Search for packages
Package details: pkg:deb/debian/tomcat9@9.0.70-2
purl pkg:deb/debian/tomcat9@9.0.70-2
Next non-vulnerable version 9.0.95-1
Latest non-vulnerable version 9.0.95-1
Risk 10.0
Vulnerabilities affecting this package (4)
Vulnerability Summary Fixed by
VCID-6y3x-kyj7-aaaf
Aliases:
CVE-2023-44487
GHSA-qppj-fm5r-hxr3
VSV00013
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
9.0.95-1
Affected by 0 other vulnerabilities.
VCID-7sta-sz5f-aaap
Aliases:
CVE-2023-28708
GHSA-2c9m-w27f-53rm
Apache Tomcat vulnerable to Unprotected Transport of Credentials
9.0.95-1
Affected by 0 other vulnerabilities.
VCID-f68z-z5n7-aaae
Aliases:
CVE-2023-42795
GHSA-g8pj-r55q-5c2v
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
9.0.95-1
Affected by 0 other vulnerabilities.
VCID-r78u-gre6-aaaj
Aliases:
CVE-2023-45648
GHSA-r6j3-px5g-cq3x
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.
9.0.95-1
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (17)
Vulnerability Summary Aliases
VCID-2c6h-srga-aaap Apache Commons FileUpload denial of service vulnerability CVE-2023-24998
GHSA-hfrx-6qgj-fp6c
VCID-2kcn-vmty-hyc5 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue. CVE-2024-50379
GHSA-5j33-cvvr-w245
VCID-6qpu-a1ru-qqdw Apache Tomcat - Security constraint bypass for pre/post-resources Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. CVE-2025-49125
GHSA-wc4r-xq3c-5cf3
VCID-7sta-sz5f-aaap Apache Tomcat vulnerable to Unprotected Transport of Credentials CVE-2023-28708
GHSA-2c9m-w27f-53rm
VCID-c5mx-k2k4-aaag Cross-site Scripting in Apache Tomcat CVE-2022-34305
GHSA-6j88-6whg-x687
VCID-cf6s-u8r8-kqdh Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue. CVE-2025-48976
GHSA-vv7r-c36w-3prj
VCID-ckkm-g4kc-tfbg Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue. CVE-2025-31650
GHSA-3p2h-wqq4-wf4h
VCID-f414-dkxe-ckdp Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue. CVE-2024-54677
GHSA-653p-vg55-5652
VCID-g1y6-gy6q-kbfm Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability CVE-2024-56337
GHSA-27hp-xhwr-wr2m
VCID-h5vt-s4xq-hkbn Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. Users are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue. CVE-2025-46701
GHSA-h2fw-rfh5-95r3
VCID-s526-jddr-jqd1 Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. Older, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process. CVE-2024-38286
GHSA-7jqf-v358-p8g7
VCID-s7md-7wyb-d3dp Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue. CVE-2024-52316
GHSA-xcpr-7mr4-h4xq
VCID-tzx4-sq6x-aaap Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue. CVE-2024-21733
GHSA-f4qf-m5gf-8jm8
VCID-urcd-kkup-t7c7 Apache Tomcat - DoS in multipart upload Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. CVE-2025-48988
GHSA-h3gc-qfqq-6h8f
VCID-xwgq-td7d-uydt tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2025-24813
GHSA-83qj-6fr2-vhqg
VCID-yktk-48uz-aaac Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue. CVE-2024-34750
GHSA-wm9w-rjj3-j356
VCID-yzt8-watu-qkcs Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue. CVE-2025-31651
GHSA-ff77-26x5-69cr

Date Actor Action Vulnerability Source VulnerableCode Version
2025-06-22T14:59:01.422112+00:00 Debian Importer Fixing VCID-urcd-kkup-t7c7 https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-22T13:10:55.148292+00:00 Debian Importer Fixing VCID-f414-dkxe-ckdp https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-22T13:06:15.257858+00:00 Debian Importer Fixing VCID-yktk-48uz-aaac https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-22T07:43:36.468627+00:00 Debian Importer Affected by VCID-7sta-sz5f-aaap None 36.1.3
2025-06-22T05:33:36.252643+00:00 Debian Importer Affected by VCID-r78u-gre6-aaaj None 36.1.3
