VulnerableCode Package Details - pkg:apache/tomcat@7.0.47

Search for packages

Vulnerability	Summary	Fixed by
VCID-tcbc-3kgt-muam Aliases: CVE-2013-4322 GHSA-wq2p-q66w-q8gp	Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.	7.0.50 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.0-RC10 Affected by 0 other vulnerabilities.
VCID-w82a-7kk2-p3f1 Aliases: CVE-2013-4590 GHSA-87w9-x2c3-hrjj	Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, .jspx, .tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.	7.0.50 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.0-RC10 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-tcbc-3kgt-muam
Aliases:
CVE-2013-4322
GHSA-wq2p-q66w-q8gp

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

7.0.50
Affected by 1 other vulnerability.

8.0.0-RC10
Affected by 0 other vulnerabilities.

VCID-w82a-7kk2-p3f1
Aliases:
CVE-2013-4590
GHSA-87w9-x2c3-hrjj

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

7.0.50
Affected by 1 other vulnerability.

8.0.0-RC10
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-h9ds-trhx-m7aj	Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.	CVE-2013-4286 GHSA-j448-j653-r3vj

Vulnerability

Summary

Aliases

VCID-h9ds-trhx-m7aj

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CVE-2013-4286
GHSA-j448-j653-r3vj

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:15.040126+00:00	Apache Tomcat Importer	Fixing	VCID-h9ds-trhx-m7aj	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:15.009417+00:00	Apache Tomcat Importer	Affected by	VCID-w82a-7kk2-p3f1	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:14.979115+00:00	Apache Tomcat Importer	Affected by	VCID-tcbc-3kgt-muam	https://tomcat.apache.org/security-7.html	38.0.0