VulnerableCode Package Details - pkg:apache/tomcat@9.0.0%2BM11

Search for packages

Vulnerability	Summary	Fixed by
VCID-fen9-e5k1-aaap Aliases: CVE-2016-8747 GHSA-fjwp-r6fm-q6qw	An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.	9.0.0+M17 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-q1t4-rzf5-aaac Aliases: CVE-2016-6816 GHSA-jc7p-5r39-9477	The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.	9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-sc5t-244h-aaas Aliases: CVE-2016-8735 GHSA-cw54-59pw-4g8c	Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.	9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-thqm-a8vn-aaap Aliases: CVE-2016-6817 GHSA-698c-2x4j-g9gq	The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.	9.0.0+M13 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-fen9-e5k1-aaap
Aliases:
CVE-2016-8747
GHSA-fjwp-r6fm-q6qw

An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.

9.0.0+M17
Affected by 1 other vulnerability.

VCID-q1t4-rzf5-aaac
Aliases:
CVE-2016-6816
GHSA-jc7p-5r39-9477

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.

9.0.0+M13
Affected by 1 other vulnerability.

VCID-sc5t-244h-aaas
Aliases:
CVE-2016-8735
GHSA-cw54-59pw-4g8c

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

9.0.0+M13
Affected by 1 other vulnerability.

VCID-thqm-a8vn-aaap
Aliases:
CVE-2016-6817
GHSA-698c-2x4j-g9gq

The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.

9.0.0+M13
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-03-28T13:19:20.207119+00:00	Apache Tomcat Importer	Affected by	VCID-q1t4-rzf5-aaac	https://tomcat.apache.org/security-9.html	36.0.0
2025-03-28T13:19:20.152671+00:00	Apache Tomcat Importer	Affected by	VCID-thqm-a8vn-aaap	https://tomcat.apache.org/security-9.html	36.0.0
2025-03-28T13:19:20.097884+00:00	Apache Tomcat Importer	Affected by	VCID-sc5t-244h-aaas	https://tomcat.apache.org/security-9.html	36.0.0
2025-03-28T13:19:19.982123+00:00	Apache Tomcat Importer	Affected by	VCID-fen9-e5k1-aaap	https://tomcat.apache.org/security-9.html	36.0.0
2024-09-18T08:17:30.924581+00:00	Apache Tomcat Importer	Affected by	VCID-q1t4-rzf5-aaac	https://tomcat.apache.org/security-9.html	34.0.1
2024-09-18T08:17:30.868007+00:00	Apache Tomcat Importer	Affected by	VCID-thqm-a8vn-aaap	https://tomcat.apache.org/security-9.html	34.0.1
2024-09-18T08:17:30.811402+00:00	Apache Tomcat Importer	Affected by	VCID-sc5t-244h-aaas	https://tomcat.apache.org/security-9.html	34.0.1
2024-09-18T08:17:30.698097+00:00	Apache Tomcat Importer	Affected by	VCID-fen9-e5k1-aaap	https://tomcat.apache.org/security-9.html	34.0.1
2024-01-04T02:15:35.026335+00:00	Apache Tomcat Importer	Affected by	VCID-q1t4-rzf5-aaac	https://tomcat.apache.org/security-9.html	34.0.0rc1
2024-01-04T02:15:34.979228+00:00	Apache Tomcat Importer	Affected by	VCID-thqm-a8vn-aaap	https://tomcat.apache.org/security-9.html	34.0.0rc1
2024-01-04T02:15:34.931367+00:00	Apache Tomcat Importer	Affected by	VCID-sc5t-244h-aaas	https://tomcat.apache.org/security-9.html	34.0.0rc1
2024-01-04T02:15:34.830143+00:00	Apache Tomcat Importer	Affected by	VCID-fen9-e5k1-aaap	https://tomcat.apache.org/security-9.html	34.0.0rc1