VulnerableCode Package Details - pkg:apache/tomcat@9.0.9

Search for packages

Vulnerability	Summary	Fixed by
VCID-m2zn-ja8d-7kg8 Aliases: CVE-2018-8034 GHSA-46j3-r4pj-4835	The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.	9.0.10 Affected by 0 other vulnerabilities.
VCID-xshb-a2kb-c7gs Aliases: CVE-2018-8037 GHSA-6v52-mj5r-7j2m	If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.	9.0.10 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-m2zn-ja8d-7kg8
Aliases:
CVE-2018-8034
GHSA-46j3-r4pj-4835

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

9.0.10
Affected by 0 other vulnerabilities.

VCID-xshb-a2kb-c7gs
Aliases:
CVE-2018-8037
GHSA-6v52-mj5r-7j2m

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.

9.0.10
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-n3zn-tuck-gkfe	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.	CVE-2018-8014 GHSA-r4x2-3cq5-hqvp

Vulnerability

Summary

Aliases

VCID-n3zn-tuck-gkfe

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

CVE-2018-8014
GHSA-r4x2-3cq5-hqvp

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:08.975733+00:00	Apache Tomcat Importer	Fixing	VCID-n3zn-tuck-gkfe	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:08.940005+00:00	Apache Tomcat Importer	Affected by	VCID-xshb-a2kb-c7gs	https://tomcat.apache.org/security-9.html	38.0.0
2026-04-01T12:38:08.902447+00:00	Apache Tomcat Importer	Affected by	VCID-m2zn-ja8d-7kg8	https://tomcat.apache.org/security-9.html	38.0.0