{"url":"http://public2.vulnerablecode.io/api/packages/1332?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@7.0.21","type":"maven","namespace":"org.apache.tomcat","name":"tomcat","version":"7.0.21","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"9.0.118","latest_non_vulnerable_version":"11.0.22","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/4585?format=json","vulnerability_id":"VCID-hxj6-mupf-abbc","summary":"Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-3375.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-3375.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2011-3375","reference_id":"","reference_type":"","scores":[{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83916","published_at":"2026-05-14T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83789","published_at":"2026-04-24T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83798","published_at":"2026-04-26T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83805","published_at":"2026-04-29T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83829","published_at":"2026-05-05T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.8385","published_at":"2026-05-07T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83867","published_at":"2026-05-09T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83866","published_at":"2026-05-11T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83882","published_at":"2026-05-12T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83665","published_at":"2026-04-01T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83678","published_at":"2026-04-02T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83692","published_at":"2026-04-04T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83695","published_at":"2026-04-07T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83718","published_at":"2026-04-08T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83725","published_at":"2026-04-09T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83741","published_at":"2026-04-11T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83735","published_at":"2026-04-12T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.8373","published_at":"2026-04-13T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83764","published_at":"2026-04-16T12:55:00Z"},{"value":"0.02015","scoring_system":"epss","scoring_elements":"0.83765","published_at":"2026-04-21T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2011-3375"},{"reference_url":"https://github.com/apache/tomcat","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/tomcat"},{"reference_url":"https://github.com/apache/tomcat70/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/tomcat70/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21"},{"reference_url":"https://github.com/apache/tomcat/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/tomcat/commit/9eae334e9492f55a841e6eb7ab302ff11d03ab21"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3375","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-3375"},{"reference_url":"https://svn.apache.org/viewvc?view=rev&rev=1176592","reference_id":"","reference_type":"","scores":[],"url":"https://svn.apache.org/viewvc?view=rev&rev=1176592"},{"reference_url":"https://svn.apache.org/viewvc?view=rev&rev=1185998","reference_id":"","reference_type":"","scores":[],"url":"https://svn.apache.org/viewvc?view=rev&rev=1185998"},{"reference_url":"http://tomcat.apache.org/security-6.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://tomcat.apache.org/security-6.html"},{"reference_url":"http://tomcat.apache.org/security-7.html","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://tomcat.apache.org/security-7.html"},{"reference_url":"http://www.debian.org/security/2012/dsa-2401","reference_id":"","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.debian.org/security/2012/dsa-2401"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=782624","reference_id":"782624","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=782624"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3375","reference_id":"CVE-2011-3375","reference_type":"","scores":[{"value":"Important","scoring_system":"apache_tomcat","scoring_elements":""}],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3375"},{"reference_url":"https://github.com/advisories/GHSA-rp8h-vr48-4j8p","reference_id":"GHSA-rp8h-vr48-4j8p","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-rp8h-vr48-4j8p"},{"reference_url":"https://security.gentoo.org/glsa/201206-24","reference_id":"GLSA-201206-24","reference_type":"","scores":[],"url":"https://security.gentoo.org/glsa/201206-24"},{"reference_url":"https://access.redhat.com/errata/RHSA-2012:0681","reference_id":"RHSA-2012:0681","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2012:0681"},{"reference_url":"https://access.redhat.com/errata/RHSA-2012:0682","reference_id":"RHSA-2012:0682","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2012:0682"},{"reference_url":"https://usn.ubuntu.com/1359-1/","reference_id":"USN-1359-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/1359-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1330?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@7.0.22","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-hhk9-cr54-8fgc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@7.0.22"}],"aliases":["CVE-2011-3375","GHSA-rp8h-vr48-4j8p"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-hxj6-mupf-abbc"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/4589?format=json","vulnerability_id":"VCID-j2j9-avuw-n3eq","summary":"org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-3376.json","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2011-3376.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2011-3376","reference_id":"","reference_type":"","scores":[{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53341","published_at":"2026-05-14T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53175","published_at":"2026-04-01T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53199","published_at":"2026-04-02T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53224","published_at":"2026-04-04T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53192","published_at":"2026-04-07T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53245","published_at":"2026-04-08T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53239","published_at":"2026-04-09T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.5329","published_at":"2026-04-11T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53275","published_at":"2026-04-12T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53258","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53296","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53302","published_at":"2026-04-18T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53282","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53253","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53264","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53227","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53184","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53235","published_at":"2026-05-07T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53286","published_at":"2026-05-09T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53247","published_at":"2026-05-11T12:55:00Z"},{"value":"0.00299","scoring_system":"epss","scoring_elements":"0.53274","published_at":"2026-05-12T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2011-3376"},{"reference_url":"https://svn.apache.org/viewvc?view=rev&rev=1176588","reference_id":"","reference_type":"","scores":[],"url":"https://svn.apache.org/viewvc?view=rev&rev=1176588"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=752371","reference_id":"752371","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=752371"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3376","reference_id":"CVE-2011-3376","reference_type":"","scores":[{"value":"Low","scoring_system":"apache_tomcat","scoring_elements":""}],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3376"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1330?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@7.0.22","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-hhk9-cr54-8fgc"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@7.0.22"}],"aliases":["CVE-2011-3376"],"risk_score":1.4,"exploitability":"0.5","weighted_severity":"2.7","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-j2j9-avuw-n3eq"}],"fixing_vulnerabilities":[],"risk_score":"4.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@7.0.21"}