Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@9.0.118
purl pkg:apache/tomcat@9.0.118
Next non-vulnerable version 9.0.123
Latest non-vulnerable version 11.0.27
Risk score
Vulnerabilities affecting this package (8)
Advisory Summary Fixed in package version
CVE-2026-101356

Important: HTTP/2 request/response mix-up after error during async processing
9.0.123
Not vulnerable
CVE-2026-50229

Low: XSS in number guess example
9.0.119
Vulnerable
CVE-2026-53404

Low: Bad ornext processing in RewriteValve
9.0.119
Vulnerable
CVE-2026-53434

Low: Invalid CRL configuration doesn't trigger failure for FFM Connector
9.0.119
Vulnerable
CVE-2026-55276

Low: Logged effective web.xml is incomplete
9.0.119
Vulnerable
CVE-2026-55955

Low: EncryptInterceptor not protected against replay attacks
9.0.119
Vulnerable
CVE-2026-55956

Moderate: Security constraints for default servlet ignored method
9.0.119
Vulnerable
CVE-2026-86350

Important: Regression in fix for CVE-2026-41293 can trigger request header mix-up
9.0.122
Vulnerable
Vulnerabilities fixed by this package (7)
Advisory Summary Aliases
CVE-2026-41284
Low: Unbounded read in WebDAV LOCK and PROPFIND handling
CVE-2026-41293
Low: HTTP/2 request headers not validated
CVE-2026-42498
Low: WebSocket authentication header exposure
CVE-2026-43512
Moderate: Digest authenticator will authenticate any unknown user
CVE-2026-43513
Low: LockOutRealm treats user names as case-sensitive
CVE-2026-43514
Low: AJP secret compared in non-constant time
CVE-2026-43515
Moderate: Security constraints not correctly applied