VulnerableCode Package Details - pkg:apache/tomcat@9.0.0%2BM19

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-3pmw-yhnf-aaaj	Information Exposure The refactoring of the HTTP connectors introduced a regression in the send file processing. If the file processing completed quickly, it is possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.	CVE-2017-5651 GHSA-9hg2-395j-83rm
VCID-gd2a-2tnw-aaap	Improper Resource Shutdown or Release The handling of an HTTP/2 `GOAWAY` frame for a connection did not close streams associated with that connection that were currently waiting for a `WINDOW_UPDATE` before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.	CVE-2017-5650 GHSA-9785-w233-x6hv
VCID-w4q7-4d2t-aaan	Information Exposure When "send file" is used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.	CVE-2017-5647 GHSA-3gv7-3h64-78cm

Vulnerability

Summary

Aliases

VCID-3pmw-yhnf-aaaj

Information Exposure The refactoring of the HTTP connectors introduced a regression in the send file processing. If the file processing completed quickly, it is possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.

CVE-2017-5651
GHSA-9hg2-395j-83rm

VCID-gd2a-2tnw-aaap

Improper Resource Shutdown or Release The handling of an HTTP/2 `GOAWAY` frame for a connection did not close streams associated with that connection that were currently waiting for a `WINDOW_UPDATE` before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.

CVE-2017-5650
GHSA-9785-w233-x6hv

VCID-w4q7-4d2t-aaan

Information Exposure When "send file" is used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.

CVE-2017-5647
GHSA-3gv7-3h64-78cm

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-03-28T13:19:19.866840+00:00	Apache Tomcat Importer	Fixing	VCID-w4q7-4d2t-aaan	https://tomcat.apache.org/security-9.html	36.0.0
2025-03-28T13:19:19.807301+00:00	Apache Tomcat Importer	Fixing	VCID-gd2a-2tnw-aaap	https://tomcat.apache.org/security-9.html	36.0.0
2025-03-28T13:19:19.746537+00:00	Apache Tomcat Importer	Fixing	VCID-3pmw-yhnf-aaaj	https://tomcat.apache.org/security-9.html	36.0.0
2024-09-18T08:17:30.607299+00:00	Apache Tomcat Importer	Fixing	VCID-w4q7-4d2t-aaan	https://tomcat.apache.org/security-9.html	34.0.1
2024-09-18T08:17:30.557717+00:00	Apache Tomcat Importer	Fixing	VCID-gd2a-2tnw-aaap	https://tomcat.apache.org/security-9.html	34.0.1
2024-09-18T08:17:30.499837+00:00	Apache Tomcat Importer	Fixing	VCID-3pmw-yhnf-aaaj	https://tomcat.apache.org/security-9.html	34.0.1
2024-01-04T02:15:34.735857+00:00	Apache Tomcat Importer	Fixing	VCID-w4q7-4d2t-aaan	https://tomcat.apache.org/security-9.html	34.0.0rc1
2024-01-04T02:15:34.682225+00:00	Apache Tomcat Importer	Fixing	VCID-gd2a-2tnw-aaap	https://tomcat.apache.org/security-9.html	34.0.0rc1
2024-01-04T02:15:34.626802+00:00	Apache Tomcat Importer	Fixing	VCID-3pmw-yhnf-aaaj	https://tomcat.apache.org/security-9.html	34.0.0rc1