VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat-catalina@8.0.8

Vulnerabilities affecting this package (23)

Advisory	Summary	Fixed in package version
CVE-2019-17563	When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a …	There are no reported fixed by versions.
CVE-2019-0221	The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided …	9.0.19 Vulnerable 9.0.20 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 7.0.94 Vulnerable
CVE-2018-1305	Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and …	9.0.8 Vulnerable 9.0.10 Vulnerable 9.0.16 Vulnerable 9.0.19 Vulnerable 9.0.20 Vulnerable 9.0.21 Vulnerable 9.0.22 Vulnerable 9.0.24 Vulnerable 9.0.26 Vulnerable 9.0.27 Vulnerable 9.0.29 Vulnerable 9.0.30 Vulnerable 9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 9.0.35 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable 8.5.28 Vulnerable 8.5.30 Vulnerable 8.5.31 Vulnerable 8.5.32 Vulnerable 8.5.34 Vulnerable 8.5.35 Vulnerable 8.5.37 Vulnerable 8.5.38 Vulnerable 8.5.39 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 8.5.42 Vulnerable 8.5.43 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.50 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 7.0.85 Vulnerable 7.0.90 Vulnerable 7.0.91 Vulnerable 7.0.94 Vulnerable 7.0.96 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 7.0.99 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable 8.5.57 Vulnerable 7.0.105 Vulnerable
GHSA-gx5v-xp9w-j4cg Aliases: CVE-2026-41284	Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-5mp6-jrq3-r938 Aliases: CVE-2026-43513	Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …	9.0.118 Vulnerable
GHSA-5m62-pw8w-7w9f Aliases: CVE-2026-43515	Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable
GHSA-fv25-8xcx-gqjc Aliases: CVE-2026-42498	Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …	9.0.118 Vulnerable
GHSA-h6fc-48rj-7qqh Aliases: CVE-2026-43512	Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-9m89-8frq-c98c Aliases: CVE-2026-43514	Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …	9.0.118 Vulnerable
CVE-2016-3092	Denial of Service The MultipartStream class in this package allows remote attackers to cause a denial of service (CPU consumption) …	7.0.70 Vulnerable 8.0.36 Vulnerable 8.5.3 Vulnerable 9.0.0.M8 Vulnerable
CVE-2017-7674	Insufficient Verification of Data Authenticity The CORS Filter in Apache Tomcat did not add an HTTP Vary header indicating that …	7.0.79 Vulnerable 8.5.16 Vulnerable 9.0.0.M22 Vulnerable
GHSA-cw54-59pw-4g8c Aliases: CVE-2016-8735	Apache Tomcat Improper Access Control vulnerability Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x …	8.0.39 Vulnerable 8.0.39 Vulnerable
GHSA-v646-rx6w-r3qq Aliases: CVE-2016-5388	Improper Access Control in Apache Tomcat Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is …	8.5.5 Vulnerable 8.5.5 Vulnerable
CVE-2026-41293 Aliases: GHSA-r29c-68gh-xp6x	Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	10.1.55 Vulnerable 9.0.118 Vulnerable 11.0.22 Vulnerable 10.1.55 Vulnerable 9.0.118 Vulnerable 11.0.22 Vulnerable
CVE-2024-52316 Aliases: GHSA-xcpr-7mr4-h4xq	Apache Tomcat - Authentication Bypass Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom …	9.0.96 Vulnerable 10.1.30 Vulnerable 11.0.1 Vulnerable 9.0.96 Vulnerable 10.1.30 Vulnerable 11.0.1 Vulnerable
CVE-2026-24880 Aliases: GHSA-563x-q5rq-57qp	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …	10.1.52 Vulnerable 9.0.116 Vulnerable 11.0.20 Vulnerable 10.1.52 Vulnerable 9.0.116 Vulnerable 11.0.20 Vulnerable
CVE-2016-6797 Aliases: GHSA-q6x7-f33r-3wxx	Incorrect Authorization The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 …	7.0.72 Vulnerable 8.5.5 Vulnerable 9.0.0.M10 Vulnerable 8.0.37 Vulnerable 7.0.72 Vulnerable 8.5.5 Vulnerable 9.0.0.M10 Vulnerable 8.0.37 Vulnerable
CVE-2016-5018 Aliases: GHSA-4v3g-g84w-hv7r	Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, …	7.0.72 Vulnerable 8.5.5 Vulnerable 9.0.0.M10 Vulnerable 8.0.37 Vulnerable 7.0.72 Vulnerable 8.5.5 Vulnerable 9.0.0.M10 Vulnerable 8.0.37 Vulnerable
CVE-2016-8745 Aliases: GHSA-w3j5-q8f2-3cqq	Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat A bug in the error handling of the send …	7.0.75 Vulnerable 8.0.41 Vulnerable 8.5.9 Vulnerable 7.0.75 Vulnerable 8.0.41 Vulnerable 8.5.9 Vulnerable
GHSA-3vx3-xf6q-r5xp Aliases: CVE-2017-5648	Exposure of Resource to Wrong Sphere in Apache Tomcat While investigating bug 60718, it was noticed that some calls to …	9.0.0.M18 Vulnerable 8.5.13 Vulnerable 8.0.42 Vulnerable 9.0.0.M18 Vulnerable 8.5.13 Vulnerable 8.0.42 Vulnerable 8.0.42 Vulnerable
GHSA-xjgh-84hx-56c5 Aliases: CVE-2017-12617	Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, …	9.0.1 Vulnerable 8.5.23 Vulnerable 8.0.47 Vulnerable 9.0.1 Vulnerable 8.5.23 Vulnerable 8.0.47 Vulnerable 9.0.1 Vulnerable 8.0.47 Vulnerable
GHSA-xcpr-7mr4-h4xq Aliases: CVE-2024-52316	Apache Tomcat - Authentication Bypass Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom …	9.0.96 Vulnerable 11.0.1 Vulnerable 9.0.96 Vulnerable
GHSA-344f-f5vg-2jfj Aliases: CVE-2020-9484	Potential remote code execution in Apache Tomcat When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to …	10.0.0-M5 Vulnerable 8.5.55 Vulnerable 10.0.0-M5 Vulnerable 8.5.55 Vulnerable 8.5.55 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0

Advisory	Summary	Aliases
CVE-2011-1088	Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via …
CVE-2016-0706	Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on …