Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@9.0.116
purl pkg:apache/tomcat@9.0.116
Next non-vulnerable version 9.0.123
Latest non-vulnerable version 11.0.27
Risk score
Vulnerabilities affecting this package (5)
Advisory Summary Fixed in package version
CVE-2026-29146

Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
9.0.117
Vulnerable
CVE-2026-34483

Low: Incomplete escaping of JSON access logs
9.0.117
Vulnerable
CVE-2026-34487

Low: Cloud membership for clustering component exposed the Kubernetes bearer token
9.0.117
Vulnerable
CVE-2026-34500

Moderate: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
9.0.117
Vulnerable
CVE-2026-78437

Low: HTTP/2 DoS via malformed request
9.0.122
Vulnerable
Vulnerabilities fixed by this package (6)
Advisory Summary Aliases
CVE-2025-66614
Moderate: The fix for CVE-2025-66614 was incomplete
CVE-2026-24880
Low: Request smuggling via invalid chunk extension
CVE-2026-25854
Low: Occasionally open redirect
CVE-2026-29129
Low: Configured TLS cipher preference order not preserved
CVE-2026-29145
Moderate: OCSP checks sometimes soft-fail even when soft-fail is disabled
CVE-2026-29146
Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor