Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@9.0.0%2BM1
purl pkg:apache/tomcat@9.0.0%2BM1
Next non-vulnerable version 9.0.5
Latest non-vulnerable version 11.0.27
Risk score
Vulnerabilities affecting this package (85)
Advisory Summary Fixed in package version
CVE-2015-5345

Low: Directory disclosure
9.0.0
Vulnerable
CVE-2015-5346

Low: Session Fixation
9.0.0
Vulnerable
CVE-2015-5351

Moderate: CSRF token leak
9.0.0
Vulnerable
CVE-2016-0706

Low: Security Manager bypass
9.0.0
Vulnerable
CVE-2016-0714

Moderate: Security Manager bypass
9.0.0
Vulnerable
CVE-2016-0762

Low: Timing Attack
9.0.0
Vulnerable
CVE-2016-0763

Moderate: Security Manager bypass
9.0.0
Vulnerable
CVE-2016-3092

Moderate: Denial of Service
9.0.0
Vulnerable
CVE-2016-5018

Low: Security Manager Bypass
9.0.0
Vulnerable
CVE-2016-6794

Low: System Property Disclosure
9.0.0
Vulnerable
CVE-2016-6796

Low: Security Manager Bypass
9.0.0
Vulnerable
CVE-2016-6797

Low: Unrestricted Access to Global Resources
9.0.0
Vulnerable
CVE-2016-6816

Important: Information Disclosure
9.0.0
Vulnerable
CVE-2016-6817

Important: Denial of Service
9.0.0
Vulnerable
CVE-2016-8735

Important: Remote Code Execution
9.0.0
Vulnerable
CVE-2016-8745

Important: Information Disclosure
9.0.0
Vulnerable
CVE-2017-12617

Important: Remote Code Execution
9.0.1
Vulnerable
CVE-2017-5647

Important: Information Disclosure
9.0.0
Vulnerable
CVE-2017-5648

Low: Information Disclosure
9.0.0
Vulnerable
CVE-2017-5650

Important: Denial of Service
9.0.0
Vulnerable
CVE-2017-5651

Important: Information Disclosure
9.0.0
Vulnerable
CVE-2017-5664

Important: Security Constraint Bypass
9.0.0
Vulnerable
CVE-2017-7674

Moderate: Cache Poisoning
9.0.0
Vulnerable
CVE-2017-7675

Important: Security Constraint Bypass
9.0.0
Vulnerable
CVE-2018-11784

Moderate: Open Redirect
9.0.12
Not vulnerable
CVE-2018-1304

Important: Security constraints mapped to context root are ignored
9.0.5
Not vulnerable
CVE-2018-1305

Important: Security constraint annotations applied too late
9.0.5
Not vulnerable
CVE-2018-1336

Important: A bug in the UTF-8 decoder can lead to DoS
9.0.8
Not vulnerable
CVE-2018-8034

Low: host name verification missing in WebSocket client
9.0.10
Not vulnerable
CVE-2019-0199

Important: Denial of Service
9.0.16
Not vulnerable
CVE-2019-0221

Low: XSS in SSI printenv
9.0.19
Vulnerable
CVE-2019-0232

Important: Remote Code Execution on Windows
9.0.19
Vulnerable
CVE-2019-10072

Important: Denial of Service
9.0.20
Vulnerable
CVE-2019-12418

Moderate: Local Privilege Escalation
9.0.29
Vulnerable
CVE-2019-17563

Low: Session fixation
9.0.30
Vulnerable
CVE-2020-11996

Important: HTTP/2 DoS
9.0.36
Vulnerable
CVE-2020-13935

Important: WebSocket DoS
9.0.37
Vulnerable
CVE-2020-13943

Moderate: HTTP/2 request mix-up
9.0.38
Not vulnerable
CVE-2020-1935

Low: HTTP Request Smuggling
9.0.31
Not vulnerable
CVE-2020-1938

Important: AJP Request Injection and potential Remote Code Execution
9.0.31
Not vulnerable
CVE-2020-9484

Low: Fix for CVE-2020-9484 was incomplete
9.0.43
Vulnerable
9.0.35
Vulnerable
CVE-2021-24122

