VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat-util@10.0.2

Search for packages

Vulnerability	Summary	Fixed by
VCID-j8tk-s915-pbfy Aliases: CVE-2021-43980 GHSA-jx7c-7mj5-9438	The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.	10.0.20 Affected by 0 other vulnerabilities. 10.1.1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-j8tk-s915-pbfy
Aliases:
CVE-2021-43980
GHSA-jx7c-7mj5-9438

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

10.0.20
Affected by 0 other vulnerabilities.

10.1.1
Affected by 2 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-a8gk-n8bq-87cp	When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.	CVE-2021-24122 GHSA-2rvv-w9r2-rg7m

Vulnerability

Summary

Aliases

VCID-a8gk-n8bq-87cp

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.

CVE-2021-24122
GHSA-2rvv-w9r2-rg7m

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-11T23:28:09.531162+00:00	GitLab Importer	Affected by	VCID-j8tk-s915-pbfy	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-util/CVE-2021-43980.yml	38.3.0
2026-04-11T22:28:02.932843+00:00	GitLab Importer	Fixing	VCID-a8gk-n8bq-87cp	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-util/CVE-2021-24122.yml	38.3.0
2026-04-02T23:33:58.396124+00:00	GitLab Importer	Affected by	VCID-j8tk-s915-pbfy	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-util/CVE-2021-43980.yml	38.1.0
2026-04-02T22:39:41.287596+00:00	GitLab Importer	Fixing	VCID-a8gk-n8bq-87cp	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-util/CVE-2021-24122.yml	38.1.0
2026-04-01T17:55:55.248160+00:00	GitLab Importer	Affected by	VCID-j8tk-s915-pbfy	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-util/CVE-2021-43980.yml	38.0.0
2026-04-01T16:57:05.241552+00:00	GitLab Importer	Fixing	VCID-a8gk-n8bq-87cp	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-util/CVE-2021-24122.yml	38.0.0