VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.0.M22

Vulnerabilities affecting this package (24)

Advisory	Summary	Fixed in package version
CVE-2019-10072	The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions …	8.5.50 Vulnerable 9.0.30 Vulnerable 8.5.41 Vulnerable 9.0.20 Vulnerable 9.0.35 Vulnerable
CVE-2018-8037	If an async request was completed by the application at the same time as the container triggered the async timeout, …	8.5.50 Vulnerable 9.0.30 Vulnerable 8.5.32 Vulnerable 8.5.34 Vulnerable 8.5.35 Vulnerable 8.5.37 Vulnerable 8.5.38 Vulnerable 8.5.39 Vulnerable 8.5.40 Vulnerable 9.0.10 Vulnerable 9.0.16 Vulnerable 9.0.19 Vulnerable 8.5.41 Vulnerable 8.5.42 Vulnerable 8.5.45 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable
CVE-2020-1938	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats …	9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.35 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable 9.0.34 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable
CVE-2019-0199	The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS …	7.0.47 Vulnerable 7.0.53 Vulnerable 7.0.59 Vulnerable 7.0.69 Vulnerable 8.5.50 Vulnerable 9.0.30 Vulnerable 9.0.31 Vulnerable 9.0.33 Vulnerable 8.5.38 Vulnerable 8.5.39 Vulnerable 8.5.40 Vulnerable 9.0.16 Vulnerable 9.0.19 Vulnerable 8.5.41 Vulnerable 9.0.20 Vulnerable 9.0.35 Vulnerable 7.0.64 Vulnerable 7.0.68 Vulnerable 7.0.72 Vulnerable 7.0.75 Vulnerable 8.5.42 Vulnerable 8.5.45 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 9.0.29 Vulnerable 7.0.73 Vulnerable 7.0.77 Vulnerable 7.0.78 Vulnerable 7.0.79 Vulnerable 7.0.81 Vulnerable 7.0.82 Vulnerable 7.0.90 Vulnerable 7.0.91 Vulnerable 7.0.94 Vulnerable 9.0.21 Vulnerable 9.0.22 Vulnerable 9.0.24 Vulnerable 9.0.26 Vulnerable 9.0.27 Vulnerable 9.0.34 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable
CVE-2020-11996	A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to …	8.5.56 Vulnerable 8.5.57 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable
GHSA-25xr-qj8w-c4vf Aliases: CVE-2025-53506	Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams Uncontrolled Resource Consumption vulnerability in Apache Tomcat if …	9.0.107 Vulnerable
GHSA-gqp3-2cvr-x8m3 Aliases: CVE-2025-48989	Apache Tomcat Improper Resource Shutdown or Release vulnerability Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable …	9.0.108 Vulnerable
GHSA-p22x-g9px-3945 Aliases: CVE-2022-42252	Apache Tomcat may reject request containing invalid Content-Length header If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to …	9.0.68 Vulnerable
GHSA-vvw4-rfwf-p6hx Aliases: CVE-2020-17527	Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat While investigating bug 64830 it was discovered that Apache …	9.0.40 Vulnerable
GHSA-wm9w-rjj3-j356 Aliases: CVE-2024-34750	Apache Tomcat - Denial of Service Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing …	9.0.90 Vulnerable
GHSA-r6j3-px5g-cq3x Aliases: CVE-2023-45648	Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 …	9.0.81 Vulnerable
GHSA-f4qf-m5gf-8jm8 Aliases: CVE-2024-21733	Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information Generation of Error Message Containing Sensitive Information vulnerability in …	9.0.44 Vulnerable 9.0.44 Vulnerable
GHSA-hfrx-6qgj-fp6c Aliases: CVE-2023-24998	Apache Commons FileUpload denial of service vulnerability Apache Commons FileUpload before 1.5 does not limit the number of request parts …	9.0.71 Vulnerable 9.0.71 Vulnerable
GHSA-qq5r-98hh-rxc9 Aliases: CVE-2026-24733	Apache Tomcat - Security constraint bypass with HTTP/0.9 Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 …	9.0.113 Vulnerable
GHSA-4j3c-42xv-3f84 Aliases: CVE-2025-52434	Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization …	9.0.107 Vulnerable
CVE-2025-52434 Aliases: GHSA-4j3c-42xv-3f84	Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization …	9.0.107 Vulnerable
CVE-2025-48989 Aliases: GHSA-gqp3-2cvr-x8m3	Apache Tomcat Improper Resource Shutdown or Release vulnerability Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable …	11.0.10 Vulnerable 10.1.44 Vulnerable 9.0.108 Vulnerable 11.0.10 Vulnerable 10.1.44 Vulnerable 9.0.108 Vulnerable
CVE-2020-13934 Aliases: GHSA-vf77-8h7g-gghp	Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat An h2c direct connection to Apache …	8.5.56 Vulnerable 9.0.36 Vulnerable 10.0.0-M6 Vulnerable 8.5.56 Vulnerable 9.0.36 Vulnerable 10.0.0-M6 Vulnerable
GHSA-r29c-68gh-xp6x Aliases: CVE-2026-41293	Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable
GHSA-fpj8-gq4v-p354 Aliases: CVE-2025-66614	Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, …	9.0.113 Vulnerable 9.0.113 Vulnerable
GHSA-f268-65qc-98vg Aliases: CVE-2020-13943	Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 …	10.0.0-M8 Vulnerable 9.0.38 Vulnerable 9.0.38 Vulnerable
GHSA-vf77-8h7g-gghp Aliases: CVE-2020-13934	Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat An h2c direct connection to Apache …	10.0.0-M6 Vulnerable 9.0.36 Vulnerable 9.0.36 Vulnerable
GHSA-7w75-32cg-r6g2 Aliases: CVE-2024-24549	Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests Denial of Service due to improper …	11.0.0-M17 Vulnerable 10.1.19 Vulnerable 9.0.86 Vulnerable 9.0.86 Vulnerable
GHSA-563x-q5rq-57qp Aliases: CVE-2026-24880	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …	9.0.116 Vulnerable 11.0.20 Vulnerable 9.0.116 Vulnerable

Next non-vulnerable version	9.0.122
Latest non-vulnerable version	11.0.26
Risk score	4.4