VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.28

Vulnerabilities affecting this package (35)

Advisory	Summary	Fixed in package version
CVE-2019-10072	The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions …	8.5.50 Vulnerable 9.0.30 Vulnerable 8.5.41 Vulnerable 9.0.20 Vulnerable 9.0.35 Vulnerable
CVE-2018-8037	If an async request was completed by the application at the same time as the container triggered the async timeout, …	8.5.50 Vulnerable 9.0.30 Vulnerable 8.5.32 Vulnerable 8.5.34 Vulnerable 8.5.35 Vulnerable 8.5.37 Vulnerable 8.5.38 Vulnerable 8.5.39 Vulnerable 8.5.40 Vulnerable 9.0.10 Vulnerable 9.0.16 Vulnerable 9.0.19 Vulnerable 8.5.41 Vulnerable 8.5.42 Vulnerable 8.5.45 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable
CVE-2020-1938	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats …	9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.35 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable 9.0.34 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable
CVE-2019-0199	The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS …	7.0.47 Vulnerable 7.0.53 Vulnerable 7.0.59 Vulnerable 7.0.69 Vulnerable 8.5.50 Vulnerable 9.0.30 Vulnerable 9.0.31 Vulnerable 9.0.33 Vulnerable 8.5.38 Vulnerable 8.5.39 Vulnerable 8.5.40 Vulnerable 9.0.16 Vulnerable 9.0.19 Vulnerable 8.5.41 Vulnerable 9.0.20 Vulnerable 9.0.35 Vulnerable 7.0.64 Vulnerable 7.0.68 Vulnerable 7.0.72 Vulnerable 7.0.75 Vulnerable 8.5.42 Vulnerable 8.5.45 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 9.0.29 Vulnerable 7.0.73 Vulnerable 7.0.77 Vulnerable 7.0.78 Vulnerable 7.0.79 Vulnerable 7.0.81 Vulnerable 7.0.82 Vulnerable 7.0.90 Vulnerable 7.0.91 Vulnerable 7.0.94 Vulnerable 9.0.21 Vulnerable 9.0.22 Vulnerable 9.0.24 Vulnerable 9.0.26 Vulnerable 9.0.27 Vulnerable 9.0.34 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable
CVE-2020-1935	In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an …	9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.35 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable 7.0.105 Vulnerable 9.0.34 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable
CVE-2020-11996	A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to …	8.5.56 Vulnerable 8.5.57 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable
GHSA-25xr-qj8w-c4vf Aliases: CVE-2025-53506	Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams Uncontrolled Resource Consumption vulnerability in Apache Tomcat if …	There are no reported fixed by versions.
GHSA-vvw4-rfwf-p6hx Aliases: CVE-2020-17527	Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat While investigating bug 64830 it was discovered that Apache …	8.5.60 Vulnerable
GHSA-wm9w-rjj3-j356 Aliases: CVE-2024-34750	Apache Tomcat - Denial of Service Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing …	There are no reported fixed by versions.
GHSA-r6j3-px5g-cq3x Aliases: CVE-2023-45648	Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 …	8.5.94 Vulnerable
GHSA-qppj-fm5r-hxr3 Aliases: CVE-2023-44487	HTTP/2 Stream Cancellation Attack ## HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that …	8.5.94 Vulnerable
CVE-2022-42252	Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 …	9.0.68 Vulnerable 10.0.27 Vulnerable 10.1.1 Vulnerable 8.5.83 Vulnerable
CVE-2020-1938	Improper Input Validation When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache …	9.0.31 Vulnerable 8.5.51 Vulnerable 7.0.100 Vulnerable
CVE-2023-41080	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 …	9.0.80 Vulnerable 8.5.93 Vulnerable 10.1.13 Vulnerable
