VulnerableCode Package Details - pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.43

Vulnerabilities affecting this package (66)

Advisory	Summary	Fixed in package version
CVE-2019-17563	When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a …	There are no reported fixed by versions.
CVE-2020-1938	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats …	9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 9.0.35 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable 10.0.0-M1 Vulnerable 10.0.0-M3 Vulnerable 10.0.0-M5 Vulnerable 10.0.0-M6 Vulnerable 10.0.0-M7 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.54 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable
CVE-2020-1935	In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an …	9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 9.0.35 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable 10.0.0-M1 Vulnerable 10.0.0-M3 Vulnerable 10.0.0-M5 Vulnerable 10.0.0-M6 Vulnerable 10.0.0-M7 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.54 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable 7.0.105 Vulnerable
CVE-2020-11996	A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to …	9.0.36 Vulnerable 9.0.37 Vulnerable 10.0.0-M6 Vulnerable 10.0.0-M7 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable
GHSA-hgrr-935x-pq79 Aliases: CVE-2025-61795	Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …	There are no reported fixed by versions.
GHSA-wmwf-9ccg-fff5 Aliases: CVE-2025-55752	Apache Tomcat Vulnerable to Relative Path Traversal The fix for bug 60013 introduced a regression where the rewritten URL was …	There are no reported fixed by versions.
GHSA-h2fw-rfh5-95r3 Aliases: CVE-2025-46701	Apache Tomcat - CGI security constraint bypass Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security …	There are no reported fixed by versions.
GHSA-wr62-c79q-cv37 Aliases: CVE-2025-52520	Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits For some unlikely configurations of multipart upload, …	There are no reported fixed by versions.
GHSA-25xr-qj8w-c4vf Aliases: CVE-2025-53506	Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams Uncontrolled Resource Consumption vulnerability in Apache Tomcat if …	There are no reported fixed by versions.
GHSA-83qj-6fr2-vhqg Aliases: CVE-2025-24813	Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Path Equivalence: 'file.Name' (Internal Dot) leading to …	There are no reported fixed by versions.
GHSA-p22x-g9px-3945 Aliases: CVE-2022-42252	Apache Tomcat may reject request containing invalid Content-Length header If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to …	8.5.83 Vulnerable
GHSA-9xcj-c8cr-8c3c Aliases: CVE-2019-17563	In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation …	8.5.50 Vulnerable
GHSA-5j33-cvvr-w245 Aliases: CVE-2024-50379	Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat …	There are no reported fixed by versions.
GHSA-wm9w-rjj3-j356 Aliases: CVE-2024-34750	Apache Tomcat - Denial of Service Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing …	There are no reported fixed by versions.
GHSA-g8pj-r55q-5c2v Aliases: CVE-2023-42795	Apache Tomcat Incomplete Cleanup vulnerability Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from …	8.5.94 Vulnerable
GHSA-r6j3-px5g-cq3x Aliases: CVE-2023-45648	Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 …	8.5.94 Vulnerable
GHSA-qppj-fm5r-hxr3 Aliases: CVE-2023-44487	HTTP/2 Stream Cancellation Attack ## HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that …	8.5.94 Vulnerable
GHSA-q3mw-pvr8-9ggc Aliases: CVE-2023-41080	Apache Tomcat Open Redirect vulnerability URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue …	8.5.93 Vulnerable
GHSA-9m3c-qcxr-9x87 Aliases: CVE-2026-25854	Apache Tomcat has an Open Redirect vulnerability Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via …	9.0.116 Vulnerable
GHSA-gx5v-xp9w-j4cg Aliases: CVE-2026-41284	Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-5mp6-jrq3-r938 Aliases: CVE-2026-43513	Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …	9.0.118 Vulnerable
GHSA-5m62-pw8w-7w9f Aliases: CVE-2026-43515	Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable
GHSA-fv25-8xcx-gqjc Aliases: CVE-2026-42498	Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …	9.0.118 Vulnerable
