VulnerableCode Package Details - pkg:apache/tomcat@8.5.13

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-1hdb-24e3-f3d6	In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.	CVE-2017-5651 GHSA-9hg2-395j-83rm
VCID-m1zd-uytj-3bej	A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.	CVE-2017-5647 GHSA-3gv7-3h64-78cm
VCID-u3ck-cvgt-fuhd	In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.	CVE-2017-5650 GHSA-9785-w233-x6hv

Vulnerability

Summary

Aliases

VCID-1hdb-24e3-f3d6

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.

CVE-2017-5651
GHSA-9hg2-395j-83rm

VCID-m1zd-uytj-3bej

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.

CVE-2017-5647
GHSA-3gv7-3h64-78cm

VCID-u3ck-cvgt-fuhd

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.

CVE-2017-5650
GHSA-9785-w233-x6hv

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:12.099540+00:00	Apache Tomcat Importer	Fixing	VCID-m1zd-uytj-3bej	https://tomcat.apache.org/security-8.html	38.0.0
2026-04-01T12:38:12.072981+00:00	Apache Tomcat Importer	Fixing	VCID-u3ck-cvgt-fuhd	https://tomcat.apache.org/security-8.html	38.0.0
2026-04-01T12:38:12.042353+00:00	Apache Tomcat Importer	Fixing	VCID-1hdb-24e3-f3d6	https://tomcat.apache.org/security-8.html	38.0.0