VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat@9.0.0.M21

Vulnerabilities affecting this package (140)

Advisory	Summary	Fixed in package version
CVE-2018-8014	Low: CORS filter has insecure defaults	8.0.53 Vulnerable 8.5.32 Vulnerable
CVE-2016-6797	Low: Unrestricted Access to Global Resources	8.5.5 Vulnerable
CVE-2016-6796	Low: Security Manager Bypass	8.5.5 Vulnerable
CVE-2016-6794	Low: System Property Disclosure	8.5.5 Vulnerable
CVE-2016-5018	Low: Security Manager Bypass	8.5.5 Vulnerable
CVE-2016-0762	Low: Timing Attack	8.5.5 Vulnerable
CVE-2016-3092	Moderate: Denial of Service	8.5.3 Vulnerable
CVE-2013-4286	Important: Information disclosure	There are no reported fixed by versions.
CVE-2018-8014	Low: CORS filter has insecure defaults	There are no reported fixed by versions.
GHSA-4vww-mc66-62m6 Aliases: CVE-2021-33037	HTTP Request Smuggling in Apache Tomcat Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not …	9.0.48 Vulnerable
GHSA-36qh-35cm-5w2w Aliases: CVE-2021-30640	Authentication Bypass by Alternate Name in Apache Tomcat A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker …	9.0.45 Vulnerable
GHSA-hgrr-935x-pq79 Aliases: CVE-2025-61795	Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …	9.0.110 Vulnerable
GHSA-wmwf-9ccg-fff5 Aliases: CVE-2025-55752	Apache Tomcat Vulnerable to Relative Path Traversal The fix for bug 60013 introduced a regression where the rewritten URL was …	9.0.109 Vulnerable
GHSA-h3ch-5pp2-vh6w Aliases: CVE-2022-25762	Improper socket reuse in Apache Tomcat If a web application sends a WebSocket message concurrently with the WebSocket connection closing …	9.0.20 Vulnerable
GHSA-jx7c-7mj5-9438 Aliases: CVE-2021-43980	Apache Tomcat Race Condition vulnerability The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to …	9.0.62 Vulnerable
GHSA-g8pj-r55q-5c2v Aliases: CVE-2023-42795	Apache Tomcat Incomplete Cleanup vulnerability Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from …	9.0.81 Vulnerable
GHSA-r6j3-px5g-cq3x Aliases: CVE-2023-45648	Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 …	9.0.81 Vulnerable
GHSA-q3mw-pvr8-9ggc Aliases: CVE-2023-41080	Apache Tomcat Open Redirect vulnerability URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue …	9.0.80 Vulnerable
GHSA-9m3c-qcxr-9x87 Aliases: CVE-2026-25854	Apache Tomcat has an Open Redirect vulnerability Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via …	9.0.116 Vulnerable
GHSA-gx5v-xp9w-j4cg Aliases: CVE-2026-41284	Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-5mp6-jrq3-r938 Aliases: CVE-2026-43513	Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …	9.0.118 Vulnerable
GHSA-5m62-pw8w-7w9f Aliases: CVE-2026-43515	Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable
GHSA-fv25-8xcx-gqjc Aliases: CVE-2026-42498	Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …	9.0.118 Vulnerable
GHSA-h6fc-48rj-7qqh Aliases: CVE-2026-43512	Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-9m89-8frq-c98c Aliases: CVE-2026-43514	Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …	9.0.118 Vulnerable
CVE-2019-12418	Insufficiently Protected Credentials When Apache Tomcat is configured with the JMX Remote Lifecycle Listener, a local attacker without access to …	8.5.49 Vulnerable 7.0.99 Vulnerable 9.0.29 Vulnerable
CVE-2019-17563	Session Fixation When using `FORM` authentication with Apache Tomcat there is a narrow window where an attacker could perform a …	8.5.50 Vulnerable 7.0.99 Vulnerable 9.0.30 Vulnerable
CVE-2024-21733 Aliases: GHSA-f4qf-m5gf-8jm8	Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from …	8.5.64 Vulnerable 9.0.44 Vulnerable
CVE-2019-0199	Uncontrolled Resource Consumption The HTTP/2 implementation in Apache Tomcat accepted streams with excessive numbers of `SETTINGS` frames and also permitted …	8.5.38 Vulnerable 9.0.16 Vulnerable