2025-06-21T22:58:42.958269+00:00 Debian Importer Fixing VCID-s7md-7wyb-d3dp https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T22:37:30.726337+00:00 Debian Importer Fixing VCID-xwgq-td7d-uydt https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T16:49:20.596206+00:00 Debian Importer Fixing VCID-c5mx-k2k4-aaag https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T16:49:09.688921+00:00 Debian Importer Fixing VCID-2kcn-vmty-hyc5 https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T14:12:49.096812+00:00 Debian Importer Fixing VCID-6qpu-a1ru-qqdw https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T07:24:06.904254+00:00 Debian Importer Fixing VCID-yzt8-watu-qkcs https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T06:46:35.850952+00:00 Debian Importer Fixing VCID-tzx4-sq6x-aaap https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T05:05:14.127091+00:00 Debian Importer Fixing VCID-ckkm-g4kc-tfbg https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T04:20:35.579273+00:00 Debian Importer Fixing VCID-g1y6-gy6q-kbfm https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-21T04:20:08.860957+00:00 Debian Importer Fixing VCID-h5vt-s4xq-hkbn https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-20T21:09:21.485373+00:00 Debian Importer Fixing VCID-cf6s-u8r8-kqdh https://security-tracker.debian.org/tracker/data/json 36.1.3
2025-06-20T20:01:12.545297+00:00 Debian Importer Affected by VCID-6y3x-kyj7-aaaf None 36.1.3
2025-06-05T14:05:19.861752+00:00 Debian Importer Affected by VCID-6y3x-kyj7-aaaf None 36.1.0
2025-05-31T18:52:01.051380+00:00 Debian Importer Fixing VCID-h5vt-s4xq-hkbn https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-05-02T07:33:04.837809+00:00 Debian Importer Fixing VCID-yzt8-watu-qkcs https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-05-02T04:33:33.666938+00:00 Debian Importer Fixing VCID-ckkm-g4kc-tfbg https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-13T03:27:30.864285+00:00 Debian Oval Importer Fixing VCID-xwgq-td7d-uydt https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T03:23:00.789536+00:00 Debian Oval Importer Fixing VCID-tzx4-sq6x-aaap https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T03:21:26.609153+00:00 Debian Oval Importer Fixing VCID-g1y6-gy6q-kbfm https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T03:13:37.977428+00:00 Debian Oval Importer Fixing VCID-2kcn-vmty-hyc5 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T03:09:13.261791+00:00 Debian Oval Importer Fixing VCID-s7md-7wyb-d3dp https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-13T03:02:41.111340+00:00 Debian Oval Importer Fixing VCID-s526-jddr-jqd1 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 36.0.0
2025-04-06T23:03:57.954528+00:00 Debian Importer Affected by VCID-f68z-z5n7-aaae None 36.0.0
2025-04-06T18:52:52.996843+00:00 Debian Importer Fixing VCID-s526-jddr-jqd1 https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-06T06:35:19.301428+00:00 Debian Importer Fixing VCID-f414-dkxe-ckdp https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-06T06:30:30.208463+00:00 Debian Importer Fixing VCID-yktk-48uz-aaac https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-06T01:21:07.320333+00:00 Debian Importer Affected by VCID-7sta-sz5f-aaap None 36.0.0
2025-04-05T23:25:18.857860+00:00 Debian Importer Affected by VCID-r78u-gre6-aaaj None 36.0.0
2025-04-05T18:48:44.516582+00:00 Debian Importer Fixing VCID-s7md-7wyb-d3dp https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-05T18:36:07.164719+00:00 Debian Importer Fixing VCID-xwgq-td7d-uydt https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-05T13:13:52.252822+00:00 Debian Importer Fixing VCID-c5mx-k2k4-aaag https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-05T13:13:42.042433+00:00 Debian Importer Fixing VCID-2kcn-vmty-hyc5 https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-05T04:02:21.749875+00:00 Debian Importer Fixing VCID-tzx4-sq6x-aaap https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-04T07:09:42.312657+00:00 Debian Importer Fixing VCID-g1y6-gy6q-kbfm https://security-tracker.debian.org/tracker/data/json 36.0.0
2025-04-03T23:04:26.660704+00:00 Debian Importer Affected by VCID-6y3x-kyj7-aaaf None 36.0.0
2025-02-22T05:44:18.123745+00:00 Debian Importer Fixing VCID-g1y6-gy6q-kbfm https://security-tracker.debian.org/tracker/data/json 35.1.0
2025-02-22T05:40:36.625717+00:00 Debian Importer Fixing VCID-f414-dkxe-ckdp https://security-tracker.debian.org/tracker/data/json 35.1.0
2025-02-22T05:32:05.038464+00:00 Debian Importer Fixing VCID-s7md-7wyb-d3dp https://security-tracker.debian.org/tracker/data/json 35.1.0
