Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.0-M1
purl pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.0-M1
Tags Ghost
Next non-vulnerable version 9.0.96
Latest non-vulnerable version 11.0.21
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-b3bb-9ajg-sfc9
Aliases:
CVE-2023-46589
GHSA-fccv-jmmp-qg76
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.
9.0.83
Affected by 2 other vulnerabilities.
10.1.16
Affected by 1 other vulnerability.
11.0.0-M11
Affected by 1 other vulnerability.
VCID-v7tp-1t4h-zqeg
Aliases:
CVE-2023-28708
GHSA-2c9m-w27f-53rm
When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel. Older, EOL versions may also be affected.
9.0.72
Affected by 2 other vulnerabilities.
10.1.6
Affected by 2 other vulnerabilities.
11.0.0-M3
Affected by 1 other vulnerability.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-02T17:00:46.112595+00:00 GHSA Importer Affected by VCID-b3bb-9ajg-sfc9 https://github.com/advisories/GHSA-fccv-jmmp-qg76 38.1.0
2026-04-02T16:59:09.232380+00:00 GHSA Importer Affected by VCID-v7tp-1t4h-zqeg https://github.com/advisories/GHSA-2c9m-w27f-53rm 38.1.0