VulnerableCode Package Details - pkg:apache/tomcat@9.0.107

Search for packages

Vulnerability	Summary	Fixed by
VCID-2c1v-7he2-4fe5 Aliases: CVE-2025-48989 GHSA-gqp3-2cvr-x8m3	Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.	9.0.108 Affected by 0 other vulnerabilities. 10.1.44 Affected by 0 other vulnerabilities. 11.0.10 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-2c1v-7he2-4fe5
Aliases:
CVE-2025-48989
GHSA-gqp3-2cvr-x8m3

Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.

9.0.108
Affected by 0 other vulnerabilities.

10.1.44
Affected by 0 other vulnerabilities.

11.0.10
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-7498-2z96-w3aa	For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.	CVE-2025-52520 GHSA-wr62-c79q-cv37
VCID-dk83-wt6s-c3a7	Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.	CVE-2025-53506 GHSA-25xr-qj8w-c4vf
VCID-tc17-t52j-nyh4	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 9.0.107, which fixes the issue.	CVE-2025-52434 GHSA-4j3c-42xv-3f84

Vulnerability

Summary

Aliases

VCID-7498-2z96-w3aa

For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

CVE-2025-52520
GHSA-wr62-c79q-cv37

VCID-dk83-wt6s-c3a7

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

CVE-2025-53506
GHSA-25xr-qj8w-c4vf

VCID-tc17-t52j-nyh4

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections. This issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 9.0.107, which fixes the issue.

CVE-2025-52434
GHSA-4j3c-42xv-3f84

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-08-14T08:24:36.488222+00:00	Apache Tomcat Importer	Affected by	VCID-2c1v-7he2-4fe5	https://tomcat.apache.org/security-9.html	37.0.0
2025-07-31T08:03:18.364195+00:00	Apache Tomcat Importer	Fixing	VCID-dk83-wt6s-c3a7	https://tomcat.apache.org/security-9.html	37.0.0
2025-07-31T08:03:18.333933+00:00	Apache Tomcat Importer	Fixing	VCID-7498-2z96-w3aa	https://tomcat.apache.org/security-9.html	37.0.0
2025-07-31T08:03:18.305903+00:00	Apache Tomcat Importer	Fixing	VCID-tc17-t52j-nyh4	https://tomcat.apache.org/security-9.html	37.0.0