VulnerableCode Package Details - pkg:apache/tomcat@8.5.7

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:apache/tomcat@8.5.7

Essentials
History (2)

purl	pkg:apache/tomcat@8.5.7

Next non-vulnerable version	8.5.13
Latest non-vulnerable version	11.0.21
Risk	4.0

Vulnerabilities affecting this package (2)

Vulnerability	Summary	Fixed by
VCID-6wvu-2rmc-mfhj Aliases: CVE-2016-8747 GHSA-fjwp-r6fm-q6qw	An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.	8.5.11 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.0+M17 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-k9cg-ehdw-dbh6 Aliases: CVE-2024-21733 GHSA-f4qf-m5gf-8jm8	Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.	8.5.64 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.44 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-6wvu-2rmc-mfhj
Aliases:
CVE-2016-8747
GHSA-fjwp-r6fm-q6qw

An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.

8.5.11
Affected by 1 other vulnerability.

9.0.0+M17
Affected by 1 other vulnerability.

VCID-k9cg-ehdw-dbh6
Aliases:
CVE-2024-21733
GHSA-f4qf-m5gf-8jm8

Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.

8.5.64
Affected by 1 other vulnerability.

9.0.44
Affected by 1 other vulnerability.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:12.211000+00:00	Apache Tomcat Importer	Affected by	VCID-6wvu-2rmc-mfhj	https://tomcat.apache.org/security-8.html	38.0.0
2026-04-01T12:38:10.743282+00:00	Apache Tomcat Importer	Affected by	VCID-k9cg-ehdw-dbh6	https://tomcat.apache.org/security-8.html	38.0.0