Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@9.0.83
purl pkg:apache/tomcat@9.0.83
Next non-vulnerable version 9.0.86
Latest non-vulnerable version 11.0.21
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-8war-4v58-eub2
Aliases:
CVE-2026-24734
GHSA-mgp5-rv84-w37q
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
9.0.115
Affected by 6 other vulnerabilities.
10.1.52
Affected by 6 other vulnerabilities.
11.0.18
Affected by 5 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-b3bb-9ajg-sfc9 Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue. CVE-2023-46589
GHSA-fccv-jmmp-qg76

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T12:38:07.574110+00:00 Apache Tomcat Importer Fixing VCID-b3bb-9ajg-sfc9 https://tomcat.apache.org/security-9.html 38.0.0
2026-04-01T12:38:06.669428+00:00 Apache Tomcat Importer Affected by VCID-8war-4v58-eub2 https://tomcat.apache.org/security-9.html 38.0.0