VulnerableCode Package Details - pkg:apache/tomcat@8.5.64

Search for packages

Vulnerability	Summary	Fixed by
VCID-3h9k-jyh8-zuau Aliases: CVE-2021-30639 GHSA-44qp-qhfv-c7f6	A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.	8.5.65 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 9.0.45 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.0.5 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-3h9k-jyh8-zuau
Aliases:
CVE-2021-30639
GHSA-44qp-qhfv-c7f6

A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.

8.5.65
Affected by 1 other vulnerability.

9.0.45
Affected by 1 other vulnerability.

10.0.5
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
VCID-7m6d-m7rr-fbgj	Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.	CVE-2021-41079 GHSA-59g9-7gfx-c72p
VCID-ekhp-s7kg-ebdy	Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.	CVE-2024-21733 GHSA-f4qf-m5gf-8jm8

Vulnerability

Summary

Aliases

VCID-7m6d-m7rr-fbgj

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

CVE-2021-41079
GHSA-59g9-7gfx-c72p

VCID-ekhp-s7kg-ebdy

Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.

CVE-2024-21733
GHSA-f4qf-m5gf-8jm8

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-31T08:03:21.856449+00:00	Apache Tomcat Importer	Fixing	VCID-ekhp-s7kg-ebdy	https://tomcat.apache.org/security-8.html	37.0.0
2025-07-31T08:03:21.823170+00:00	Apache Tomcat Importer	Fixing	VCID-7m6d-m7rr-fbgj	https://tomcat.apache.org/security-8.html	37.0.0
2025-07-31T08:03:21.793525+00:00	Apache Tomcat Importer	Affected by	VCID-3h9k-jyh8-zuau	https://tomcat.apache.org/security-8.html	37.0.0