Search for packages
| purl | pkg:apache/tomcat@9.0.0-M1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2c6h-srga-aaap
Aliases: CVE-2023-24998 GHSA-hfrx-6qgj-fp6c |
Apache Commons FileUpload denial of service vulnerability |
Affected by 9 other vulnerabilities. Affected by 8 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-6y3x-kyj7-aaaf
Aliases: CVE-2023-44487 GHSA-qppj-fm5r-hxr3 VSV00013 |
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
Affected by 2 other vulnerabilities. Affected by 7 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-7nyx-ctuq-aaar
Aliases: CVE-2020-17527 GHSA-vvw4-rfwf-p6hx |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Affected by 21 other vulnerabilities. Affected by 17 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-7sta-sz5f-aaap
Aliases: CVE-2023-28708 GHSA-2c9m-w27f-53rm |
Apache Tomcat vulnerable to Unprotected Transport of Credentials |
Affected by 8 other vulnerabilities. Affected by 7 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-7tp8-ektn-aaan
Aliases: CVE-2022-42252 GHSA-p22x-g9px-3945 |
Apache Tomcat may reject request containing invalid Content-Length header |
Affected by 9 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 9 other vulnerabilities. |
|
VCID-7uaw-6w3w-aaar
Aliases: CVE-2024-24549 GHSA-7w75-32cg-r6g2 |
Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-a1en-zn2z-aaab
Aliases: CVE-2021-43980 GHSA-jx7c-7mj5-9438 |
Apache Tomcat Race Condition vulnerability |
Affected by 12 other vulnerabilities. Affected by 12 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 14 other vulnerabilities. Affected by 14 other vulnerabilities. |
|
VCID-ah95-hj74-aaaq
Aliases: CVE-2017-12617 GHSA-xjgh-84hx-56c5 |
Unrestricted Upload of File with Dangerous Type When running Apache Tomcat with HTTP PUTs enabled it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. |
Affected by 38 other vulnerabilities. |
|
VCID-e318-2aad-aaag
Aliases: CVE-2023-41080 GHSA-q3mw-pvr8-9ggc |
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. The vulnerability is limited to the ROOT (default) web application. |
Affected by 6 other vulnerabilities. Affected by 5 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-exnf-s6zc-aaah
Aliases: CVE-2024-23672 GHSA-v682-8vv8-vpwr |
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-f68z-z5n7-aaae
Aliases: CVE-2023-42795 GHSA-g8pj-r55q-5c2v |
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. |
Affected by 2 other vulnerabilities. Affected by 7 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-ma76-864y-aaaf
Aliases: CVE-2005-4836 GHSA-qrcx-p4rr-g48h |
The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information. | There are no reported fixed by versions. |
|
VCID-pcvp-wv2z-aaas
Aliases: CVE-2023-46589 GHSA-fccv-jmmp-qg76 |
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M11Â onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-r78u-gre6-aaaj
Aliases: CVE-2023-45648 GHSA-r6j3-px5g-cq3x |
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue. |
Affected by 2 other vulnerabilities. Affected by 7 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-s7md-7wyb-d3dp
Aliases: CVE-2024-52316 GHSA-xcpr-7mr4-h4xq |
Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 3 other vulnerabilities. |
|
VCID-urnb-7r7w-aaae
Aliases: CVE-2021-41079 GHSA-59g9-7gfx-c72p |
Infinite loop in Tomcat due to parsing error |
Affected by 18 other vulnerabilities. Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-yktk-48uz-aaac
Aliases: CVE-2024-34750 GHSA-wm9w-rjj3-j356 |
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-03-28T13:19:17.946848+00:00 | Apache Tomcat Importer | Affected by | VCID-7nyx-ctuq-aaar | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:17.604893+00:00 | Apache Tomcat Importer | Affected by | VCID-urnb-7r7w-aaae | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:17.240286+00:00 | Apache Tomcat Importer | Affected by | VCID-a1en-zn2z-aaab | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:17.004521+00:00 | Apache Tomcat Importer | Affected by | VCID-7tp8-ektn-aaan | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:16.870799+00:00 | Apache Tomcat Importer | Affected by | VCID-2c6h-srga-aaap | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:16.818710+00:00 | Apache Tomcat Importer | Affected by | VCID-7sta-sz5f-aaap | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:16.658075+00:00 | Apache Tomcat Importer | Affected by | VCID-e318-2aad-aaag | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:16.550854+00:00 | Apache Tomcat Importer | Affected by | VCID-f68z-z5n7-aaae | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:16.499407+00:00 | Apache Tomcat Importer | Affected by | VCID-6y3x-kyj7-aaaf | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:16.437241+00:00 | Apache Tomcat Importer | Affected by | VCID-r78u-gre6-aaaj | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:16.386167+00:00 | Apache Tomcat Importer | Affected by | VCID-pcvp-wv2z-aaas | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:16.336361+00:00 | Apache Tomcat Importer | Affected by | VCID-7uaw-6w3w-aaar | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:16.282658+00:00 | Apache Tomcat Importer | Affected by | VCID-exnf-s6zc-aaah | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2025-03-28T13:19:16.227454+00:00 | Apache Tomcat Importer | Affected by | VCID-yktk-48uz-aaac | https://tomcat.apache.org/security-9.html | 36.0.0 |
