Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.37
purl pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.37
Next non-vulnerable version 8.5.99
Latest non-vulnerable version 11.0.26
Risk score 10.0
Vulnerabilities affecting this package (8)
Advisory Summary Fixed in package version
CVE-2020-13935

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, …
8.5.57
Vulnerable
9.0.37
Vulnerable
10.0.0-M7
Vulnerable
CVE-2023-41080

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 …
8.5.93
Vulnerable
9.0.80
Vulnerable
10.1.13
Vulnerable
CVE-2023-46589

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from …
8.5.96
Vulnerable
9.0.83
Vulnerable
10.1.16
Vulnerable
CVE-2021-24122

Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP …
7.0.107
Not vulnerable
8.5.60
Vulnerable
9.0.40
Vulnerable
10.0.0-M10
Not vulnerable
CVE-2021-43980

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in … There are no reported fixed by versions.
CVE-2020-13935
Aliases:
GHSA-m7jv-hq7h-mq7c
Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …
8.5.57
Vulnerable
9.0.37
Vulnerable
10.0.0-M7
Vulnerable
7.0.105
Vulnerable
8.5.57
Vulnerable
9.0.37
Vulnerable
10.0.0-M7
Vulnerable
7.0.105
Vulnerable
GHSA-m7jv-hq7h-mq7c
Aliases:
CVE-2020-13935
Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …
8.5.57
Vulnerable
8.5.57
Vulnerable
GHSA-v682-8vv8-vpwr
Aliases:
CVE-2024-23672
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections …
11.0.0-M17
Vulnerable
10.1.19
Vulnerable
9.0.86
Vulnerable
8.5.99
Not vulnerable
8.5.99
Not vulnerable
Vulnerabilities fixed by this package (1)

Advisory Summary Aliases
CVE-2018-8034
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions …