Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.0.0-RC1
purl pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.0.0-RC1
Next non-vulnerable version 9.0.107
Latest non-vulnerable version 11.0.21
Risk 10.0
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-2sr7-c3j5-cfhg
Aliases:
CVE-2014-0095
GHSA-wf5v-jhxj-q632
java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.
8.0.4
Affected by 0 other vulnerabilities.
8.0.5
Affected by 8 other vulnerabilities.
VCID-e7kd-kk57-mkd6
Aliases:
CVE-2020-8022
GHSA-gc58-v8h3-x2gr
A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.
8.0.53
Affected by 3 other vulnerabilities.
9.0.35
Affected by 16 other vulnerabilities.
VCID-vdnj-sqmx-e3ep
Aliases:
CVE-2017-12617
GHSA-xjgh-84hx-56c5
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
8.0.47
Affected by 4 other vulnerabilities.
8.5.23
Affected by 22 other vulnerabilities.
9.0.1
Affected by 22 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-16T21:52:26.235145+00:00 GitLab Importer Affected by VCID-2sr7-c3j5-cfhg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2014-0095.yml 38.4.0
2026-04-16T21:38:50.771303+00:00 GitLab Importer Affected by VCID-e7kd-kk57-mkd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2020-8022.yml 38.4.0
2026-04-11T23:08:10.406281+00:00 GitLab Importer Affected by VCID-2sr7-c3j5-cfhg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2014-0095.yml 38.3.0
2026-04-11T22:53:56.143823+00:00 GitLab Importer Affected by VCID-e7kd-kk57-mkd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2020-8022.yml 38.3.0
2026-04-04T14:31:05.640499+00:00 GHSA Importer Affected by VCID-2sr7-c3j5-cfhg https://github.com/advisories/GHSA-wf5v-jhxj-q632 38.1.0
2026-04-04T14:30:15.967025+00:00 GHSA Importer Affected by VCID-vdnj-sqmx-e3ep https://github.com/advisories/GHSA-xjgh-84hx-56c5 38.1.0
2026-04-02T23:16:40.731101+00:00 GitLab Importer Affected by VCID-2sr7-c3j5-cfhg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2014-0095.yml 38.1.0
2026-04-02T23:03:09.913570+00:00 GitLab Importer Affected by VCID-e7kd-kk57-mkd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2020-8022.yml 38.1.0
2026-04-01T17:22:03.696132+00:00 GitLab Importer Affected by VCID-e7kd-kk57-mkd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2020-8022.yml 38.0.0
2026-04-01T12:50:41.916487+00:00 GitLab Importer Affected by VCID-2sr7-c3j5-cfhg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2014-0095.yml 38.0.0