VulnerableCode Package Details - pkg:apache/tomcat@10.1.43

Search for packages

Vulnerability	Summary	Fixed by
VCID-2c1v-7he2-4fe5 Aliases: CVE-2025-48989 GHSA-gqp3-2cvr-x8m3	Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.	10.1.44 Affected by 0 other vulnerabilities. 11.0.10 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-2c1v-7he2-4fe5
Aliases:
CVE-2025-48989
GHSA-gqp3-2cvr-x8m3

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

10.1.44
Affected by 0 other vulnerabilities.

11.0.10
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-7498-2z96-w3aa	For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.	CVE-2025-52520 GHSA-wr62-c79q-cv37
VCID-dk83-wt6s-c3a7	Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.	CVE-2025-53506 GHSA-25xr-qj8w-c4vf

Vulnerability

Summary

Aliases

VCID-7498-2z96-w3aa

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

CVE-2025-52520
GHSA-wr62-c79q-cv37

VCID-dk83-wt6s-c3a7

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

CVE-2025-53506
GHSA-25xr-qj8w-c4vf

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-08-14T08:24:36.230461+00:00	Apache Tomcat Importer	Affected by	VCID-2c1v-7he2-4fe5	https://tomcat.apache.org/security-10.html	37.0.0
2025-07-31T08:03:16.733566+00:00	Apache Tomcat Importer	Fixing	VCID-dk83-wt6s-c3a7	https://tomcat.apache.org/security-10.html	37.0.0
2025-07-31T08:03:16.708671+00:00	Apache Tomcat Importer	Fixing	VCID-7498-2z96-w3aa	https://tomcat.apache.org/security-10.html	37.0.0