VulnerableCode Package Details - pkg:apache/tomcat@9.0.0-M1

Vulnerabilities affecting this package (15)

Vulnerability	Summary	Fixed by
VCID-56jv-htmt-rkew Aliases: CVE-2023-24998 GHSA-hfrx-6qgj-fp6c	Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.	9.0.71 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 10.1.5 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 11.0.0-M3 Affected by 0 other vulnerabilities.
VCID-5781-s1ny-q7ey Aliases: CVE-2023-44487 GHSA-2m7v-gc89-fjqf GHSA-qppj-fm5r-hxr3 GHSA-vx74-f528-fxqg GHSA-xpw8-rcwv-8f8p GMS-2023-3377 VSV00013		9.0.81 Affected by 0 other vulnerabilities. 10.1.14 Affected by 0 other vulnerabilities. 11.0.0-M12 Affected by 0 other vulnerabilities.
VCID-8mns-kw6c-a7dk Aliases: CVE-2024-52316 GHSA-xcpr-7mr4-h4xq	Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.	9.0.96 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.1.31 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 11.0.0 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-8myk-ac5b-huh8 Aliases: CVE-2024-34750 GHSA-wm9w-rjj3-j356	Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.	9.0.90 Affected by 0 other vulnerabilities. 10.1.25 Affected by 0 other vulnerabilities. 11.0.0-M21 Affected by 0 other vulnerabilities.
VCID-b3bb-9ajg-sfc9 Aliases: CVE-2023-46589 GHSA-fccv-jmmp-qg76	Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.	9.0.83 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.1.16 Affected by 0 other vulnerabilities. 11.0.0-M11 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-dy6m-zt6r-9ubd Aliases: CVE-2021-41079 GHSA-59g9-7gfx-c72p	Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.	9.0.44 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.0.4 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-j6cj-ftyd-3ffa Aliases: CVE-2023-41080 GHSA-q3mw-pvr8-9ggc	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.	9.0.80 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 10.1.13 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 11.0.0-M11 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-j8tk-s915-pbfy Aliases: CVE-2021-43980 GHSA-jx7c-7mj5-9438	The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.	9.0.62 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.0.20 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.1.0-M14 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-n9yk-e49f-n7e7 Aliases: CVE-2023-42795 GHSA-g8pj-r55q-5c2v	Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.	9.0.81 Affected by 0 other vulnerabilities. 10.1.14 Affected by 0 other vulnerabilities. 11.0.0-M12 Affected by 0 other vulnerabilities.
VCID-nmq2-8ysj-4fbc Aliases: CVE-2022-42252 GHSA-p22x-g9px-3945	If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.	9.0.68 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.0.27 Affected by 0 other vulnerabilities. 10.1.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-p6pa-f1fg-hbhg Aliases: CVE-2024-23672 GHSA-v682-8vv8-vpwr	Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.	9.0.86 Affected by 0 other vulnerabilities. 10.1.19 Affected by 0 other vulnerabilities. 11.0.0-M17 Affected by 0 other vulnerabilities.
VCID-ran8-rnqn-tkbc Aliases: CVE-2020-17527 GHSA-vvw4-rfwf-p6hx	While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.	9.0.40 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 10.0.0-M10 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-rzj2-4kcj-43dq Aliases: CVE-2023-45648 GHSA-r6j3-px5g-cq3x	Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.	9.0.81 Affected by 0 other vulnerabilities. 10.1.14 Affected by 0 other vulnerabilities. 11.0.0-M12 Affected by 0 other vulnerabilities.
VCID-v7tp-1t4h-zqeg Aliases: CVE-2023-28708 GHSA-2c9m-w27f-53rm	When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.	9.0.72 Affected by 0 other vulnerabilities. 10.1.6 Affected by 0 other vulnerabilities. 11.0.0-M3 Affected by 0 other vulnerabilities.
VCID-vsdf-4tfj-uybe Aliases: CVE-2024-24549 GHSA-7w75-32cg-r6g2	Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.	9.0.86 Affected by 0 other vulnerabilities. 10.1.19 Affected by 0 other vulnerabilities. 11.0.0-M17 Affected by 0 other vulnerabilities.

Next non-vulnerable version	9.0.0+M10
Latest non-vulnerable version	11.0.21
Risk	10.0

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:08.339715+00:00	Apache Tomcat Importer	Affected by	VCID-ran8-rnqn-tkbc	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:08.174569+00:00	Apache Tomcat Importer	Affected by	VCID-dy6m-zt6r-9ubd	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:07.989253+00:00	Apache Tomcat Importer	Affected by	VCID-j8tk-s915-pbfy	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:07.896473+00:00	Apache Tomcat Importer	Affected by	VCID-nmq2-8ysj-4fbc	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:07.838098+00:00	Apache Tomcat Importer	Affected by	VCID-56jv-htmt-rkew	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:07.809223+00:00	Apache Tomcat Importer	Affected by	VCID-v7tp-1t4h-zqeg	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:07.722497+00:00	Apache Tomcat Importer	Affected by	VCID-j6cj-ftyd-3ffa	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:07.662445+00:00	Apache Tomcat Importer	Affected by	VCID-n9yk-e49f-n7e7	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:07.631924+00:00	Apache Tomcat Importer	Affected by	VCID-5781-s1ny-q7ey	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:07.600613+00:00	Apache Tomcat Importer	Affected by	VCID-rzj2-4kcj-43dq	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:07.569449+00:00	Apache Tomcat Importer	Affected by	VCID-b3bb-9ajg-sfc9	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:07.541789+00:00	Apache Tomcat Importer	Affected by	VCID-vsdf-4tfj-uybe	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:07.511902+00:00	Apache Tomcat Importer	Affected by	VCID-p6pa-f1fg-hbhg	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:07.452697+00:00	Apache Tomcat Importer	Affected by	VCID-8myk-ac5b-huh8	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:07.423388+00:00	Apache Tomcat Importer	Affected by	VCID-8mns-kw6c-a7dk	https://tomcat.apache.org/security-9.html	38.0.0