Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat@9.0.92
purl pkg:maven/org.apache.tomcat/tomcat@9.0.92
Tags Ghost
Next non-vulnerable version 9.0.117
Latest non-vulnerable version 11.0.21
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-8e1c-rbkg-v7c2
Aliases:
CVE-2026-34500
GHSA-24j9-x2wg-9qv6
9.0.117
Affected by 0 other vulnerabilities.
10.1.54
Affected by 0 other vulnerabilities.
11.0.21
Affected by 0 other vulnerabilities.
VCID-9qgr-t27j-y7d3
Aliases:
CVE-2024-52317
GHSA-qvf5-hvjx-wm27
Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.
9.0.96
Affected by 2 other vulnerabilities.
10.1.31
Affected by 2 other vulnerabilities.
11.0.0
Affected by 6 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-13T07:05:08.606690+00:00 GHSA Importer Affected by VCID-8e1c-rbkg-v7c2 https://github.com/advisories/GHSA-24j9-x2wg-9qv6 38.3.0
2026-04-10T00:03:26.955667+00:00 Apache Tomcat Importer Affected by VCID-8e1c-rbkg-v7c2 https://tomcat.apache.org/security-9.html 38.1.0
2026-04-01T12:38:07.405306+00:00 Apache Tomcat Importer Affected by VCID-9qgr-t27j-y7d3 https://tomcat.apache.org/security-9.html 38.0.0