VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100

Search for packages

Vulnerability	Summary	Fixed by
VCID-2zq1-na8s-mfdd Aliases: CVE-2025-31650 GHSA-3p2h-wqq4-wf4h	Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.	9.0.104 Affected by 0 other vulnerabilities. 10.1.40 Affected by 0 other vulnerabilities. 11.0.6 Affected by 0 other vulnerabilities.
VCID-8myk-ac5b-huh8 Aliases: CVE-2024-34750 GHSA-wm9w-rjj3-j356	Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.	9.0.90 Affected by 0 other vulnerabilities. 10.1.25 Affected by 0 other vulnerabilities. 11.0.0-M21 Affected by 0 other vulnerabilities.
VCID-fpgj-82wf-ykbw Aliases: CVE-2025-53506 GHSA-25xr-qj8w-c4vf	Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.	9.0.107 Affected by 0 other vulnerabilities. 10.1.43 Affected by 0 other vulnerabilities. 11.0.9 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-2zq1-na8s-mfdd
Aliases:
CVE-2025-31650
GHSA-3p2h-wqq4-wf4h

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.90 though 8.5.100. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

9.0.104
Affected by 0 other vulnerabilities.

10.1.40
Affected by 0 other vulnerabilities.

11.0.6
Affected by 0 other vulnerabilities.

VCID-8myk-ac5b-huh8
Aliases:
CVE-2024-34750
GHSA-wm9w-rjj3-j356

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.

9.0.90
Affected by 0 other vulnerabilities.

10.1.25
Affected by 0 other vulnerabilities.

11.0.0-M21
Affected by 0 other vulnerabilities.

VCID-fpgj-82wf-ykbw
Aliases:
CVE-2025-53506
GHSA-25xr-qj8w-c4vf

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other EOL versions may also be affected. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

9.0.107
Affected by 0 other vulnerabilities.

10.1.43
Affected by 0 other vulnerabilities.

11.0.9
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-07T04:58:11.680807+00:00	GHSA Importer	Affected by	VCID-fpgj-82wf-ykbw	https://github.com/advisories/GHSA-25xr-qj8w-c4vf	38.1.0
2026-04-07T04:57:41.930802+00:00	GHSA Importer	Affected by	VCID-2zq1-na8s-mfdd	https://github.com/advisories/GHSA-3p2h-wqq4-wf4h	38.1.0
2026-04-01T16:05:57.102581+00:00	GHSA Importer	Affected by	VCID-8myk-ac5b-huh8	https://github.com/advisories/GHSA-wm9w-rjj3-j356	38.0.0