VulnerableCode Package Details - pkg:apache/tomcat@9.0.37

Search for packages

Vulnerability	Summary	Fixed by
VCID-wgsc-dnn1-ukeq Aliases: CVE-2020-13943 GHSA-f268-65qc-98vg	If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.	9.0.38 Affected by 0 other vulnerabilities. 10.0.0-M8 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-wgsc-dnn1-ukeq
Aliases:
CVE-2020-13943
GHSA-f268-65qc-98vg

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

9.0.38
Affected by 0 other vulnerabilities.

10.0.0-M8
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-dzan-r49k-kqab	An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.	CVE-2020-13934 GHSA-vf77-8h7g-gghp
VCID-nvbx-q971-skgm	The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.	CVE-2020-13935 GHSA-m7jv-hq7h-mq7c

Vulnerability

Summary

Aliases

VCID-dzan-r49k-kqab

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

CVE-2020-13934
GHSA-vf77-8h7g-gghp

VCID-nvbx-q971-skgm

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

CVE-2020-13935
GHSA-m7jv-hq7h-mq7c

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:08.424838+00:00	Apache Tomcat Importer	Fixing	VCID-dzan-r49k-kqab	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:08.396128+00:00	Apache Tomcat Importer	Fixing	VCID-nvbx-q971-skgm	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:08.368591+00:00	Apache Tomcat Importer	Affected by	VCID-wgsc-dnn1-ukeq	https://tomcat.apache.org/security-9.html	38.0.0