Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat-util@9.0.69
purl pkg:maven/org.apache.tomcat/tomcat-util@9.0.69
Next non-vulnerable version 9.0.83
Latest non-vulnerable version 11.0.1
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-b3bb-9ajg-sfc9
Aliases:
CVE-2023-46589
GHSA-fccv-jmmp-qg76
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.
9.0.83
Affected by 0 other vulnerabilities.
10.1.16
Affected by 0 other vulnerabilities.
11.0.1
Affected by 0 other vulnerabilities.
VCID-j6cj-ftyd-3ffa
Aliases:
CVE-2023-41080
GHSA-q3mw-pvr8-9ggc
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application.
9.0.80
Affected by 1 other vulnerability.
10.1.13
Affected by 1 other vulnerability.
11.0.1
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-stds-vw5z-auhp The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output. CVE-2022-45143
GHSA-rq2w-37h9-vg94

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-16T22:44:16.583996+00:00 GitLab Importer Affected by VCID-b3bb-9ajg-sfc9 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-util/CVE-2023-46589.yml 38.4.0
2026-04-16T22:36:52.471625+00:00 GitLab Importer Affected by VCID-j6cj-ftyd-3ffa https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-util/CVE-2023-41080.yml 38.4.0
2026-04-12T00:03:53.915336+00:00 GitLab Importer Affected by VCID-b3bb-9ajg-sfc9 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-util/CVE-2023-46589.yml 38.3.0
2026-04-11T23:56:10.183374+00:00 GitLab Importer Affected by VCID-j6cj-ftyd-3ffa https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-util/CVE-2023-41080.yml 38.3.0
2026-04-03T00:08:34.388655+00:00 GitLab Importer Affected by VCID-b3bb-9ajg-sfc9 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-util/CVE-2023-46589.yml 38.1.0
2026-04-02T23:59:14.893973+00:00 GitLab Importer Affected by VCID-j6cj-ftyd-3ffa https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-util/CVE-2023-41080.yml 38.1.0
2026-04-02T16:58:43.194306+00:00 GHSA Importer Fixing VCID-stds-vw5z-auhp https://github.com/advisories/GHSA-rq2w-37h9-vg94 38.1.0
2026-04-01T12:57:53.493469+00:00 GithubOSV Importer Fixing VCID-stds-vw5z-auhp https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-rq2w-37h9-vg94/GHSA-rq2w-37h9-vg94.json 38.0.0