Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@9.0.115
purl pkg:apache/tomcat@9.0.115
Next non-vulnerable version 9.0.123
Latest non-vulnerable version 11.0.27
Risk score
Vulnerabilities affecting this package (7)
Advisory Summary Fixed in package version
CVE-2025-66614

Moderate: The fix for CVE-2025-66614 was incomplete
9.0.116
Vulnerable
CVE-2026-24880

Low: Request smuggling via invalid chunk extension
9.0.116
Vulnerable
CVE-2026-25854

Low: Occasionally open redirect
9.0.116
Vulnerable
CVE-2026-29129

Low: Configured TLS cipher preference order not preserved
9.0.116
Vulnerable
CVE-2026-29145

Moderate: OCSP checks sometimes soft-fail even when soft-fail is disabled
9.0.116
Vulnerable
CVE-2026-29146

Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
9.0.116
Vulnerable
CVE-2026-65637

Moderate: HTTP/2 no-authority bypass of strict SNI validation
9.0.121
Vulnerable
Vulnerabilities fixed by this package (1)
Advisory Summary Aliases
CVE-2026-24734
Moderate: Incomplete OCSP verification checks