Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@9.0.105
purl pkg:apache/tomcat@9.0.105
Next non-vulnerable version 9.0.110
Latest non-vulnerable version 11.0.21
Risk 4.0
Vulnerabilities affecting this package (5)
Vulnerability Summary Fixed by
VCID-246u-a4rh-yyd4
Aliases:
CVE-2025-49125
GHSA-wc4r-xq3c-5cf3
Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
9.0.106
Affected by 3 other vulnerabilities.
10.1.42
Affected by 2 other vulnerabilities.
11.0.8
Affected by 2 other vulnerabilities.
VCID-2kku-pzer-9ufv
Aliases:
CVE-2025-55668
GHSA-23hv-mwm6-g8jf
Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
9.0.106
Affected by 3 other vulnerabilities.
10.1.42
Affected by 2 other vulnerabilities.
11.0.8
Affected by 2 other vulnerabilities.
VCID-2x6a-3gh1-rkhs
Aliases:
CVE-2025-48976
GHSA-vv7r-c36w-3prj
Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.
9.0.106
Affected by 3 other vulnerabilities.
10.1.42
Affected by 2 other vulnerabilities.
11.0.8
Affected by 2 other vulnerabilities.
VCID-bks8-nvm9-vbgy
Aliases:
CVE-2025-49124
GHSA-42wg-hm62-jcwg
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100 and 7.0.95 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
9.0.106
Affected by 3 other vulnerabilities.
10.1.42
Affected by 2 other vulnerabilities.
11.0.8
Affected by 2 other vulnerabilities.
VCID-gb2v-96xj-ybad
Aliases:
CVE-2025-48988
GHSA-h3gc-qfqq-6h8f
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
9.0.106
Affected by 3 other vulnerabilities.
10.1.42
Affected by 2 other vulnerabilities.
11.0.8
Affected by 2 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-sr8e-w1qk-r7fz Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue. CVE-2025-46701
GHSA-h2fw-rfh5-95r3

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T12:38:07.130763+00:00 Apache Tomcat Importer Fixing VCID-sr8e-w1qk-r7fz https://tomcat.apache.org/security-9.html 38.0.0
2026-04-01T12:38:07.098436+00:00 Apache Tomcat Importer Affected by VCID-2x6a-3gh1-rkhs https://tomcat.apache.org/security-9.html 38.0.0
2026-04-01T12:38:07.066567+00:00 Apache Tomcat Importer Affected by VCID-gb2v-96xj-ybad https://tomcat.apache.org/security-9.html 38.0.0
2026-04-01T12:38:07.037823+00:00 Apache Tomcat Importer Affected by VCID-bks8-nvm9-vbgy https://tomcat.apache.org/security-9.html 38.0.0
2026-04-01T12:38:07.008655+00:00 Apache Tomcat Importer Affected by VCID-246u-a4rh-yyd4 https://tomcat.apache.org/security-9.html 38.0.0
2026-04-01T12:38:06.978680+00:00 Apache Tomcat Importer Affected by VCID-2kku-pzer-9ufv https://tomcat.apache.org/security-9.html 38.0.0