GHSA-h6fc-48rj-7qqh Aliases: CVE-2026-43512	Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-9m89-8frq-c98c Aliases: CVE-2026-43514	Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …	9.0.118 Vulnerable
GHSA-qxf4-chvg-4r8r Aliases: CVE-2020-1935	Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 …	8.5.51 Vulnerable
GHSA-c9hw-wf7x-jp9j Aliases: CVE-2020-1938	Improper Privilege Management in Tomcat When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections …	8.5.51 Vulnerable
CVE-2022-42252 Aliases: GHSA-p22x-g9px-3945	Improper Input Validation If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was …	8.5.83 Vulnerable 9.0.68 Vulnerable 10.0.27 Vulnerable 10.1.1 Vulnerable
CVE-2022-29885	Uncontrolled Resource Consumption The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to …	10.1.1 Vulnerable 8.5.79 Vulnerable 9.0.63 Vulnerable 10.0.21 Vulnerable
CVE-2022-25762 Aliases: GHSA-h3ch-5pp2-vh6w	Improper Resource Shutdown or Release If a web application sends a WebSocket message concurrently with the WebSocket connection closing when …	9.0.20 Vulnerable 8.5.75 Vulnerable
CVE-2019-12418 Aliases: GHSA-hh3j-x4mc-g48r	In Apache Tomcat, a local attacker may be able to perform a man-in-the-middle attack to capture user names and passwords …	9.0.29 Vulnerable 8.5.49 Vulnerable 7.0.99 Vulnerable
CVE-2021-25329	Uncontrolled Resource Consumption The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat with a configuration edge case that was …	9.0.41 Vulnerable 7.0.107 Vulnerable 8.5.61 Vulnerable
CVE-2020-13934	Denial of Service h2c does not release the `HTTP/1.1` processor after the upgrade to `HTTP/2.` If a sufficient number of …	9.0.37 Vulnerable 8.5.57 Vulnerable
CVE-2021-30640	Improper Authentication A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a …	8.5.66 Vulnerable 7.0.109 Vulnerable 9.0.46 Vulnerable 10.0.6 Vulnerable
CVE-2020-17527	Information Exposure While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header …	9.0.40 Vulnerable 10.0.2 Vulnerable 8.5.60 Vulnerable
CVE-2021-41079	Improper Input Validation Apache Tomcat does not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or …	8.5.64 Vulnerable 9.0.44 Vulnerable 10.0.4 Vulnerable
GHSA-f4qf-m5gf-8jm8 Aliases: CVE-2024-21733	Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information Generation of Error Message Containing Sensitive Information vulnerability in …	8.5.64 Vulnerable 8.5.64 Vulnerable
GHSA-4j3c-42xv-3f84 Aliases: CVE-2025-52434	Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization …	There are no reported fixed by versions.
GHSA-7jqf-v358-p8g7 Aliases: CVE-2024-38286	Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability Allocation of Resources Without Limits or Throttling vulnerability in Apache …	There are no reported fixed by versions.
CVE-2025-52434 Aliases: GHSA-4j3c-42xv-3f84	Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization …	9.0.107 Vulnerable
CVE-2025-61795 Aliases: GHSA-hgrr-935x-pq79	Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …	11.0.12 Vulnerable 10.1.47 Vulnerable 9.0.110 Vulnerable 11.0.12 Vulnerable 10.1.47 Vulnerable 9.0.110 Vulnerable
CVE-2020-11996 Aliases: GHSA-53hp-jpwq-2jgq	Uncontrolled Resource Consumption in Apache Tomcat A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, …	9.0.35 Vulnerable 10.0.0-M5 Vulnerable 8.5.55 Vulnerable 9.0.35 Vulnerable 10.0.0-M5 Vulnerable 8.5.55 Vulnerable
CVE-2023-28708 Aliases: GHSA-2c9m-w27f-53rm	Unprotected Transport of Credentials When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the …	8.5.86 Vulnerable 9.0.72 Vulnerable 11.0.0 Vulnerable 10.1.6 Vulnerable 8.5.86 Vulnerable 9.0.72 Vulnerable 11.0.0 Vulnerable 10.1.6 Vulnerable
CVE-2021-43980	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in …	There are no reported fixed by versions.
GHSA-j39c-c8hj-x4j3 Aliases: CVE-2021-25122	Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat When responding to new h2c connection requests, Apache Tomcat …	8.5.63 Vulnerable 8.5.63 Vulnerable
GHSA-r29c-68gh-xp6x Aliases: CVE-2026-41293	Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable 9.0.118 Vulnerable
GHSA-fpj8-gq4v-p354 Aliases: CVE-2025-66614	Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, …	9.0.113 Vulnerable
GHSA-9xv2-5v5q-p794 Aliases: CVE-2026-65905	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	There are no reported fixed by versions.
