VulnerableCode Package Details - pkg:apache/tomcat@9.0.0%2BM11

Search for packages

Vulnerability	Summary	Fixed by
VCID-3r3s-q21j-c3au Aliases: CVE-2016-6816 GHSA-jc7p-5r39-9477	The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.	9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-6wvu-2rmc-mfhj Aliases: CVE-2016-8747 GHSA-fjwp-r6fm-q6qw	An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.	9.0.0+M17 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-95d1-arxd-hkd1 Aliases: CVE-2016-8735 GHSA-cw54-59pw-4g8c	Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.	9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-xqjr-7xfw-mbh2 Aliases: CVE-2025-55752 GHSA-wmwf-9ccg-fff5	Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.	9.0.109 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.1.45 Affected by 0 other vulnerabilities. 11.0.11 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-yxpq-rrry-j3h8 Aliases: CVE-2016-6817 GHSA-698c-2x4j-g9gq	The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.	9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-3r3s-q21j-c3au
Aliases:
CVE-2016-6816
GHSA-jc7p-5r39-9477

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

9.0.0+M13
Affected by 1 other vulnerability.

VCID-6wvu-2rmc-mfhj
Aliases:
CVE-2016-8747
GHSA-fjwp-r6fm-q6qw

An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.

9.0.0+M17
Affected by 1 other vulnerability.

VCID-95d1-arxd-hkd1
Aliases:
CVE-2016-8735
GHSA-cw54-59pw-4g8c

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

9.0.0+M13
Affected by 1 other vulnerability.

VCID-xqjr-7xfw-mbh2
Aliases:
CVE-2025-55752
GHSA-wmwf-9ccg-fff5

Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.

9.0.109
Affected by 1 other vulnerability.

10.1.45
Affected by 0 other vulnerabilities.

11.0.11
Affected by 1 other vulnerability.

VCID-yxpq-rrry-j3h8
Aliases:
CVE-2016-6817
GHSA-698c-2x4j-g9gq

The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.

9.0.0+M13
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:09.525928+00:00	Apache Tomcat Importer	Affected by	VCID-3r3s-q21j-c3au	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:09.493796+00:00	Apache Tomcat Importer	Affected by	VCID-yxpq-rrry-j3h8	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:09.461166+00:00	Apache Tomcat Importer	Affected by	VCID-95d1-arxd-hkd1	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:09.394374+00:00	Apache Tomcat Importer	Affected by	VCID-6wvu-2rmc-mfhj	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:06.825841+00:00	Apache Tomcat Importer	Affected by	VCID-xqjr-7xfw-mbh2	https://tomcat.apache.org/security-9.html	38.0.0