Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat@9.0.9
purl pkg:maven/org.apache.tomcat/tomcat@9.0.9
Tags Ghost
Next non-vulnerable version 9.0.117
Latest non-vulnerable version 11.0.21
Risk 4.1
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-m2zn-ja8d-7kg8
Aliases:
CVE-2018-8034
GHSA-46j3-r4pj-4835
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
9.0.10
Affected by 20 other vulnerabilities.
VCID-xshb-a2kb-c7gs
Aliases:
CVE-2018-8037
GHSA-6v52-mj5r-7j2m
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.
9.0.10
Affected by 20 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T12:47:54.479950+00:00 GitLab Importer Affected by VCID-xshb-a2kb-c7gs https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2018-8037.yml 38.0.0
2026-04-01T12:47:54.227589+00:00 GitLab Importer Affected by VCID-m2zn-ja8d-7kg8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2018-8034.yml 38.0.0
2026-04-01T12:38:08.986949+00:00 Apache Tomcat Importer Fixing VCID-n3zn-tuck-gkfe https://tomcat.apache.org/security-9.html 38.0.0
2026-04-01T12:38:08.953560+00:00 Apache Tomcat Importer Affected by VCID-xshb-a2kb-c7gs https://tomcat.apache.org/security-9.html 38.0.0
2026-04-01T12:38:08.914506+00:00 Apache Tomcat Importer Affected by VCID-m2zn-ja8d-7kg8 https://tomcat.apache.org/security-9.html 38.0.0