Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat@4.1.15
purl pkg:maven/org.apache.tomcat/tomcat@4.1.15
Tags Ghost
Next non-vulnerable version 9.0.117
Latest non-vulnerable version 11.0.21
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-1bxf-s34t-sffn
Aliases:
CVE-2005-4836
GHSA-qrcx-p4rr-g48h
The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information. There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T16:00:27.292904+00:00 GHSA Importer Affected by VCID-1bxf-s34t-sffn https://github.com/advisories/GHSA-qrcx-p4rr-g48h 38.0.0
2026-04-01T12:49:57.133493+00:00 GitLab Importer Affected by VCID-1bxf-s34t-sffn https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2005-4836.yml 38.0.0
2026-04-01T12:38:19.539347+00:00 Apache Tomcat Importer Affected by VCID-1bxf-s34t-sffn https://tomcat.apache.org/security-4.html 38.0.0