GHSA-653p-vg55-5652 Aliases: CVE-2024-54677	Apache Tomcat Uncontrolled Resource Consumption vulnerability Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads …	9.0.98 Vulnerable 9.0.98 Vulnerable
CVE-2026-24880 Aliases: GHSA-563x-q5rq-57qp	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …	11.0.20 Vulnerable 10.1.52 Vulnerable 9.0.116 Vulnerable 11.0.20 Vulnerable 10.1.52 Vulnerable 9.0.116 Vulnerable
CVE-2025-61795 Aliases: GHSA-hgrr-935x-pq79	Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …	11.0.12 Vulnerable 9.0.110 Vulnerable 10.1.47 Vulnerable 11.0.12 Vulnerable 9.0.110 Vulnerable 10.1.47 Vulnerable
CVE-2018-1305	Improper Access Control A vulnerability in Tomcat leads to the exposure of resources to users that are not authorised to …	7.0.85 Vulnerable 9.0.5 Vulnerable 7.0.85 Vulnerable 9.0.5 Vulnerable
CVE-2020-13934 Aliases: GHSA-vf77-8h7g-gghp	Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat An h2c direct connection to Apache …	8.5.56 Vulnerable 9.0.36 Vulnerable 10.0.0-M6 Vulnerable 8.5.56 Vulnerable 9.0.36 Vulnerable 10.0.0-M6 Vulnerable
CVE-2024-54677 Aliases: GHSA-653p-vg55-5652	Apache Tomcat Uncontrolled Resource Consumption vulnerability Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads …	11.0.2 Vulnerable 10.1.34 Vulnerable 9.0.98 Vulnerable 11.0.2 Vulnerable 10.1.34 Vulnerable 9.0.98 Vulnerable
CVE-2020-11996 Aliases: GHSA-53hp-jpwq-2jgq	Uncontrolled Resource Consumption in Apache Tomcat A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, …	8.5.55 Vulnerable 9.0.35 Vulnerable 10.0.0-M5 Vulnerable 8.5.55 Vulnerable 9.0.35 Vulnerable 10.0.0-M5 Vulnerable
CVE-2020-13935 Aliases: GHSA-m7jv-hq7h-mq7c	Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …	8.5.57 Vulnerable 7.0.105 Vulnerable 9.0.37 Vulnerable 10.0.0-M7 Vulnerable 8.5.57 Vulnerable 7.0.105 Vulnerable 9.0.37 Vulnerable 10.0.0-M7 Vulnerable
GHSA-m7jv-hq7h-mq7c Aliases: CVE-2020-13935	Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …	9.0.37 Vulnerable 9.0.37 Vulnerable
GHSA-r29c-68gh-xp6x Aliases: CVE-2026-41293	Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable 9.0.118 Vulnerable
GHSA-fpj8-gq4v-p354 Aliases: CVE-2025-66614	Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, …	9.0.113 Vulnerable 9.0.113 Vulnerable
GHSA-9xv2-5v5q-p794 Aliases: CVE-2026-65905	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	9.0.121 Vulnerable
GHSA-gcx9-497g-6cp6 Aliases: CVE-2026-65182	Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads …	9.0.121 Vulnerable
GHSA-h3x4-894j-xpx5 Aliases: CVE-2026-68525	Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows …	9.0.121 Vulnerable
CVE-2026-87022	Low: WebSocket message smuggling with per-message-deflate	9.0.122 Vulnerable
CVE-2026-79677	Moderate: WebSocket DoS due to lost asynchronous write timeout	9.0.122 Vulnerable
CVE-2026-78383	Important: AJP DoS via missing request body	9.0.122 Vulnerable
CVE-2026-76183	Important: Bypass of security constraints for WebSocket endpoints	9.0.122 Vulnerable
CVE-2026-75973	Low: Cross-context authentication mix-up with Jakarta Authentication configured	9.0.122 Vulnerable
CVE-2026-73581	Moderate: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore	9.0.122 Vulnerable
CVE-2026-73180	Low: Authenticated WebSocket session survives end of HTTP session	9.0.121 Vulnerable
CVE-2026-68569	Important: Principal lookup could fail open in some cases	9.0.121 Vulnerable
CVE-2026-68525	Low: Redirect after FORM authentication may bypass method specific constraints	9.0.121 Vulnerable
CVE-2026-65927	Important: RewriteValve [N] restarts at the second rule and may bypass access control	9.0.121 Vulnerable
