Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat@7.0.105
purl pkg:maven/org.apache.tomcat/tomcat@7.0.105
Next non-vulnerable version 9.0.117
Latest non-vulnerable version 11.0.21
Risk 4.0
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-a8gk-n8bq-87cp
Aliases:
CVE-2021-24122
GHSA-2rvv-w9r2-rg7m
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
7.0.107
Affected by 4 other vulnerabilities.
8.5.60
Affected by 12 other vulnerabilities.
9.0.40
Affected by 12 other vulnerabilities.
10.0.0-M10
Affected by 1 other vulnerability.
VCID-e7kd-kk57-mkd6
Aliases:
CVE-2020-8022
GHSA-gc58-v8h3-x2gr
A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.
8.0.53
Affected by 1 other vulnerability.
9.0.35
Affected by 12 other vulnerabilities.
VCID-kwab-3s4q-eka4
Aliases:
CVE-2021-30640
GHSA-36qh-35cm-5w2w
A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65.
7.0.109
Affected by 2 other vulnerabilities.
8.5.65
Affected by 9 other vulnerabilities.
8.5.66
Affected by 9 other vulnerabilities.
9.0.45
Affected by 8 other vulnerabilities.
9.0.46
Affected by 8 other vulnerabilities.
10.0.5
Affected by 6 other vulnerabilities.
10.0.6
Affected by 6 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-nvbx-q971-skgm The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service. CVE-2020-13935
GHSA-m7jv-hq7h-mq7c

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-16T21:38:31.748993+00:00 GitLab Importer Affected by VCID-e7kd-kk57-mkd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2020-8022.yml 38.4.0
2026-04-16T21:27:27.048863+00:00 GitLab Importer Affected by VCID-kwab-3s4q-eka4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2021-30640.yml 38.4.0
2026-04-16T21:15:51.289799+00:00 GitLab Importer Affected by VCID-a8gk-n8bq-87cp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2021-24122.yml 38.4.0
2026-04-11T22:53:17.035924+00:00 GitLab Importer Affected by VCID-e7kd-kk57-mkd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2020-8022.yml 38.3.0
2026-04-11T22:40:23.653543+00:00 GitLab Importer Affected by VCID-kwab-3s4q-eka4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2021-30640.yml 38.3.0
2026-04-11T22:27:59.090071+00:00 GitLab Importer Affected by VCID-a8gk-n8bq-87cp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2021-24122.yml 38.3.0
2026-04-02T23:02:36.778371+00:00 GitLab Importer Affected by VCID-e7kd-kk57-mkd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2020-8022.yml 38.1.0
2026-04-02T22:50:53.729501+00:00 GitLab Importer Affected by VCID-kwab-3s4q-eka4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2021-30640.yml 38.1.0
2026-04-02T22:39:37.872541+00:00 GitLab Importer Affected by VCID-a8gk-n8bq-87cp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2021-24122.yml 38.1.0
2026-04-01T17:21:28.105406+00:00 GitLab Importer Affected by VCID-e7kd-kk57-mkd6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2020-8022.yml 38.0.0
2026-04-01T17:08:53.995420+00:00 GitLab Importer Affected by VCID-kwab-3s4q-eka4 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2021-30640.yml 38.0.0
2026-04-01T16:57:01.433585+00:00 GitLab Importer Affected by VCID-a8gk-n8bq-87cp https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2021-24122.yml 38.0.0
2026-04-01T15:59:29.330375+00:00 GHSA Importer Fixing VCID-nvbx-q971-skgm https://github.com/advisories/GHSA-m7jv-hq7h-mq7c 38.0.0
2026-04-01T13:06:03.077715+00:00 GithubOSV Importer Fixing VCID-nvbx-q971-skgm https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-m7jv-hq7h-mq7c/GHSA-m7jv-hq7h-mq7c.json 38.0.0
2026-04-01T12:38:13.543313+00:00 Apache Tomcat Importer Fixing VCID-nvbx-q971-skgm https://tomcat.apache.org/security-7.html 38.0.0