VulnerableCode Package Details - pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.0.44

Vulnerabilities affecting this package (30)

Advisory	Summary	Fixed in package version
CVE-2018-1304	The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in …	9.0.6 Vulnerable 9.0.7 Vulnerable 9.0.8 Vulnerable 9.0.10 Vulnerable 9.0.11 Vulnerable 9.0.12 Vulnerable 9.0.13 Vulnerable 9.0.14 Vulnerable 9.0.16 Vulnerable 9.0.17 Vulnerable 9.0.19 Vulnerable 9.0.20 Vulnerable 9.0.21 Vulnerable 9.0.22 Vulnerable 9.0.24 Vulnerable 9.0.26 Vulnerable 9.0.27 Vulnerable 9.0.29 Vulnerable 9.0.30 Vulnerable 9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 10.0.0-M1 Vulnerable 10.0.0-M3 Vulnerable 8.0.50 Vulnerable 8.0.51 Vulnerable 8.0.53 Vulnerable 8.5.28 Vulnerable 8.5.29 Vulnerable 8.5.30 Vulnerable 8.5.31 Vulnerable 8.5.33 Vulnerable 8.5.34 Vulnerable 8.5.35 Vulnerable 8.5.37 Vulnerable 8.5.38 Vulnerable 8.5.39 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 8.5.42 Vulnerable 8.5.43 Vulnerable 8.5.45 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.49 Vulnerable 8.5.50 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.54 Vulnerable
CVE-2019-17563	When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a …	There are no reported fixed by versions.
CVE-2018-8034	The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions …	9.0.10 Vulnerable 9.0.11 Vulnerable 9.0.12 Vulnerable 9.0.30 Vulnerable 8.0.53 Vulnerable 8.5.33 Vulnerable 8.5.34 Vulnerable 7.0.90 Vulnerable 7.0.91 Vulnerable
CVE-2019-0221	The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided …	9.0.19 Vulnerable 9.0.20 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 7.0.94 Vulnerable
CVE-2020-1938	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats …	9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 9.0.35 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable 10.0.0-M1 Vulnerable 10.0.0-M3 Vulnerable 10.0.0-M5 Vulnerable 10.0.0-M6 Vulnerable 10.0.0-M7 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.54 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable
CVE-2018-1305	Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and …	9.0.6 Vulnerable 9.0.7 Vulnerable 9.0.8 Vulnerable 9.0.10 Vulnerable 9.0.11 Vulnerable 9.0.12 Vulnerable 9.0.13 Vulnerable 9.0.14 Vulnerable 9.0.16 Vulnerable 9.0.17 Vulnerable 9.0.19 Vulnerable 9.0.20 Vulnerable 9.0.21 Vulnerable 9.0.22 Vulnerable 9.0.24 Vulnerable 9.0.26 Vulnerable 9.0.27 Vulnerable 9.0.29 Vulnerable 9.0.30 Vulnerable 9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 9.0.35 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable 10.0.0-M1 Vulnerable 10.0.0-M3 Vulnerable 10.0.0-M5 Vulnerable 10.0.0-M6 Vulnerable 10.0.0-M7 Vulnerable 8.0.50 Vulnerable 8.0.51 Vulnerable 8.0.53 Vulnerable 8.5.28 Vulnerable 8.5.29 Vulnerable 8.5.30 Vulnerable 8.5.31 Vulnerable 8.5.33 Vulnerable 8.5.34 Vulnerable 8.5.35 Vulnerable 8.5.37 Vulnerable 8.5.38 Vulnerable 8.5.39 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 8.5.42 Vulnerable 8.5.43 Vulnerable 8.5.45 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.49 Vulnerable 8.5.50 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.54 Vulnerable 7.0.86 Vulnerable 7.0.88 Vulnerable 7.0.90 Vulnerable 7.0.91 Vulnerable 7.0.94 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.99 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable 7.0.105 Vulnerable
CVE-2018-11784	When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a …	9.0.12 Vulnerable 9.0.13 Vulnerable 9.0.14 Vulnerable 9.0.16 Vulnerable 9.0.17 Vulnerable 9.0.19 Vulnerable 9.0.20 Vulnerable 9.0.21 Vulnerable 9.0.22 Vulnerable 9.0.24 Vulnerable 9.0.26 Vulnerable 9.0.27 Vulnerable 9.0.29 Vulnerable 9.0.30 Vulnerable 9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 9.0.35 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable 10.0.0-M1 Vulnerable 10.0.0-M3 Vulnerable 10.0.0-M5 Vulnerable 10.0.0-M6 Vulnerable 10.0.0-M7 Vulnerable 8.5.34 Vulnerable 8.5.35 Vulnerable 8.5.37 Vulnerable 8.5.38 Vulnerable 8.5.39 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 8.5.42 Vulnerable 8.5.43 Vulnerable 8.5.45 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.49 Vulnerable 8.5.50 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.54 Vulnerable 7.0.91 Vulnerable 7.0.94 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.99 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable 7.0.105 Vulnerable