| 2024-11-20T22:07:30.417426+00:00 | Apache Tomcat Importer | Affected by | VCID-s7md-7wyb-d3dp | https://tomcat.apache.org/security-9.html | 35.0.0 |
| 2024-11-18T23:02:24.199228+00:00 | Apache Tomcat Importer | Affected by | VCID-s7md-7wyb-d3dp | https://tomcat.apache.org/security-9.html | 34.3.2 |
| 2024-09-18T08:17:28.767588+00:00 | Apache Tomcat Importer | Affected by | VCID-7nyx-ctuq-aaar | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:28.444158+00:00 | Apache Tomcat Importer | Affected by | VCID-urnb-7r7w-aaae | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:28.009707+00:00 | Apache Tomcat Importer | Affected by | VCID-a1en-zn2z-aaab | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:27.802914+00:00 | Apache Tomcat Importer | Affected by | VCID-7tp8-ektn-aaan | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:27.683347+00:00 | Apache Tomcat Importer | Affected by | VCID-2c6h-srga-aaap | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:27.631430+00:00 | Apache Tomcat Importer | Affected by | VCID-7sta-sz5f-aaap | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:27.487552+00:00 | Apache Tomcat Importer | Affected by | VCID-e318-2aad-aaag | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:27.266320+00:00 | Apache Tomcat Importer | Affected by | VCID-f68z-z5n7-aaae | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:27.219559+00:00 | Apache Tomcat Importer | Affected by | VCID-6y3x-kyj7-aaaf | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:27.167010+00:00 | Apache Tomcat Importer | Affected by | VCID-r78u-gre6-aaaj | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:27.119235+00:00 | Apache Tomcat Importer | Affected by | VCID-pcvp-wv2z-aaas | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:27.075410+00:00 | Apache Tomcat Importer | Affected by | VCID-7uaw-6w3w-aaar | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:27.027176+00:00 | Apache Tomcat Importer | Affected by | VCID-exnf-s6zc-aaah | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-09-18T08:17:26.975084+00:00 | Apache Tomcat Importer | Affected by | VCID-yktk-48uz-aaac | https://tomcat.apache.org/security-9.html | 34.0.1 |
| 2024-07-03T20:06:44.899300+00:00 | Apache Tomcat Importer | Affected by | VCID-yktk-48uz-aaac | https://tomcat.apache.org/security-9.html | 34.0.0rc4 |
| 2024-04-23T22:42:27.824965+00:00 | Apache Tomcat Importer | Affected by | VCID-7uaw-6w3w-aaar | https://tomcat.apache.org/security-9.html | 34.0.0rc4 |
| 2024-04-23T22:42:27.764409+00:00 | Apache Tomcat Importer | Affected by | VCID-exnf-s6zc-aaah | https://tomcat.apache.org/security-9.html | 34.0.0rc4 |
| 2024-01-04T02:15:33.108785+00:00 | Apache Tomcat Importer | Affected by | VCID-7nyx-ctuq-aaar | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |
| 2024-01-04T02:15:32.844397+00:00 | Apache Tomcat Importer | Affected by | VCID-urnb-7r7w-aaae | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |
| 2024-01-04T02:15:32.497230+00:00 | Apache Tomcat Importer | Affected by | VCID-a1en-zn2z-aaab | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |
| 2024-01-04T02:15:32.332517+00:00 | Apache Tomcat Importer | Affected by | VCID-7tp8-ektn-aaan | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |
| 2024-01-04T02:15:32.232384+00:00 | Apache Tomcat Importer | Affected by | VCID-2c6h-srga-aaap | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |
| 2024-01-04T02:15:32.180580+00:00 | Apache Tomcat Importer | Affected by | VCID-7sta-sz5f-aaap | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |
| 2024-01-04T02:15:32.034064+00:00 | Apache Tomcat Importer | Affected by | VCID-e318-2aad-aaag | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |
| 2024-01-04T02:15:31.930389+00:00 | Apache Tomcat Importer | Affected by | VCID-f68z-z5n7-aaae | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |
| 2024-01-04T02:15:31.878748+00:00 | Apache Tomcat Importer | Affected by | VCID-6y3x-kyj7-aaaf | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |
| 2024-01-04T02:15:31.828594+00:00 | Apache Tomcat Importer | Affected by | VCID-r78u-gre6-aaaj | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |
| 2024-01-04T02:15:31.778404+00:00 | Apache Tomcat Importer | Affected by | VCID-pcvp-wv2z-aaas | https://tomcat.apache.org/security-9.html | 34.0.0rc1 |