CVE-2026-65905	Low: Limited replay attack possible with DIGEST authentication	9.0.121 Vulnerable
CVE-2026-65182	Important: Security constraint bypass	9.0.121 Vulnerable
CVE-2026-59083	Low: Incorrect URL decoding in RewriteValve may allow security control bypass	9.0.120 Vulnerable
CVE-2026-55956	Moderate: Security constraints for default servlet ignored method	9.0.119 Vulnerable
CVE-2026-55276	Low: Logged effective web.xml is incomplete	9.0.119 Vulnerable
CVE-2026-53404	Low: Bad ornext processing in RewriteValve	9.0.119 Vulnerable
CVE-2026-50229	Low: XSS in number guess example	9.0.119 Vulnerable
CVE-2026-43515	Moderate: Security constraints not correctly applied	9.0.118 Vulnerable
CVE-2026-43514	Low: AJP secret compared in non-constant time	9.0.118 Vulnerable
CVE-2026-43513	Low: LockOutRealm treats user names as case-sensitive	9.0.118 Vulnerable
CVE-2026-43512	Moderate: Digest authenticator will authenticate any unknown user	9.0.118 Vulnerable
CVE-2026-41293	Low: HTTP/2 request headers not validated	9.0.118 Vulnerable
CVE-2026-41284	Low: Unbounded read in WebDAV LOCK and PROPFIND handling	9.0.118 Vulnerable
CVE-2025-66614	Moderate: The fix for CVE-2025-66614 was incomplete	9.0.113 Vulnerable
CVE-2026-24880	Low: Request smuggling via invalid chunk extension	9.0.116 Vulnerable
CVE-2026-24733	Low: Security constraint bypass	9.0.113 Vulnerable
CVE-2025-61795	Low: Delayed cleaning of multipart upload temporary files may lead to DoS	9.0.110 Vulnerable
CVE-2025-55752	Important: Directory traversal via Rewrite Valve with possible remote code execution if PUT is enabled	9.0.109 Vulnerable
CVE-2025-48989	Important: DoS in HTTP/2 due to client triggered stream reset	9.0.108 Vulnerable
CVE-2025-52434	Important: APR/Native Connector crash leading to DoS	9.0.107 Vulnerable
CVE-2025-52520	Low: DoS due to overflow in file upload limit	9.0.107 Vulnerable
CVE-2025-53506	Important: DoS via excessive HTTP/2 streams	9.0.107 Vulnerable
CVE-2025-55668	Moderate: Session fixation possible via rewrite valve	9.0.106 Vulnerable
CVE-2025-49125	Moderate: Security constraint bypass for PreResources and PostResources	9.0.106 Vulnerable
CVE-2025-48988	Important: DoS in multipart upload	9.0.106 Vulnerable
CVE-2025-48976	Important: DoS in Commons FileUpload	9.0.106 Vulnerable
CVE-2025-46701	Low: CGI security constraint bypass	9.0.105 Vulnerable
CVE-2025-31651	Low: Rewrite rule bypass	9.0.104 Vulnerable
CVE-2026-55957	Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind	9.0.102 Vulnerable
CVE-2025-24813	Important: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet -	9.0.99 Vulnerable
CVE-2024-56337	Important: Remote Code Execution via write enabled Default Servlet. Mitigation for CVE-2024-50379 was incomplete -	9.0.98 Vulnerable
CVE-2024-54677	Low: DoS in examples web application	9.0.98 Vulnerable
CVE-2024-50379	Important: Remote Code Execution via write enabled Default Servlet	9.0.98 Vulnerable
CVE-2024-52316	Low: Authentication Bypass	9.0.96 Vulnerable
CVE-2024-34750	Important: Denial of Service	9.0.90 Vulnerable
CVE-2024-23672	Important: Denial of Service	9.0.86 Vulnerable
CVE-2024-24549	Important: Denial of Service	9.0.86 Vulnerable
CVE-2023-46589	Important: Request smuggling	9.0.83 Vulnerable
CVE-2023-45648	Important: Request smuggling	9.0.81 Vulnerable
CVE-2023-44487	Important: Denial of Service	9.0.81 Vulnerable
CVE-2023-42795	Important: Information Disclosure	9.0.81 Vulnerable
CVE-2023-41080	Moderate: Open redirect	9.0.80 Vulnerable
CVE-2023-28708	Important: Apache Tomcat information disclosure	9.0.72 Vulnerable
CVE-2023-24998	Important: Apache Tomcat denial of service	9.0.71 Vulnerable
CVE-2022-42252	Low: Apache Tomcat request smuggling	9.0.68 Vulnerable
CVE-2021-43980	High: Information Disclosure	9.0.62 Vulnerable
