VulnerableCode Package Details - pkg:apache/tomcat@9.0.0%2BM18

Search for packages

Vulnerability	Summary	Fixed by
VCID-3nsr-9s9y-ckft Aliases: CVE-2017-5650 GHSA-9785-w233-x6hv	Improper Resource Shutdown or Release The handling of an HTTP/2 `GOAWAY` frame for a connection did not close streams associated with that connection that were currently waiting for a `WINDOW_UPDATE` before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.	9.0.0+M19 Affected by 0 other vulnerabilities.
VCID-4nx6-t8vd-bqcu Aliases: CVE-2017-5651 GHSA-9hg2-395j-83rm	Information Exposure The refactoring of the HTTP connectors introduced a regression in the send file processing. If the file processing completed quickly, it is possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.	9.0.0+M19 Affected by 0 other vulnerabilities.
VCID-hqzu-shyu-j3hp Aliases: CVE-2017-5647 GHSA-3gv7-3h64-78cm	Information Exposure When "send file" is used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.	9.0.0+M19 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-3nsr-9s9y-ckft
Aliases:
CVE-2017-5650
GHSA-9785-w233-x6hv

Improper Resource Shutdown or Release The handling of an HTTP/2 `GOAWAY` frame for a connection did not close streams associated with that connection that were currently waiting for a `WINDOW_UPDATE` before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.

9.0.0+M19
Affected by 0 other vulnerabilities.

VCID-4nx6-t8vd-bqcu
Aliases:
CVE-2017-5651
GHSA-9hg2-395j-83rm

Information Exposure The refactoring of the HTTP connectors introduced a regression in the send file processing. If the file processing completed quickly, it is possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.

9.0.0+M19
Affected by 0 other vulnerabilities.

VCID-hqzu-shyu-j3hp
Aliases:
CVE-2017-5647
GHSA-3gv7-3h64-78cm

Information Exposure When "send file" is used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.

9.0.0+M19
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-se44-f85s-xyex	Exposure of Resource to Wrong Sphere Some calls to application listeners in Apache Tomcat did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.	CVE-2017-5648 GHSA-3vx3-xf6q-r5xp

Vulnerability

Summary

Aliases

VCID-se44-f85s-xyex

Exposure of Resource to Wrong Sphere Some calls to application listeners in Apache Tomcat did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.

CVE-2017-5648
GHSA-3vx3-xf6q-r5xp

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-04T16:25:33.389976+00:00	Apache Tomcat Importer	Fixing	VCID-se44-f85s-xyex	https://tomcat.apache.org/security-9.html	38.6.0
2026-06-04T16:25:33.329893+00:00	Apache Tomcat Importer	Affected by	VCID-hqzu-shyu-j3hp	https://tomcat.apache.org/security-9.html	38.6.0
2026-06-04T16:25:33.276257+00:00	Apache Tomcat Importer	Affected by	VCID-3nsr-9s9y-ckft	https://tomcat.apache.org/security-9.html	38.6.0
2026-06-04T16:25:33.219756+00:00	Apache Tomcat Importer	Affected by	VCID-4nx6-t8vd-bqcu	https://tomcat.apache.org/security-9.html	38.6.0