CVE-2020-13935	Loop with Unreachable Exit Condition (Infinite Loop) The payload length in a WebSocket frame was not correctly validated in Apache …	8.5.57 Vulnerable 7.0.105 Vulnerable 9.0.37 Vulnerable 10.0.2 Vulnerable
CVE-2020-13943	HTTP Request Smuggling If a `HTTP/2` client connecting to Apache Tomcat exceeded the agreed maximum number of concurrent streams for …	9.0.38 Vulnerable 8.5.58 Vulnerable
CVE-2021-33037	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Apache Tomcat does not correctly parse the HTTP transfer-encoding request header in …	9.0.48 Vulnerable 8.5.68 Vulnerable 10.0.7 Vulnerable
CVE-2020-17527	Information Exposure While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header …	10.0.2 Vulnerable 9.0.40 Vulnerable 8.5.60 Vulnerable
CVE-2020-1935	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) In Apache Tomcat M1 to to to the HTTP header parsing code …	9.0.31 Vulnerable 8.5.51 Vulnerable 7.0.100 Vulnerable
CVE-2020-11996	Uncontrolled Resource Consumption A specially crafted sequence of `HTTP/2` requests sent to Apache Tomcat could trigger high CPU usage for …	8.5.56 Vulnerable 9.0.36 Vulnerable
CVE-2021-24122	Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP …	10.0.0-M10 Vulnerable 9.0.40 Vulnerable 8.5.60 Vulnerable 7.0.107 Vulnerable
GHSA-f4qf-m5gf-8jm8 Aliases: CVE-2024-21733	Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information Generation of Error Message Containing Sensitive Information vulnerability in …	8.5.64 Vulnerable
GHSA-qq5r-98hh-rxc9 Aliases: CVE-2026-24733	Apache Tomcat - Security constraint bypass with HTTP/0.9 Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 …	9.0.113 Vulnerable
GHSA-qcxh-w3j9-58qr Aliases: CVE-2019-0199	Apache Tomcat Denial of Service vulnerability The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted …	8.5.38 Vulnerable 8.5.38 Vulnerable
GHSA-4j3c-42xv-3f84 Aliases: CVE-2025-52434	Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization …	There are no reported fixed by versions.
CVE-2025-52434 Aliases: GHSA-4j3c-42xv-3f84	Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization …	9.0.107 Vulnerable
CVE-2020-13934 Aliases: GHSA-vf77-8h7g-gghp	Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat An h2c direct connection to Apache …	8.5.56 Vulnerable 9.0.36 Vulnerable 10.0.0-M6 Vulnerable 8.5.56 Vulnerable 9.0.36 Vulnerable 10.0.0-M6 Vulnerable
CVE-2021-43980	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in …	There are no reported fixed by versions.
GHSA-r29c-68gh-xp6x Aliases: CVE-2026-41293	Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable
GHSA-fpj8-gq4v-p354 Aliases: CVE-2025-66614	Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, …	9.0.113 Vulnerable
GHSA-3p2h-wqq4-wf4h Aliases: CVE-2025-31650	Apache Tomcat Denial of Service via invalid HTTP priority header Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling …	9.0.104 Vulnerable
GHSA-f268-65qc-98vg Aliases: CVE-2020-13943	Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 …	10.0.0-M8 Vulnerable 9.0.38 Vulnerable 8.5.58 Vulnerable 8.5.58 Vulnerable
GHSA-vf77-8h7g-gghp Aliases: CVE-2020-13934	Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat An h2c direct connection to Apache …	10.0.0-M6 Vulnerable 8.5.56 Vulnerable 8.5.56 Vulnerable
GHSA-7w75-32cg-r6g2 Aliases: CVE-2024-24549	Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests Denial of Service due to improper …	11.0.0-M17 Vulnerable 10.1.19 Vulnerable 9.0.86 Vulnerable 8.5.99 Vulnerable 8.5.99 Vulnerable
GHSA-563x-q5rq-57qp Aliases: CVE-2026-24880	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …	9.0.116 Vulnerable 11.0.20 Vulnerable 9.0.116 Vulnerable

Next non-vulnerable version	9.0.122
Latest non-vulnerable version	11.0.26
Risk score	10.0