Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat@8.5.96 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-nq3y-spqj-qyca
Aliases: CVE-2018-1305 GHSA-jx6h-3fjx-cgv5 |
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them. |
Affected by 26 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-2n65-91en-cqa8 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue. |
CVE-2023-46589
GHSA-fccv-jmmp-qg76 |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-08-01T09:06:29.526923+00:00 | GitLab Importer | Affected by | VCID-nq3y-spqj-qyca | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2018-1305.yml | 37.0.0 |
| 2025-07-31T09:30:38.289940+00:00 | GitLab Importer | Fixing | VCID-2n65-91en-cqa8 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2023-46589.yml | 37.0.0 |
| 2025-07-31T08:03:21.209952+00:00 | Apache Tomcat Importer | Fixing | VCID-2n65-91en-cqa8 | https://tomcat.apache.org/security-8.html | 37.0.0 |