Search for packages
Package details: pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.96
purl pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.96
Next non-vulnerable version 9.0.104
Latest non-vulnerable version 11.0.8
Risk 10.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-ckkm-g4kc-tfbg
Aliases:
CVE-2025-31650
GHSA-3p2h-wqq4-wf4h
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.
9.0.104
Affected by 0 other vulnerabilities.
10.1.40
Affected by 0 other vulnerabilities.
11.0.6
Affected by 0 other vulnerabilities.
VCID-yzt8-watu-qkcs
Aliases:
CVE-2025-31651
GHSA-ff77-26x5-69cr
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
9.0.104
Affected by 0 other vulnerabilities.
10.1.40
Affected by 0 other vulnerabilities.
11.0.6
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-cvmu-3hdx-3kdn Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue. CVE-2024-52317
GHSA-qvf5-hvjx-wm27

Date Actor Action Vulnerability Source VulnerableCode Version
2025-06-20T17:20:47.153238+00:00 GitLab Importer Affected by VCID-ckkm-g4kc-tfbg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2025-31650.yml 36.1.3
2025-06-20T17:20:46.427994+00:00 GitLab Importer Affected by VCID-yzt8-watu-qkcs https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2025-31651.yml 36.1.3
2025-06-20T17:12:29.381239+00:00 GitLab Importer Fixing VCID-cvmu-3hdx-3kdn https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2024-52317.yml 36.1.3
2025-06-03T23:55:41.890337+00:00 GitLab Importer Affected by VCID-ckkm-g4kc-tfbg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2025-31650.yml 36.1.0
2025-06-03T23:55:41.310804+00:00 GitLab Importer Affected by VCID-yzt8-watu-qkcs https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2025-31651.yml 36.1.0
2025-06-03T23:48:12.130856+00:00 GitLab Importer Fixing VCID-cvmu-3hdx-3kdn https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2024-52317.yml 36.1.0
2025-06-02T23:54:36.135690+00:00 GitLab Importer Affected by VCID-ckkm-g4kc-tfbg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2025-31650.yml 36.1.2
2025-06-02T23:54:35.437640+00:00 GitLab Importer Affected by VCID-yzt8-watu-qkcs https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2025-31651.yml 36.1.2
2025-06-02T23:46:50.916954+00:00 GitLab Importer Fixing VCID-cvmu-3hdx-3kdn https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2024-52317.yml 36.1.2
2025-05-29T23:36:36.722566+00:00 GitLab Importer Affected by VCID-ckkm-g4kc-tfbg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2025-31650.yml 36.0.0
2025-05-29T23:36:35.930739+00:00 GitLab Importer Affected by VCID-yzt8-watu-qkcs https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2025-31651.yml 36.0.0
2025-04-04T11:32:25.511112+00:00 GithubOSV Importer Fixing VCID-cvmu-3hdx-3kdn https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-qvf5-hvjx-wm27/GHSA-qvf5-hvjx-wm27.json 36.0.0
2025-03-28T20:12:44.664671+00:00 GHSA Importer Fixing VCID-cvmu-3hdx-3kdn https://github.com/advisories/GHSA-qvf5-hvjx-wm27 36.0.0
2025-03-28T16:49:29.053059+00:00 GitLab Importer Fixing VCID-cvmu-3hdx-3kdn https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2024-52317.yml 36.0.0
2025-02-18T04:15:06.718115+00:00 GitLab Importer Fixing VCID-cvmu-3hdx-3kdn https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2024-52317.yml 35.1.0
2024-12-19T19:15:59.995672+00:00 GitLab Importer Fixing VCID-cvmu-3hdx-3kdn https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat.embed/tomcat-embed-core/CVE-2024-52317.yml 35.0.0
2024-11-19T19:46:51.571116+00:00 GHSA Importer Fixing VCID-cvmu-3hdx-3kdn https://github.com/advisories/GHSA-qvf5-hvjx-wm27 34.3.2
2024-11-19T00:40:22.747086+00:00 GithubOSV Importer Fixing VCID-cvmu-3hdx-3kdn https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-qvf5-hvjx-wm27/GHSA-qvf5-hvjx-wm27.json 34.3.2