VulnerableCode Package Details - pkg:apache/tomcat@9.0.92

Search for packages

Package details: pkg:apache/tomcat@9.0.92

Essentials
History (1)

purl	pkg:apache/tomcat@9.0.92

Next non-vulnerable version	9.0.99
Latest non-vulnerable version	11.0.9
Risk	4.0

Vulnerabilities affecting this package (1)

Vulnerability	Summary	Fixed by
VCID-rcr4-rbsk-myej Aliases: CVE-2024-52317 GHSA-qvf5-hvjx-wm27	Apache Tomcat Request and/or response mix-up Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.	9.0.96 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.1.31 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 11.0.0 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-rcr4-rbsk-myej
Aliases:
CVE-2024-52317
GHSA-qvf5-hvjx-wm27

Apache Tomcat Request and/or response mix-up Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.

9.0.96
Affected by 1 other vulnerability.

10.1.31
Affected by 1 other vulnerability.

11.0.0
Affected by 3 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-01T15:07:04.782774+00:00	Apache Tomcat Importer	Affected by	VCID-rcr4-rbsk-myej	https://tomcat.apache.org/security-9.html	36.1.3