Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/tomcat9@9.0.16-1?distro=trixie
purl pkg:deb/debian/tomcat9@9.0.16-1?distro=trixie
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-wbaq-j85q-y3c6 The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. CVE-2019-0199
GHSA-qcxh-w3j9-58qr

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-16T12:40:34.948665+00:00 Debian Importer Fixing VCID-wbaq-j85q-y3c6 https://security-tracker.debian.org/tracker/data/json 38.4.0
2026-04-13T08:41:16.781660+00:00 Debian Importer Fixing VCID-wbaq-j85q-y3c6 https://security-tracker.debian.org/tracker/data/json 38.3.0
2026-04-03T07:55:24.089597+00:00 Debian Importer Fixing VCID-wbaq-j85q-y3c6 https://security-tracker.debian.org/tracker/data/json 38.1.0