Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@9.0.89
purl pkg:apache/tomcat@9.0.89
Next non-vulnerable version 9.0.90
Latest non-vulnerable version 11.0.21
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-3vdn-j7sj-dfdn
Aliases:
CVE-2024-38286
GHSA-7jqf-v358-p8g7
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
9.0.90
Affected by 0 other vulnerabilities.
10.1.25
Affected by 0 other vulnerabilities.
11.0.0-M21
Affected by 0 other vulnerabilities.
VCID-8myk-ac5b-huh8
Aliases:
CVE-2024-34750
GHSA-wm9w-rjj3-j356
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.
9.0.90
Affected by 0 other vulnerabilities.
10.1.25
Affected by 0 other vulnerabilities.
11.0.0-M21
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T12:38:07.484629+00:00 Apache Tomcat Importer Affected by VCID-3vdn-j7sj-dfdn https://tomcat.apache.org/security-9.html 38.0.0
2026-04-01T12:38:07.455281+00:00 Apache Tomcat Importer Affected by VCID-8myk-ac5b-huh8 https://tomcat.apache.org/security-9.html 38.0.0