary Fixed by
VCID-241m-q6vd-kudk
Aliases:
CVE-2011-2526
GHSA-9ggm-7897-x4mg
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
6.0.33
Affected by 4 other vulnerabilities.
7.0.19
Affected by 1 other vulnerability.
VCID-618c-ar98-qfcr
Aliases:
CVE-2011-2729
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
6.0.33
Affected by 4 other vulnerabilities.
7.0.20
Affected by 1 other vulnerability.
VCID-d9ys-kxh6-nkgr
Aliases:
CVE-2011-1184
GHSA-q9xf-jwr4-v445
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.
6.0.33
Affected by 4 other vulnerabilities.
7.0.12
Affected by 1 other vulnerability.
VCID-mctd-9zgv-5qgp
Aliases:
CVE-2011-2204
GHSA-c57p-3v2g-w9rg
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.
6.0.33
Affected by 4 other vulnerabilities.
7.0.19
Affected by 1 other vulnerability.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-7ej8-5f77-cybb Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request. CVE-2011-0534
GHSA-43v2-6grp-9pp9

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T12:38:17.135851+00:00 Apache Tomcat Importer Fixing VCID-7ej8-5f77-cybb https://tomcat.apache.org/security-6.html 38.0.0
2026-04-01T12:38:17.109038+00:00 Apache Tomcat Importer Affected by VCID-618c-ar98-qfcr https://tomcat.apache.org/security-6.html 38.0.0
2026-04-01T12:38:17.078635+00:00 Apache Tomcat Importer Affected by VCID-241m-q6vd-kudk https://tomcat.apache.org/security-6.html 38.0.0
2026-04-01T12:38:17.049431+00:00 Apache Tomcat Importer Affected by VCID-mctd-9zgv-5qgp https://tomcat.apache.org/security-6.html 38.0.0
2026-04-01T12:38:17.019518+00:00 Apache Tomcat Importer Affected by VCID-d9ys-kxh6-nkgr https://tomcat.apache.org/security-6.html 38.0.0