VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat-catalina@11.0.7

Search for packages

Vulnerability	Summary	Fixed by
VCID-246u-a4rh-yyd4 Aliases: CVE-2025-49125 GHSA-wc4r-xq3c-5cf3	Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.	11.0.8 Affected by 0 other vulnerabilities.
VCID-gb2v-96xj-ybad Aliases: CVE-2025-48988 GHSA-h3gc-qfqq-6h8f	Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.	11.0.8 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-246u-a4rh-yyd4
Aliases:
CVE-2025-49125
GHSA-wc4r-xq3c-5cf3

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

11.0.8
Affected by 0 other vulnerabilities.

VCID-gb2v-96xj-ybad
Aliases:
CVE-2025-48988
GHSA-h3gc-qfqq-6h8f

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.

11.0.8
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-sr8e-w1qk-r7fz	Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.	CVE-2025-46701 GHSA-h2fw-rfh5-95r3

Vulnerability

Summary

Aliases

VCID-sr8e-w1qk-r7fz

Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.

CVE-2025-46701
GHSA-h2fw-rfh5-95r3

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T23:29:50.671604+00:00	GitLab Importer	Fixing	VCID-sr8e-w1qk-r7fz	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-catalina/CVE-2025-46701.yml	38.4.0
2026-04-12T00:49:31.057998+00:00	GitLab Importer	Fixing	VCID-sr8e-w1qk-r7fz	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-catalina/CVE-2025-46701.yml	38.3.0
2026-04-07T04:58:03.896505+00:00	GHSA Importer	Affected by	VCID-246u-a4rh-yyd4	https://github.com/advisories/GHSA-wc4r-xq3c-5cf3	38.1.0
2026-04-07T04:58:03.580836+00:00	GHSA Importer	Affected by	VCID-gb2v-96xj-ybad	https://github.com/advisories/GHSA-h3gc-qfqq-6h8f	38.1.0
2026-04-07T04:57:53.703577+00:00	GHSA Importer	Fixing	VCID-sr8e-w1qk-r7fz	https://github.com/advisories/GHSA-h2fw-rfh5-95r3	38.1.0
2026-04-03T00:57:29.174744+00:00	GitLab Importer	Fixing	VCID-sr8e-w1qk-r7fz	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-catalina/CVE-2025-46701.yml	38.1.0
2026-04-02T12:41:28.732662+00:00	GitLab Importer	Fixing	VCID-sr8e-w1qk-r7fz	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-catalina/CVE-2025-46701.yml	38.0.0
2026-04-01T12:57:00.786754+00:00	GithubOSV Importer	Fixing	VCID-sr8e-w1qk-r7fz	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-h2fw-rfh5-95r3/GHSA-h2fw-rfh5-95r3.json	38.0.0