Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat@8.0.50 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2018-8034
|
Low: host name verification missing in WebSocket client |
Vulnerable |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults |
Vulnerable Vulnerable |
|
CVE-2018-1336
|
Important: A bug in the UTF-8 decoder can lead to DoS |
Vulnerable |
|
CVE-2013-4286
|
Important: Information disclosure | There are no reported fixed by versions. |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
|
GHSA-44qp-qhfv-c7f6
Aliases: CVE-2021-30639 |
Improper Handling of Exceptional Conditions in Apache Tomcat A vulnerability in Apache Tomcat allows an attacker to remotely trigger a … |
Vulnerable |
|
GHSA-9f3j-pm6f-9fm5
Aliases: CVE-2022-23181 |
Race condition in Apache Tomcat The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into … |
Vulnerable |
|
GHSA-gc58-v8h3-x2gr
Aliases: CVE-2020-8022 |
Incorrect Default Permissions in Apache Tomcat ### Withdrawn As per https://lists.apache.org/thread/0z644xfjo49pn2oxcp9qslkvhhw4tb7q this issue only affects the SUSE built artifacts of … |
Vulnerable |
|
GHSA-gx5v-xp9w-j4cg
Aliases: CVE-2026-41284 |
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
Vulnerable |
|
GHSA-5mp6-jrq3-r938
Aliases: CVE-2026-43513 |
Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This … |
Vulnerable |
|
GHSA-5m62-pw8w-7w9f
Aliases: CVE-2026-43515 |
Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
Vulnerable |
|
GHSA-fv25-8xcx-gqjc
Aliases: CVE-2026-42498 |
Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache … |
Vulnerable |
|
GHSA-h6fc-48rj-7qqh
Aliases: CVE-2026-43512 |
Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
Vulnerable |
|
GHSA-9m89-8frq-c98c
Aliases: CVE-2026-43514 |
Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to … |
Vulnerable |
|
GHSA-qxf4-chvg-4r8r
Aliases: CVE-2020-1935 |
Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 … |
Vulnerable |
|
CVE-2026-24880
Aliases: GHSA-563x-q5rq-57qp |
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-8014
|
Insecure Default Initialization of Resource The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1305
|
Improper Access Control A vulnerability in Tomcat leads to the exposure of resources to users that are not authorised to … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1336
|
Loop with Unreachable Exit Condition (Infinite Loop) An improper handling of overflow in the UTF-8 decoder with supplementary characters can … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-8034
|
Improper Certificate Validation The host name verification when using TLS with the `WebSocket` client was missing. |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-8014
|
Low: CORS filter has insecure defaults | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2018-1305
|
Important: Security constraint annotations applied too late | |
|
CVE-2018-1304
|
Important: Security constraints mapped to context root are ignored | |
|
CVE-2018-1304
|
Improper Access Control Unauthorised users could gain access to web application resources. Only security constraints with a URL pattern of … |