VulnerableCode Package Details - pkg:apache/tomcat@9.0.0%2BM11

Search for packages

Vulnerability	Summary	Fixed by
VCID-2mj1-8nz1-43cd Aliases: CVE-2016-6817 GHSA-698c-2x4j-g9gq	Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.	9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-6umz-z8db-kqcy Aliases: CVE-2016-8735 GHSA-cw54-59pw-4g8c	Improper Access Control Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.	9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-d8re-94xd-nycp Aliases: CVE-2025-55752 GHSA-wmwf-9ccg-fff5	Apache Tomcat Vulnerable to Relative Path Traversal The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.	9.0.109 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.1.45 Affected by 0 other vulnerabilities. 11.0.11 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-nndc-pabd-nbgf Aliases: CVE-2016-8747 GHSA-fjwp-r6fm-q6qw	Apache Tomcat allows remote attackers to read data that was intended to be associated with a different request An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.	9.0.0+M17 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-y9hs-ymcm-3ucx Aliases: CVE-2016-6816 GHSA-jc7p-5r39-9477	Improper Input Validation The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.	9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-2mj1-8nz1-43cd
Aliases:
CVE-2016-6817
GHSA-698c-2x4j-g9gq

Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.

9.0.0+M13
Affected by 1 other vulnerability.

VCID-6umz-z8db-kqcy
Aliases:
CVE-2016-8735
GHSA-cw54-59pw-4g8c

Improper Access Control Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

9.0.0+M13
Affected by 1 other vulnerability.

VCID-d8re-94xd-nycp
Aliases:
CVE-2025-55752
GHSA-wmwf-9ccg-fff5

Apache Tomcat Vulnerable to Relative Path Traversal The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.

9.0.109
Affected by 1 other vulnerability.

10.1.45
Affected by 0 other vulnerabilities.

11.0.11
Affected by 1 other vulnerability.

VCID-nndc-pabd-nbgf
Aliases:
CVE-2016-8747
GHSA-fjwp-r6fm-q6qw

Apache Tomcat allows remote attackers to read data that was intended to be associated with a different request An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.

9.0.0+M17
Affected by 1 other vulnerability.

VCID-y9hs-ymcm-3ucx
Aliases:
CVE-2016-6816
GHSA-jc7p-5r39-9477

Improper Input Validation The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

9.0.0+M13
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-04T16:25:33.678331+00:00	Apache Tomcat Importer	Affected by	VCID-y9hs-ymcm-3ucx	https://tomcat.apache.org/security-9.html	38.6.0
2026-06-04T16:25:33.622152+00:00	Apache Tomcat Importer	Affected by	VCID-2mj1-8nz1-43cd	https://tomcat.apache.org/security-9.html	38.6.0
2026-06-04T16:25:33.563301+00:00	Apache Tomcat Importer	Affected by	VCID-6umz-z8db-kqcy	https://tomcat.apache.org/security-9.html	38.6.0
2026-06-04T16:25:33.437236+00:00	Apache Tomcat Importer	Affected by	VCID-nndc-pabd-nbgf	https://tomcat.apache.org/security-9.html	38.6.0
2026-06-04T16:25:28.799064+00:00	Apache Tomcat Importer	Affected by	VCID-d8re-94xd-nycp	https://tomcat.apache.org/security-9.html	38.6.0