Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@7.0.6
purl pkg:apache/tomcat@7.0.6
Next non-vulnerable version 7.0.8
Latest non-vulnerable version 11.0.21
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-7ej8-5f77-cybb
Aliases:
CVE-2011-0534
GHSA-43v2-6grp-9pp9
Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
7.0.8
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-dhun-hj5q-dfch Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag. CVE-2011-0013
GHSA-3p86-xgrq-m6p6

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T12:38:15.835761+00:00 Apache Tomcat Importer Fixing VCID-dhun-hj5q-dfch https://tomcat.apache.org/security-7.html 38.0.0
2026-04-01T12:38:15.800029+00:00 Apache Tomcat Importer Affected by VCID-7ej8-5f77-cybb https://tomcat.apache.org/security-7.html 38.0.0