2025-02-22T05:29:21.355407+00:00 Debian Importer Fixing VCID-2kcn-vmty-hyc5 https://security-tracker.debian.org/tracker/data/json 35.1.0
2025-02-22T00:09:42.107831+00:00 Debian Importer Fixing VCID-s526-jddr-jqd1 https://security-tracker.debian.org/tracker/data/json 35.1.0
2025-02-21T22:11:03.775804+00:00 Debian Importer Fixing VCID-yktk-48uz-aaac https://security-tracker.debian.org/tracker/data/json 35.1.0
2025-02-21T18:29:57.153188+00:00 Debian Importer Fixing VCID-tzx4-sq6x-aaap https://security-tracker.debian.org/tracker/data/json 35.1.0
2025-02-21T14:16:19.079518+00:00 Debian Importer Affected by VCID-r78u-gre6-aaaj None 35.1.0
2025-02-21T14:04:53.632252+00:00 Debian Importer Affected by VCID-6y3x-kyj7-aaaf None 35.1.0
2025-02-21T13:42:25.737680+00:00 Debian Importer Affected by VCID-f68z-z5n7-aaae None 35.1.0
2025-02-21T10:34:18.647754+00:00 Debian Importer Affected by VCID-7sta-sz5f-aaap None 35.1.0
2025-02-20T23:02:39.508781+00:00 Debian Importer Fixing VCID-c5mx-k2k4-aaag https://security-tracker.debian.org/tracker/data/json 35.1.0
2024-12-15T18:57:23.415275+00:00 Debian Importer Fixing VCID-s7md-7wyb-d3dp https://security-tracker.debian.org/tracker/data/json 35.0.0
2024-11-24T11:23:43.926629+00:00 Debian Importer Fixing VCID-s526-jddr-jqd1 https://security-tracker.debian.org/tracker/data/json 35.0.0
2024-11-24T09:44:52.857074+00:00 Debian Importer Fixing VCID-yktk-48uz-aaac https://security-tracker.debian.org/tracker/data/json 35.0.0
2024-11-24T06:51:30.407223+00:00 Debian Importer Fixing VCID-tzx4-sq6x-aaap https://security-tracker.debian.org/tracker/data/json 35.0.0
2024-11-24T03:15:06.167541+00:00 Debian Importer Affected by VCID-r78u-gre6-aaaj None 35.0.0
2024-11-24T02:44:10.401706+00:00 Debian Importer Affected by VCID-f68z-z5n7-aaae None 35.0.0
2024-11-23T15:08:24.684405+00:00 Debian Importer Fixing VCID-c5mx-k2k4-aaag https://security-tracker.debian.org/tracker/data/json 35.0.0
2024-10-11T07:11:46.796747+00:00 Debian Importer Fixing VCID-s526-jddr-jqd1 https://security-tracker.debian.org/tracker/data/json 34.0.2
2024-10-11T05:57:19.926669+00:00 Debian Importer Fixing VCID-yktk-48uz-aaac https://security-tracker.debian.org/tracker/data/json 34.0.2
2024-10-11T03:42:17.673066+00:00 Debian Importer Fixing VCID-tzx4-sq6x-aaap https://security-tracker.debian.org/tracker/data/json 34.0.2
2024-10-11T00:40:59.792961+00:00 Debian Importer Affected by VCID-r78u-gre6-aaaj None 34.0.2
2024-10-11T00:19:01.444233+00:00 Debian Importer Affected by VCID-f68z-z5n7-aaae None 34.0.2
2024-10-10T12:58:52.163109+00:00 Debian Importer Fixing VCID-c5mx-k2k4-aaag https://security-tracker.debian.org/tracker/data/json 34.0.2
2024-09-25T21:03:20.439938+00:00 Debian Importer Fixing VCID-s526-jddr-jqd1 https://security-tracker.debian.org/tracker/data/json 34.0.1
2024-09-25T20:03:52.590630+00:00 Debian Importer Fixing VCID-yktk-48uz-aaac https://security-tracker.debian.org/tracker/data/json 34.0.1
2024-09-20T07:44:00.576569+00:00 Debian Importer Fixing VCID-tzx4-sq6x-aaap https://security-tracker.debian.org/tracker/data/json 34.0.1
2024-09-20T05:19:03.157706+00:00 Debian Importer Affected by VCID-r78u-gre6-aaaj None 34.0.1
2024-09-20T04:52:27.780784+00:00 Debian Importer Affected by VCID-f68z-z5n7-aaae None 34.0.1
2024-09-19T19:24:35.974214+00:00 Debian Importer Fixing VCID-c5mx-k2k4-aaag https://security-tracker.debian.org/tracker/data/json 34.0.1
2024-04-26T05:27:43.092821+00:00 Debian Importer Affected by VCID-r78u-gre6-aaaj None 34.0.0rc4
2024-04-26T05:24:41.210956+00:00 Debian Importer Affected by VCID-6y3x-kyj7-aaaf None 34.0.0rc4
2024-04-26T05:00:05.838519+00:00 Debian Importer Affected by VCID-f68z-z5n7-aaae None 34.0.0rc4
2024-04-26T02:41:38.189989+00:00 Debian Importer Affected by VCID-7sta-sz5f-aaap None 34.0.0rc4
2024-01-12T12:44:18.936703+00:00 Debian Importer Affected by VCID-7sta-sz5f-aaap None 34.0.0rc2
2024-01-05T09:55:03.445469+00:00 Debian Importer Affected by VCID-r78u-gre6-aaaj None 34.0.0rc1
2024-01-05T09:53:26.652940+00:00 Debian Importer Affected by VCID-6y3x-kyj7-aaaf None 34.0.0rc1
2024-01-05T09:42:47.593308+00:00 Debian Importer Affected by VCID-f68z-z5n7-aaae None 34.0.0rc1
2024-01-05T08:27:53.497953+00:00 Debian Importer Affected by VCID-7sta-sz5f-aaap None 34.0.0rc1