GHSA-gcx9-497g-6cp6 Aliases: CVE-2026-65182	Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads …	There are no reported fixed by versions.
GHSA-h3x4-894j-xpx5 Aliases: CVE-2026-68525	Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows …	There are no reported fixed by versions.
GHSA-2rvv-w9r2-rg7m Aliases: CVE-2021-24122	Information Disclosure in Apache Tomcat When serving resources from a network location using the NTFS file system, Apache Tomcat versions …	10.0.0-M10 Vulnerable 8.5.60 Vulnerable 8.5.60 Vulnerable
GHSA-jgwr-3qm3-26f3 Aliases: CVE-2021-25329	Potential remote code execution in Apache Tomcat The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, …	8.5.61 Vulnerable 8.5.61 Vulnerable
GHSA-ff77-26x5-69cr Aliases: CVE-2025-31651	Apache Tomcat Rewrite rule bypass Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset …	9.0.104 Vulnerable
GHSA-3p2h-wqq4-wf4h Aliases: CVE-2025-31650	Apache Tomcat Denial of Service via invalid HTTP priority header Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling …	9.0.104 Vulnerable
GHSA-wc4r-xq3c-5cf3 Aliases: CVE-2025-49125	Apache Tomcat - Security constraint bypass for pre/post-resources Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. …	11.0.8 Vulnerable 10.1.42 Vulnerable 9.0.106 Vulnerable
GHSA-h3gc-qfqq-6h8f Aliases: CVE-2025-48988	Apache Tomcat - DoS in multipart upload Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue …	11.0.8 Vulnerable 10.1.42 Vulnerable 9.0.106 Vulnerable
GHSA-53hp-jpwq-2jgq Aliases: CVE-2020-11996	Uncontrolled Resource Consumption in Apache Tomcat A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, …	10.0.0-M5 Vulnerable 8.5.55 Vulnerable 8.5.55 Vulnerable
GHSA-xjgh-84hx-56c5 Aliases: CVE-2017-12617	Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, …	9.0.1 Vulnerable 9.0.1 Vulnerable 9.0.1 Vulnerable
GHSA-hh3j-x4mc-g48r Aliases: CVE-2019-12418	Insufficiently Protected Credentials in Apache Tomcat When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured …	8.5.49 Vulnerable 8.5.49 Vulnerable
GHSA-7w75-32cg-r6g2 Aliases: CVE-2024-24549	Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests Denial of Service due to improper …	8.5.99 Vulnerable 9.0.86 Vulnerable 10.1.19 Vulnerable 11.0.0-M17 Vulnerable 8.5.99 Vulnerable
GHSA-fccv-jmmp-qg76 Aliases: CVE-2023-46589	Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 …	8.5.96 Vulnerable 8.5.96 Vulnerable
GHSA-563x-q5rq-57qp Aliases: CVE-2026-24880	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …	9.0.116 Vulnerable 11.0.20 Vulnerable 9.0.116 Vulnerable
GHSA-344f-f5vg-2jfj Aliases: CVE-2020-9484	Potential remote code execution in Apache Tomcat When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to …	10.0.0-M5 Vulnerable 8.5.55 Vulnerable 10.0.0-M5 Vulnerable 8.5.55 Vulnerable 8.5.55 Vulnerable
CVE-2026-55276 Aliases: GHSA-mqg3-r7h5-24x4	Apache Tomcat - Logged effective web.xml is incomplete Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles …	9.0.119 Vulnerable 10.1.56 Vulnerable 11.0.23 Vulnerable
CVE-2026-65905 Aliases: GHSA-9xv2-5v5q-p794	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	9.0.121 Vulnerable 11.0.25 Vulnerable
CVE-2026-59083 Aliases: GHSA-hcjr-322h-429r	Apache Tomcat - Incorrect URL decoding in RewriteValve may allow security control bypass Improper Handling of URL Encoding (Hex Encoding) …	9.0.120 Vulnerable 10.1.57 Vulnerable 11.0.24 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0

Advisory	Summary	Aliases
CVE-2018-1304	The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in …
CVE-2018-8037	If an async request was completed by the application at the same time as the container triggered the async timeout, …
CVE-2018-8014	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, …
CVE-2019-17569	The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The …
CVE-2019-0232	When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and …
CVE-2018-1305	Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and …
CVE-2019-0199	The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS …
CVE-2018-11784	When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a …
CVE-2018-1336	An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the …