VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.100

Search for packages

Vulnerability	Summary	Fixed by
VCID-8jy7-ws9c-dbh8 Aliases: CVE-2024-34750 GHSA-wm9w-rjj3-j356	Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.	9.0.90 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 10.1.25 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 11.0.0-M21 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-dk83-wt6s-c3a7 Aliases: CVE-2025-53506 GHSA-25xr-qj8w-c4vf	Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.	9.0.107 Affected by 0 other vulnerabilities. 10.1.43 Affected by 0 other vulnerabilities. 11.0.9 Affected by 0 other vulnerabilities.
VCID-wbae-761d-qqeq Aliases: CVE-2025-31650 GHSA-3p2h-wqq4-wf4h	Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.	9.0.104 Affected by 0 other vulnerabilities. 10.1.40 Affected by 0 other vulnerabilities. 11.0.6 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-8jy7-ws9c-dbh8
Aliases:
CVE-2024-34750
GHSA-wm9w-rjj3-j356

Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.

9.0.90
Affected by 1 other vulnerability.

10.1.25
Affected by 1 other vulnerability.

11.0.0-M21
Affected by 1 other vulnerability.

VCID-dk83-wt6s-c3a7
Aliases:
CVE-2025-53506
GHSA-25xr-qj8w-c4vf

Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.

9.0.107
Affected by 0 other vulnerabilities.

10.1.43
Affected by 0 other vulnerabilities.

11.0.9
Affected by 0 other vulnerabilities.

VCID-wbae-761d-qqeq
Aliases:
CVE-2025-31650
GHSA-3p2h-wqq4-wf4h

Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service. This issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5. Users are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.

9.0.104
Affected by 0 other vulnerabilities.

10.1.40
Affected by 0 other vulnerabilities.

11.0.6
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-08-09T13:35:47.311729+00:00	GHSA Importer	Affected by	VCID-dk83-wt6s-c3a7	https://github.com/advisories/GHSA-25xr-qj8w-c4vf	37.0.0
2025-08-09T13:35:46.861380+00:00	GHSA Importer	Affected by	VCID-wbae-761d-qqeq	https://github.com/advisories/GHSA-3p2h-wqq4-wf4h	37.0.0
2025-08-09T13:35:45.826032+00:00	GHSA Importer	Affected by	VCID-8jy7-ws9c-dbh8	https://github.com/advisories/GHSA-wm9w-rjj3-j356	37.0.0