CVE-2018-1336	An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the …	9.0.8 Vulnerable 9.0.10 Vulnerable 9.0.11 Vulnerable 9.0.12 Vulnerable 9.0.13 Vulnerable 9.0.14 Vulnerable 9.0.16 Vulnerable 9.0.17 Vulnerable 9.0.19 Vulnerable 9.0.20 Vulnerable 9.0.21 Vulnerable 9.0.22 Vulnerable 9.0.24 Vulnerable 9.0.26 Vulnerable 9.0.27 Vulnerable 9.0.29 Vulnerable 9.0.30 Vulnerable 9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 9.0.35 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable 10.0.0-M1 Vulnerable 10.0.0-M3 Vulnerable 10.0.0-M5 Vulnerable 10.0.0-M6 Vulnerable 10.0.0-M7 Vulnerable 8.0.53 Vulnerable 8.5.31 Vulnerable 8.5.33 Vulnerable 8.5.34 Vulnerable 8.5.35 Vulnerable 8.5.37 Vulnerable 8.5.38 Vulnerable 8.5.39 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 8.5.42 Vulnerable 8.5.43 Vulnerable 8.5.45 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.49 Vulnerable 8.5.50 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.54 Vulnerable 7.0.88 Vulnerable 7.0.90 Vulnerable 7.0.91 Vulnerable 7.0.94 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.99 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable
GHSA-9xcj-c8cr-8c3c Aliases: CVE-2019-17563	In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation …	8.5.50 Vulnerable
GHSA-gx5v-xp9w-j4cg Aliases: CVE-2026-41284	Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-5mp6-jrq3-r938 Aliases: CVE-2026-43513	Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …	9.0.118 Vulnerable
GHSA-5m62-pw8w-7w9f Aliases: CVE-2026-43515	Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable
GHSA-fv25-8xcx-gqjc Aliases: CVE-2026-42498	Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …	9.0.118 Vulnerable
GHSA-h6fc-48rj-7qqh Aliases: CVE-2026-43512	Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-9m89-8frq-c98c Aliases: CVE-2026-43514	Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …	9.0.118 Vulnerable
GHSA-qxf4-chvg-4r8r Aliases: CVE-2020-1935	Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 …	8.5.51 Vulnerable
GHSA-c9hw-wf7x-jp9j Aliases: CVE-2020-1938	Improper Privilege Management in Tomcat When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections …	8.5.51 Vulnerable
CVE-2019-12418 Aliases: GHSA-hh3j-x4mc-g48r	In Apache Tomcat, a local attacker may be able to perform a man-in-the-middle attack to capture user names and passwords …	9.0.29 Vulnerable 8.5.49 Vulnerable 7.0.99 Vulnerable
CVE-2020-8022 Aliases: GHSA-gc58-v8h3-x2gr	A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, …	9.0.35 Vulnerable 8.0.53 Vulnerable
GHSA-8vmx-qmch-mpqg Aliases: CVE-2019-0232	Apache Tomcat OS Command Injection vulnerability When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 …	8.5.40 Vulnerable 8.5.40 Vulnerable
GHSA-qcxh-w3j9-58qr Aliases: CVE-2019-0199	Apache Tomcat Denial of Service vulnerability The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted …	8.5.38 Vulnerable 8.5.38 Vulnerable
GHSA-m59c-jpc8-m2x4 Aliases: CVE-2018-1336	In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder An improper handing of overflow in …	9.0.8 Vulnerable 8.0.51 Vulnerable 8.0.51 Vulnerable
GHSA-46j3-r4pj-4835 Aliases: CVE-2018-8034	The host name verification missing in Apache Tomcat The host name verification when using TLS with the WebSocket client was …	9.0.10 Vulnerable 8.0.53 Vulnerable 9.0.10 Vulnerable 8.0.53 Vulnerable 8.0.53 Vulnerable
GHSA-6rxj-58jh-436r Aliases: CVE-2018-1304	Apache Tomcat unauthorized access vulnerability The URL pattern of "" (the empty string) which exactly maps to the context root …	9.0.5 Vulnerable 8.0.51 Vulnerable 9.0.5 Vulnerable 8.0.51 Vulnerable 8.0.51 Vulnerable
GHSA-r4x2-3cq5-hqvp Aliases: CVE-2018-8014	The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins The …	8.0.53 Vulnerable 8.0.53 Vulnerable 8.0.53 Vulnerable
GHSA-jgwr-3qm3-26f3 Aliases: CVE-2021-25329	Potential remote code execution in Apache Tomcat The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, …	8.5.61 Vulnerable 8.5.61 Vulnerable
GHSA-xjgh-84hx-56c5 Aliases: CVE-2017-12617	Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, …	9.0.1 Vulnerable 8.5.23 Vulnerable 8.0.47 Vulnerable 9.0.1 Vulnerable 8.5.23 Vulnerable 8.0.47 Vulnerable 9.0.1 Vulnerable 8.0.47 Vulnerable
GHSA-hh3j-x4mc-g48r Aliases: CVE-2019-12418	Insufficiently Protected Credentials in Apache Tomcat When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured …	8.5.49 Vulnerable 8.5.49 Vulnerable
GHSA-563x-q5rq-57qp Aliases: CVE-2026-24880	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …	9.0.116 Vulnerable 11.0.20 Vulnerable 9.0.116 Vulnerable
GHSA-344f-f5vg-2jfj Aliases: CVE-2020-9484	Potential remote code execution in Apache Tomcat When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to …	10.0.0-M5 Vulnerable 8.5.55 Vulnerable 10.0.0-M5 Vulnerable 8.5.55 Vulnerable 8.5.55 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0

Advisory	Summary	Aliases
CVE-2011-1088	Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via …
CVE-2019-0199	The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS …
CVE-2011-1582	Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured …
CVE-2017-5664	Improper Handling of Exceptional Conditions The error page mechanism of the Java Servlet Specification requires that, when an error occurs …