CVE-2021-33037	Important: Request Smuggling	9.0.48 Vulnerable
CVE-2021-30640	Low: Authentication weakness	9.0.46 Vulnerable
CVE-2021-41079	Important: Denial of Service	9.0.44 Vulnerable
CVE-2024-21733	Important: Information Disclosure	9.0.44 Vulnerable
CVE-2020-9484	Low: Fix for CVE-2020-9484 was incomplete	9.0.43 Vulnerable 9.0.35 Vulnerable
CVE-2021-25122	Important: Request mix-up with h2c	9.0.43 Vulnerable
CVE-2021-24122	Important: Information disclosure	9.0.40 Vulnerable
CVE-2020-17527	Moderate: HTTP/2 request header mix-up	9.0.40 Vulnerable
CVE-2020-13943	Moderate: HTTP/2 request mix-up	9.0.38 Vulnerable
CVE-2020-13935	Important: WebSocket DoS	9.0.37 Vulnerable
CVE-2020-13934	Moderate: HTTP/2 DoS	9.0.37 Vulnerable
CVE-2020-11996	Important: HTTP/2 DoS	9.0.36 Vulnerable
CVE-2020-1938	Important: AJP Request Injection and potential Remote Code Execution	9.0.31 Vulnerable
CVE-2020-1935	Low: HTTP Request Smuggling	9.0.31 Vulnerable
CVE-2019-17563	Low: Session fixation	9.0.30 Vulnerable
CVE-2019-12418	Moderate: Local Privilege Escalation	9.0.29 Vulnerable
CVE-2022-25762	Important: Request mix-up	9.0.21 Vulnerable
CVE-2019-10072	Important: Denial of Service	9.0.20 Vulnerable
CVE-2019-0232	Important: Remote Code Execution on Windows	9.0.19 Vulnerable
CVE-2019-0221	Low: XSS in SSI printenv	9.0.19 Vulnerable
CVE-2019-0199	Important: Denial of Service	9.0.16 Vulnerable
CVE-2018-11784	Moderate: Open Redirect	9.0.12 Vulnerable
CVE-2018-8034	Low: host name verification missing in WebSocket client	9.0.10 Vulnerable
CVE-2018-8037	Important: Information Disclosure	9.0.10 Vulnerable
CVE-2018-8014	Low: CORS filter has insecure defaults	There are no reported fixed by versions.
CVE-2018-1336	Important: A bug in the UTF-8 decoder can lead to DoS	9.0.8 Vulnerable
CVE-2018-1305	Important: Security constraint annotations applied too late	9.0.5 Vulnerable
CVE-2018-1304	Important: Security constraints mapped to context root are ignored	9.0.5 Vulnerable
CVE-2017-12617	Important: Remote Code Execution	9.0.1 Vulnerable
CVE-2017-7675	Important: Security Constraint Bypass	There are no reported fixed by versions.
CVE-2017-7674	Moderate: Cache Poisoning	There are no reported fixed by versions.
GHSA-53hp-jpwq-2jgq Aliases: CVE-2020-11996	Uncontrolled Resource Consumption in Apache Tomcat A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, …	10.0.0-M5 Vulnerable 9.0.35 Vulnerable 9.0.35 Vulnerable
GHSA-vf77-8h7g-gghp Aliases: CVE-2020-13934	Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat An h2c direct connection to Apache …	10.0.0-M6 Vulnerable 9.0.36 Vulnerable 9.0.36 Vulnerable
GHSA-73rx-3f9r-x949 Aliases: CVE-2017-7674	Insufficient Verification of Data Authenticity in Apache Tomcat The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, …	9.0.0.M22 Vulnerable 9.0.0.M22 Vulnerable 9.0.0.M22 Vulnerable
GHSA-68g5-8q7f-m384 Aliases: CVE-2017-7675	Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to …	9.0.0.M22 Vulnerable 9.0.0.M22 Vulnerable 9.0.0.M22 Vulnerable
CVE-2026-55956	Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method …	11.0.23 Vulnerable 10.1.56 Vulnerable 9.0.119 Vulnerable
CVE-2026-50229	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache …	11.0.23 Vulnerable 10.1.56 Vulnerable 9.0.119 Vulnerable
CVE-2026-65905 Aliases: GHSA-9xv2-5v5q-p794	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	11.0.25 Vulnerable 9.0.121 Vulnerable
CVE-2026-53404	Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain …	11.0.23 Vulnerable 10.1.56 Vulnerable 9.0.119 Vulnerable
CVE-2026-101296	Important: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms	9.0.123 Vulnerable
CVE-2026-74049	Low: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)	9.0.123 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0