VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat@11.0.0-M4

Search for packages

Package details: pkg:maven/org.apache.tomcat/tomcat@11.0.0-M4

Essentials
History (1)

purl	pkg:maven/org.apache.tomcat/tomcat@11.0.0-M4

Next non-vulnerable version	11.0.0-M5
Latest non-vulnerable version	11.0.10
Risk	4.0

Vulnerabilities affecting this package (1)

Vulnerability	Summary	Fixed by
VCID-c32f-584t-xuam Aliases: CVE-2023-28709 GHSA-cx6h-86xw-9x34	The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.	11.0.0-M5 Affected by 0 other vulnerabilities. 11.0.1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-c32f-584t-xuam
Aliases:
CVE-2023-28709
GHSA-cx6h-86xw-9x34

The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.

11.0.0-M5
Affected by 0 other vulnerabilities.

11.0.1
Affected by 3 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-31T08:03:16.638241+00:00	Apache Tomcat Importer	Affected by	VCID-c32f-584t-xuam	https://tomcat.apache.org/security-11.html	37.0.0