VulnerableCode Package Details - pkg:apache/tomcat@8.5.12

Search for packages

Vulnerability	Summary	Fixed by
VCID-1hdb-24e3-f3d6 Aliases: CVE-2017-5651 GHSA-9hg2-395j-83rm	In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.	8.5.13 Affected by 0 other vulnerabilities. 9.0.0+M19 Affected by 0 other vulnerabilities.
VCID-m1zd-uytj-3bej Aliases: CVE-2017-5647 GHSA-3gv7-3h64-78cm	A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.	8.5.13 Affected by 0 other vulnerabilities. 9.0.0+M19 Affected by 0 other vulnerabilities.
VCID-u3ck-cvgt-fuhd Aliases: CVE-2017-5650 GHSA-9785-w233-x6hv	In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.	8.5.13 Affected by 0 other vulnerabilities. 9.0.0+M19 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-1hdb-24e3-f3d6
Aliases:
CVE-2017-5651
GHSA-9hg2-395j-83rm

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.

8.5.13
Affected by 0 other vulnerabilities.

9.0.0+M19
Affected by 0 other vulnerabilities.

VCID-m1zd-uytj-3bej
Aliases:
CVE-2017-5647
GHSA-3gv7-3h64-78cm

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.

8.5.13
Affected by 0 other vulnerabilities.

9.0.0+M19
Affected by 0 other vulnerabilities.

VCID-u3ck-cvgt-fuhd
Aliases:
CVE-2017-5650
GHSA-9785-w233-x6hv

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.

8.5.13
Affected by 0 other vulnerabilities.

9.0.0+M19
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-hmbm-5ysw-77bu	While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.	CVE-2017-5648 GHSA-3vx3-xf6q-r5xp

Vulnerability

Summary

Aliases

VCID-hmbm-5ysw-77bu

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.

CVE-2017-5648
GHSA-3vx3-xf6q-r5xp

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:12.157911+00:00	Apache Tomcat Importer	Fixing	VCID-hmbm-5ysw-77bu	https://tomcat.apache.org/security-8.html	38.0.0
2026-04-01T12:38:12.097473+00:00	Apache Tomcat Importer	Affected by	VCID-m1zd-uytj-3bej	https://tomcat.apache.org/security-8.html	38.0.0
2026-04-01T12:38:12.071103+00:00	Apache Tomcat Importer	Affected by	VCID-u3ck-cvgt-fuhd	https://tomcat.apache.org/security-8.html	38.0.0
2026-04-01T12:38:12.039751+00:00	Apache Tomcat Importer	Affected by	VCID-1hdb-24e3-f3d6	https://tomcat.apache.org/security-8.html	38.0.0