VulnerableCode Package Details - pkg:apache/tomcat@8.5.60

Search for packages

Vulnerability	Summary	Fixed by
VCID-wptr-hkjx-s7c3 Aliases: CVE-2021-42340 GHSA-wph7-x527-w3h5	The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.	8.5.72 Affected by 0 other vulnerabilities. 9.0.54 Affected by 0 other vulnerabilities. 10.0.12 Affected by 0 other vulnerabilities. 10.1.0-M6 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-wptr-hkjx-s7c3
Aliases:
CVE-2021-42340
GHSA-wph7-x527-w3h5

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

8.5.72
Affected by 0 other vulnerabilities.

9.0.54
Affected by 0 other vulnerabilities.

10.0.12
Affected by 0 other vulnerabilities.

10.1.0-M6
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-a8gk-n8bq-87cp	When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.	CVE-2021-24122 GHSA-2rvv-w9r2-rg7m
VCID-ran8-rnqn-tkbc	While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.	CVE-2020-17527 GHSA-vvw4-rfwf-p6hx

Vulnerability

Summary

Aliases

VCID-a8gk-n8bq-87cp

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.

CVE-2021-24122
GHSA-2rvv-w9r2-rg7m

VCID-ran8-rnqn-tkbc

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

CVE-2020-17527
GHSA-vvw4-rfwf-p6hx

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:10.895216+00:00	Apache Tomcat Importer	Fixing	VCID-ran8-rnqn-tkbc	https://tomcat.apache.org/security-8.html	38.0.0
2026-04-01T12:38:10.864007+00:00	Apache Tomcat Importer	Fixing	VCID-a8gk-n8bq-87cp	https://tomcat.apache.org/security-8.html	38.0.0
2026-04-01T12:38:10.571228+00:00	Apache Tomcat Importer	Affected by	VCID-wptr-hkjx-s7c3	https://tomcat.apache.org/security-8.html	38.0.0