Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.99
purl pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@7.0.99
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 10.0
Vulnerabilities affecting this package (25)
Advisory Summary Fixed in package version
CVE-2019-17569

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The …
7.0.25
Vulnerable
7.0.26
Vulnerable
7.0.47
Vulnerable
7.0.53
Vulnerable
7.0.55
Vulnerable
7.0.57
Vulnerable
7.0.69
Vulnerable
7.0.75
Vulnerable
7.0.78
Vulnerable
7.0.82
Vulnerable
8.5.2
Vulnerable
8.5.3
Vulnerable
8.5.4
Vulnerable
8.5.5
Vulnerable
8.5.6
Vulnerable
8.5.8
Vulnerable
8.5.9
Vulnerable
8.5.11
Vulnerable
8.5.13
Vulnerable
8.5.14
Vulnerable
8.5.15
Vulnerable
8.5.16
Vulnerable
8.5.20
Vulnerable
8.5.21
Vulnerable
8.5.23
Vulnerable
8.5.24
Vulnerable
8.5.27
Vulnerable
9.0.0.M1
Vulnerable
9.0.0.M3
Vulnerable
9.0.0.M4
Vulnerable
9.0.0.M18
Vulnerable
9.0.1
Vulnerable
9.0.2
Vulnerable
9.0.4
Vulnerable
9.0.6
Vulnerable
9.0.7
Vulnerable
9.0.8
Vulnerable
9.0.10
Vulnerable
9.0.11
Vulnerable
9.0.12
Vulnerable
9.0.13
Vulnerable
9.0.14
Vulnerable
9.0.16
Vulnerable
9.0.17
Vulnerable
9.0.19
Vulnerable
9.0.20
Vulnerable
9.0.21
Vulnerable
9.0.22
Vulnerable
9.0.24
Vulnerable
9.0.26
Vulnerable
9.0.27
Vulnerable
9.0.31
Vulnerable
9.0.33
Vulnerable
9.0.34
Vulnerable
9.0.35
Vulnerable
9.0.36
Vulnerable
9.0.37
Vulnerable
10.0.0-M1
Vulnerable
10.0.0-M3
Vulnerable
10.0.0-M5
Vulnerable
10.0.0-M6
Vulnerable
10.0.0-M7
Vulnerable
8.5.28
Vulnerable
8.5.29
Vulnerable
8.5.30
Vulnerable
8.5.31
Vulnerable
8.5.33
Vulnerable
8.5.34
Vulnerable
8.5.35
Vulnerable
8.5.37
Vulnerable
8.5.38
Vulnerable
8.5.39
Vulnerable
8.5.40
Vulnerable
8.5.41
Vulnerable
8.5.42
Vulnerable
8.5.43
Vulnerable
8.5.46
Vulnerable
8.5.47
Vulnerable
8.5.51
Vulnerable
8.5.53
Vulnerable
8.5.54
Vulnerable
7.0.86
Vulnerable
7.0.88
Vulnerable
7.0.90
Vulnerable
7.0.91
Vulnerable
7.0.94
Vulnerable
8.5.55
Vulnerable
8.5.56
Vulnerable
8.5.57
Vulnerable
7.0.100
Vulnerable
7.0.103
Vulnerable
7.0.104
Vulnerable
7.0.105
Vulnerable
CVE-2020-1938

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats …
9.0.31
Vulnerable
9.0.33
Vulnerable
9.0.34
Vulnerable
9.0.35
Vulnerable
9.0.36
Vulnerable
9.0.37
Vulnerable
10.0.0-M1
Vulnerable
10.0.0-M3
Vulnerable
10.0.0-M5
Vulnerable
10.0.0-M6
Vulnerable
10.0.0-M7
Vulnerable
8.5.51
Vulnerable
8.5.53
Vulnerable
8.5.54
Vulnerable
8.5.55
Vulnerable
8.5.56
Vulnerable
8.5.57
Vulnerable
7.0.100
Vulnerable
7.0.103
Vulnerable
7.0.104
Vulnerable
CVE-2020-1935

