Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@9.0.92
purl pkg:apache/tomcat@9.0.92
Next non-vulnerable version 9.0.99
Latest non-vulnerable version 11.0.21
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-8e1c-rbkg-v7c2
Aliases:
CVE-2026-34500
GHSA-24j9-x2wg-9qv6
9.0.117
Affected by 0 other vulnerabilities.
10.1.54
Affected by 0 other vulnerabilities.
11.0.21
Affected by 0 other vulnerabilities.
VCID-9qgr-t27j-y7d3
Aliases:
CVE-2024-52317
GHSA-qvf5-hvjx-wm27
Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.
9.0.96
Affected by 1 other vulnerability.
10.1.31
Affected by 1 other vulnerability.
11.0.0
Affected by 3 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-10T00:03:26.933612+00:00 Apache Tomcat Importer Affected by VCID-8e1c-rbkg-v7c2 https://tomcat.apache.org/security-9.html 38.1.0
2026-04-01T12:38:07.393471+00:00 Apache Tomcat Importer Affected by VCID-9qgr-t27j-y7d3 https://tomcat.apache.org/security-9.html 38.0.0