Important: Information disclosure
9.0.40
Vulnerable
CVE-2021-25122

Important: Request mix-up with h2c
9.0.43
Vulnerable
CVE-2021-30640

Low: Authentication weakness
9.0.46
Vulnerable
CVE-2021-33037

Important: Request Smuggling
9.0.48
Not vulnerable
CVE-2022-25762

Important: Request mix-up
9.0.21
Not vulnerable
CVE-2024-50379

Important: Remote Code Execution via write enabled Default Servlet
9.0.98
Vulnerable
CVE-2024-54677

Low: DoS in examples web application
9.0.98
Vulnerable
CVE-2024-56337

Important: Remote Code Execution via write enabled Default Servlet. Mitigation for CVE-2024-50379 was incomplete -
9.0.98
Vulnerable
CVE-2025-24813

Important: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet -
9.0.99
Not vulnerable
CVE-2025-31651

Low: Rewrite rule bypass
9.0.104
Vulnerable
CVE-2025-46701

Low: CGI security constraint bypass
9.0.105
Vulnerable
CVE-2025-48976

Important: DoS in Commons FileUpload
9.0.106
Vulnerable
CVE-2025-48988

Important: DoS in multipart upload
9.0.106
Vulnerable
CVE-2025-48989

Important: DoS in HTTP/2 due to client triggered stream reset
9.0.108
Vulnerable
CVE-2025-49125

Moderate: Security constraint bypass for PreResources and PostResources
9.0.106
Vulnerable
CVE-2025-52434

Important: APR/Native Connector crash leading to DoS
9.0.107
Vulnerable
CVE-2025-52520

Low: DoS due to overflow in file upload limit
9.0.107
Vulnerable
CVE-2025-53506

Important: DoS via excessive HTTP/2 streams
9.0.107
Vulnerable
CVE-2025-55668

Moderate: Session fixation possible via rewrite valve
9.0.106
Vulnerable
CVE-2025-61795

Low: Delayed cleaning of multipart upload temporary files may lead to DoS
9.0.110
Not vulnerable
CVE-2025-66614

Moderate: The fix for CVE-2025-66614 was incomplete
9.0.113
Vulnerable
CVE-2026-101296

Important: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
9.0.123
Not vulnerable
CVE-2026-24733

Low: Security constraint bypass
9.0.113
Vulnerable
CVE-2026-24880

Low: Request smuggling via invalid chunk extension
9.0.116
Vulnerable
CVE-2026-41284

Low: Unbounded read in WebDAV LOCK and PROPFIND handling
9.0.118
Vulnerable
CVE-2026-41293

Low: HTTP/2 request headers not validated
9.0.118
Vulnerable
CVE-2026-43512

Moderate: Digest authenticator will authenticate any unknown user
9.0.118
Vulnerable
CVE-2026-43513

Low: LockOutRealm treats user names as case-sensitive
9.0.118
Vulnerable
CVE-2026-43514

Low: AJP secret compared in non-constant time
9.0.118
Vulnerable
CVE-2026-43515

Moderate: Security constraints not correctly applied
9.0.118
Vulnerable
CVE-2026-50229

Low: XSS in number guess example
9.0.119
Vulnerable
CVE-2026-53404

Low: Bad ornext processing in RewriteValve
9.0.119
Vulnerable
CVE-2026-55276

Low: Logged effective web.xml is incomplete
9.0.119
Vulnerable
CVE-2026-55956

Moderate: Security constraints for default servlet ignored method
9.0.119
Vulnerable
CVE-2026-59083

Low: Incorrect URL decoding in RewriteValve may allow security control bypass
9.0.120
Vulnerable
CVE-2026-65182

Important: Security constraint bypass
9.0.121
Vulnerable
CVE-2026-65905

Low: Limited replay attack possible with DIGEST authentication
9.0.121
Vulnerable
CVE-2026-68569

Important: Principal lookup could fail open in some cases
9.0.121
Vulnerable
CVE-2026-73581

Moderate: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
9.0.122
Vulnerable
CVE-2026-74049

Low: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
9.0.123
Not vulnerable
CVE-2026-76183

Important: Bypass of security constraints for WebSocket endpoints
9.0.122
Vulnerable
CVE-2026-78383

Important: AJP DoS via missing request body
9.0.122
Vulnerable
CVE-2026-79677

Moderate: WebSocket DoS due to lost asynchronous write timeout
9.0.122
Vulnerable
CVE-2026-87022

Low: WebSocket message smuggling with per-message-deflate
9.0.122
Vulnerable
This package is not known to fix any advisories.