VulnerableCode Package Details - pkg:apache/tomcat@7.0.88

Search for packages

Vulnerability	Summary	Fixed by
VCID-m2zn-ja8d-7kg8 Aliases: CVE-2018-8034 GHSA-46j3-r4pj-4835	The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.	7.0.90 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 8.0.53 Affected by 0 other vulnerabilities. 8.5.32 Affected by 0 other vulnerabilities. 9.0.10 Affected by 0 other vulnerabilities.
VCID-n3zn-tuck-gkfe Aliases: CVE-2018-8014 GHSA-r4x2-3cq5-hqvp	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.	7.0.89 Affected by 0 other vulnerabilities. 8.0.53 Affected by 0 other vulnerabilities. 8.5.32 Affected by 0 other vulnerabilities. 9.0.9 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-m2zn-ja8d-7kg8
Aliases:
CVE-2018-8034
GHSA-46j3-r4pj-4835

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

7.0.90
Affected by 1 other vulnerability.

8.0.53
Affected by 0 other vulnerabilities.

8.5.32
Affected by 0 other vulnerabilities.

9.0.10
Affected by 0 other vulnerabilities.

VCID-n3zn-tuck-gkfe
Aliases:
CVE-2018-8014
GHSA-r4x2-3cq5-hqvp

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

7.0.89
Affected by 0 other vulnerabilities.

8.0.53
Affected by 0 other vulnerabilities.

8.5.32
Affected by 0 other vulnerabilities.

9.0.9
Affected by 2 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-aeeu-fpay-wufz	An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.	CVE-2018-1336 GHSA-m59c-jpc8-m2x4

Vulnerability

Summary

Aliases

VCID-aeeu-fpay-wufz

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

CVE-2018-1336
GHSA-m59c-jpc8-m2x4

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:13.883310+00:00	Apache Tomcat Importer	Fixing	VCID-aeeu-fpay-wufz	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.853971+00:00	Apache Tomcat Importer	Affected by	VCID-n3zn-tuck-gkfe	https://tomcat.apache.org/security-7.html	38.0.0
2026-04-01T12:38:13.827507+00:00	Apache Tomcat Importer	Affected by	VCID-m2zn-ja8d-7kg8	https://tomcat.apache.org/security-7.html	38.0.0