Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@10.0.0-M1
purl pkg:apache/tomcat@10.0.0-M1
Next non-vulnerable version 10.0.7
Latest non-vulnerable version 11.0.27
Risk score
Vulnerabilities affecting this package (16)
Advisory Summary Fixed in package version
CVE-2020-11996

Important: HTTP/2 DoS
10.0.0
Vulnerable
CVE-2020-13934

Moderate: HTTP/2 DoS
10.0.0
Vulnerable
CVE-2020-13935

Important: WebSocket DoS
10.0.0
Vulnerable
CVE-2020-13943

Moderate: HTTP/2 request mix-up
10.0.0
Vulnerable
CVE-2020-17527

Moderate: HTTP/2 request header mix-up
10.0.0
Vulnerable
CVE-2020-9484

Low: Fix for CVE-2020-9484 was incomplete
10.0.2
Vulnerable
10.0.0
Vulnerable
CVE-2021-24122

Important: Information disclosure
10.0.0
Vulnerable
CVE-2021-25122

Important: Request mix-up with h2c
10.0.2
Vulnerable
CVE-2021-30640

Low: Authentication weakness
10.0.6
Vulnerable
CVE-2021-33037

Important: Request Smuggling
10.0.7
Not vulnerable
CVE-2021-41079

Important: Denial of Service
10.0.4
Vulnerable
CVE-2021-43980

High: Information Disclosure
10.0.20
Vulnerable
CVE-2022-29885

Low: Apache Tomcat EncryptInterceptor DoS
10.0.21
Not vulnerable
CVE-2022-34305

Low: Apache Tomcat XSS in examples web application
10.0.23
Not vulnerable
CVE-2022-42252

Low: Apache Tomcat request smuggling
10.0.27
Not vulnerable
CVE-2026-29146

Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
10.1.53
Vulnerable
This package is not known to fix any advisories.