VulnerableCode Package Details - pkg:apache/tomcat@9.0.89

Search for packages

Vulnerability	Summary	Fixed by
VCID-s526-jddr-jqd1 Aliases: CVE-2024-38286 GHSA-7jqf-v358-p8g7	Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. Older, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.	9.0.90 Affected by 0 other vulnerabilities. 10.1.25 Affected by 0 other vulnerabilities. 11.0.0-M21 Affected by 0 other vulnerabilities.
VCID-yktk-48uz-aaac Aliases: CVE-2024-34750 GHSA-wm9w-rjj3-j356	Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.	9.0.90 Affected by 0 other vulnerabilities. 10.1.25 Affected by 0 other vulnerabilities. 11.0.0-M21 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-s526-jddr-jqd1
Aliases:
CVE-2024-38286
GHSA-7jqf-v358-p8g7

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. Older, unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue. Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

9.0.90
Affected by 0 other vulnerabilities.

10.1.25
Affected by 0 other vulnerabilities.

11.0.0-M21
Affected by 0 other vulnerabilities.

VCID-yktk-48uz-aaac
Aliases:
CVE-2024-34750
GHSA-wm9w-rjj3-j356

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.

9.0.90
Affected by 0 other vulnerabilities.

10.1.25
Affected by 0 other vulnerabilities.

11.0.0-M21
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-03-28T13:19:16.232478+00:00	Apache Tomcat Importer	Affected by	VCID-yktk-48uz-aaac	https://tomcat.apache.org/security-9.html	36.0.0
2024-09-23T14:31:01.477996+00:00	Apache Tomcat Importer	Affected by	VCID-s526-jddr-jqd1	https://tomcat.apache.org/security-9.html	34.0.1
2024-09-18T08:17:26.979943+00:00	Apache Tomcat Importer	Affected by	VCID-yktk-48uz-aaac	https://tomcat.apache.org/security-9.html	34.0.1
2024-07-03T20:06:44.906586+00:00	Apache Tomcat Importer	Affected by	VCID-yktk-48uz-aaac	https://tomcat.apache.org/security-9.html	34.0.0rc4