Search for packages
| purl | pkg:maven/tomcat/catalina@10.1.0 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-b3bb-9ajg-sfc9
Aliases: CVE-2023-46589 GHSA-fccv-jmmp-qg76 |
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue. | There are no reported fixed by versions. |
|
VCID-j6cj-ftyd-3ffa
Aliases: CVE-2023-41080 GHSA-q3mw-pvr8-9ggc |
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application. | There are no reported fixed by versions. |
|
VCID-j8tk-s915-pbfy
Aliases: CVE-2021-43980 GHSA-jx7c-7mj5-9438 |
The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-03T21:27:54.991382+00:00 | GitLab Importer | Affected by | VCID-j8tk-s915-pbfy | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/tomcat/catalina/CVE-2021-43980.yml | 38.1.0 |
| 2026-04-01T12:52:10.325670+00:00 | GitLab Importer | Affected by | VCID-b3bb-9ajg-sfc9 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/tomcat/catalina/CVE-2023-46589.yml | 38.0.0 |
| 2026-04-01T12:51:44.326464+00:00 | GitLab Importer | Affected by | VCID-j6cj-ftyd-3ffa | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/tomcat/catalina/CVE-2023-41080.yml | 38.0.0 |