VulnerableCode Package Details - pkg:apache/tomcat@9.0.44

Search for packages

Vulnerability	Summary	Fixed by
VCID-dtvw-92bk-wbcf Aliases: CVE-2021-30639 GHSA-44qp-qhfv-c7f6	A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.	9.0.45 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.0.5 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-dtvw-92bk-wbcf
Aliases:
CVE-2021-30639
GHSA-44qp-qhfv-c7f6

A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.

9.0.45
Affected by 1 other vulnerability.

10.0.5
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
VCID-dy6m-zt6r-9ubd	Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.	CVE-2021-41079 GHSA-59g9-7gfx-c72p
VCID-k9cg-ehdw-dbh6	Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.	CVE-2024-21733 GHSA-f4qf-m5gf-8jm8

Vulnerability

Summary

Aliases

VCID-dy6m-zt6r-9ubd

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

CVE-2021-41079
GHSA-59g9-7gfx-c72p

VCID-k9cg-ehdw-dbh6

Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.

CVE-2024-21733
GHSA-f4qf-m5gf-8jm8

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:08.208265+00:00	Apache Tomcat Importer	Fixing	VCID-k9cg-ehdw-dbh6	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:08.178886+00:00	Apache Tomcat Importer	Fixing	VCID-dy6m-zt6r-9ubd	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:08.150439+00:00	Apache Tomcat Importer	Affected by	VCID-dtvw-92bk-wbcf	https://tomcat.apache.org/security-9.html	38.0.0