Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat@11.0.8 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-gyd5-cdaj-aaae
Aliases: CVE-2022-29885 GHSA-r84p-88g2-2vx2 |
Uncontrolled Resource Consumption The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks. | There are no reported fixed by versions. |
|
VCID-mmcg-y2kn-aaab
Aliases: CVE-2013-4286 GHSA-j448-j653-r3vj |
Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090. | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-6qpu-a1ru-qqdw | Apache Tomcat - Security constraint bypass for pre/post-resources Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. |
CVE-2025-49125
GHSA-wc4r-xq3c-5cf3 |
| VCID-cf6s-u8r8-kqdh | Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue. |
CVE-2025-48976
GHSA-vv7r-c36w-3prj |
| VCID-nmw2-9cf8-guhb | Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. |
CVE-2025-49124
|
| VCID-urcd-kkup-t7c7 | Apache Tomcat - DoS in multipart upload Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. |
CVE-2025-48988
GHSA-h3gc-qfqq-6h8f |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-06-21T19:22:33.171136+00:00 | Apache Tomcat Importer | Affected by | VCID-mmcg-y2kn-aaab | https://tomcat.apache.org/security-8.html | 36.1.3 |
| 2025-06-21T19:22:24.521589+00:00 | Apache Tomcat Importer | Affected by | VCID-mmcg-y2kn-aaab | None | 36.1.3 |
| 2025-06-20T15:38:54.567477+00:00 | GitLab Importer | Affected by | VCID-gyd5-cdaj-aaae | None | 36.1.3 |
| 2025-06-20T13:41:07.088513+00:00 | Apache Tomcat Importer | Fixing | VCID-cf6s-u8r8-kqdh | https://tomcat.apache.org/security-11.html | 36.1.3 |
| 2025-06-20T13:41:07.062269+00:00 | Apache Tomcat Importer | Fixing | VCID-urcd-kkup-t7c7 | https://tomcat.apache.org/security-11.html | 36.1.3 |
| 2025-06-20T13:41:07.032027+00:00 | Apache Tomcat Importer | Fixing | VCID-nmw2-9cf8-guhb | https://tomcat.apache.org/security-11.html | 36.1.3 |
| 2025-06-20T13:41:07.001861+00:00 | Apache Tomcat Importer | Fixing | VCID-6qpu-a1ru-qqdw | https://tomcat.apache.org/security-11.html | 36.1.3 |
| 2025-06-09T22:44:46.593419+00:00 | Apache Tomcat Importer | Affected by | VCID-mmcg-y2kn-aaab | https://tomcat.apache.org/security-8.html | 36.1.0 |
| 2025-06-09T22:44:39.802764+00:00 | Apache Tomcat Importer | Affected by | VCID-mmcg-y2kn-aaab | None | 36.1.0 |
| 2025-06-09T22:05:23.205998+00:00 | GitLab Importer | Affected by | VCID-gyd5-cdaj-aaae | None | 36.1.0 |