Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@9.0.120
purl pkg:apache/tomcat@9.0.120
Next non-vulnerable version 9.0.123
Latest non-vulnerable version 11.0.27
Risk score
Vulnerabilities affecting this package (10)
Advisory Summary Fixed in package version
CVE-2026-65182

Important: Security constraint bypass
9.0.121
Vulnerable
CVE-2026-65183

Low: TOCTOU when setting specific permissions for Unix Domain Sockets
9.0.121
Vulnerable
CVE-2026-65637

Moderate: HTTP/2 no-authority bypass of strict SNI validation
9.0.121
Vulnerable
CVE-2026-65905

Low: Limited replay attack possible with DIGEST authentication
9.0.121
Vulnerable
CVE-2026-65927

Important: RewriteValve [N] restarts at the second rule and may bypass access control
9.0.121
Vulnerable
CVE-2026-66422

Low: Servlet role references can bypass declarative role constraints
9.0.121
Vulnerable
CVE-2026-68525

Low: Redirect after FORM authentication may bypass method specific constraints
9.0.121
Vulnerable
CVE-2026-68569

Important: Principal lookup could fail open in some cases
9.0.121
Vulnerable
CVE-2026-68763

Important: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset
9.0.121
Vulnerable
CVE-2026-73180

Low: Authenticated WebSocket session survives end of HTTP session
9.0.121
Vulnerable
Vulnerabilities fixed by this package (2)
Advisory Summary Aliases
CVE-2026-59083
Low: Incorrect URL decoding in RewriteValve may allow security control bypass
CVE-2026-59084
Low: EncryptInterceptor requirements not clearly documented