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an …
9.0.31
Vulnerable
9.0.33
Vulnerable
9.0.34
Vulnerable
9.0.35
Vulnerable
9.0.36
Vulnerable
9.0.37
Vulnerable
10.0.0-M1
Vulnerable
10.0.0-M3
Vulnerable
10.0.0-M5
Vulnerable
10.0.0-M6
Vulnerable
10.0.0-M7
Vulnerable
8.5.51
Vulnerable
8.5.53
Vulnerable
8.5.54
Vulnerable
8.5.55
Vulnerable
8.5.56
Vulnerable
8.5.57
Vulnerable
7.0.100
Vulnerable
7.0.103
Vulnerable
7.0.104
Vulnerable
7.0.105
Vulnerable
GHSA-gx5v-xp9w-j4cg
Aliases:
CVE-2026-41284
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …
9.0.118
Vulnerable
GHSA-5mp6-jrq3-r938
Aliases:
CVE-2026-43513
Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …
9.0.118
Vulnerable
GHSA-5m62-pw8w-7w9f
Aliases:
CVE-2026-43515
Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …
9.0.118
Vulnerable
GHSA-fv25-8xcx-gqjc
Aliases:
CVE-2026-42498
Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …
9.0.118
Vulnerable
GHSA-h6fc-48rj-7qqh
Aliases:
CVE-2026-43512
Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …
9.0.118
Vulnerable
GHSA-9m89-8frq-c98c
Aliases:
CVE-2026-43514
Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …
9.0.118
Vulnerable
GHSA-767j-jfh2-jvrc
Aliases:
CVE-2019-17569
Potential HTTP request smuggling in Apache Tomcat The refactoring present in Apache Tomcat versions 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 …
7.0.100
Vulnerable
GHSA-qxf4-chvg-4r8r
Aliases:
CVE-2020-1935
Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 …
7.0.100
Vulnerable
GHSA-c9hw-wf7x-jp9j
Aliases:
CVE-2020-1938
Improper Privilege Management in Tomcat When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections …
7.0.100
Vulnerable
CVE-2021-25329

Uncontrolled Resource Consumption The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat with a configuration edge case that was …
9.0.41
Vulnerable
7.0.107
Vulnerable
8.5.61
Vulnerable
CVE-2020-8022
Aliases:
GHSA-gc58-v8h3-x2gr
A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, …
9.0.35
Vulnerable
8.0.53
Vulnerable
CVE-2021-30640

Improper Authentication A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a …
8.5.66
Vulnerable
7.0.109
Vulnerable
9.0.46
Vulnerable
10.0.6
Vulnerable
GHSA-7jqf-v358-p8g7
Aliases:
CVE-2024-38286
Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability Allocation of Resources Without Limits or Throttling vulnerability in Apache … There are no reported fixed by versions.
GHSA-9xv2-5v5q-p794
Aliases:
CVE-2026-65905
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … There are no reported fixed by versions.
GHSA-gcx9-497g-6cp6
Aliases:
CVE-2026-65182
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads … There are no reported fixed by versions.
GHSA-h3x4-894j-xpx5
Aliases:
CVE-2026-68525
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows … There are no reported fixed by versions.
GHSA-2rvv-w9r2-rg7m
Aliases:
CVE-2021-24122
Information Disclosure in Apache Tomcat When serving resources from a network location using the NTFS file system, Apache Tomcat versions …
10.0.0-M10
Vulnerable
7.0.107
Vulnerable
7.0.107
Vulnerable
GHSA-jgwr-3qm3-26f3
Aliases:
CVE-2021-25329
Potential remote code execution in Apache Tomcat The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, …
7.0.108
Vulnerable
7.0.108
Vulnerable
GHSA-xjgh-84hx-56c5
Aliases:
CVE-2017-12617
Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, …
9.0.1
Vulnerable
8.5.23
Vulnerable
8.0.47
Vulnerable
9.0.1
Vulnerable
8.5.23
Vulnerable
8.0.47
Vulnerable
9.0.1
Vulnerable
GHSA-563x-q5rq-57qp
Aliases:
CVE-2026-24880
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …
9.0.116
Vulnerable
11.0.20
Vulnerable
9.0.116
Vulnerable
GHSA-344f-f5vg-2jfj
Aliases:
CVE-2020-9484
Potential remote code execution in Apache Tomcat When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to …
10.0.0-M5
Vulnerable
7.0.104
Vulnerable
10.0.0-M5
Vulnerable
7.0.104
Vulnerable
7.0.104
Vulnerable
CVE-2026-65905
Aliases:
GHSA-9xv2-5v5q-p794
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …
9.0.121
Vulnerable
11.0.25
Vulnerable
Vulnerabilities fixed by this package (7)

Advisory Summary Aliases
CVE-2019-0232
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and …
CVE-2018-1305
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and …
CVE-2018-11784
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a …
CVE-2018-1336
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the …
GHSA-9xcj-c8cr-8c3c
In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation … CVE-2019-17563
CVE-2019-12418
In Apache Tomcat, a local attacker may be able to perform a man-in-the-middle attack to capture user names and passwords … GHSA-hh3j-x4mc-g48r
GHSA-hh3j-x4mc-g48r
Insufficiently Protected Credentials in Apache Tomcat When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured … CVE-2019-12418