Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@9.0.117
purl pkg:apache/tomcat@9.0.117
Next non-vulnerable version 9.0.123
Latest non-vulnerable version 11.0.27
Risk score
Vulnerabilities affecting this package (7)
Advisory Summary Fixed in package version
CVE-2026-41284

Low: Unbounded read in WebDAV LOCK and PROPFIND handling
9.0.118
Vulnerable
CVE-2026-41293

Low: HTTP/2 request headers not validated
9.0.118
Vulnerable
CVE-2026-42498

Low: WebSocket authentication header exposure
9.0.118
Vulnerable
CVE-2026-43512

Moderate: Digest authenticator will authenticate any unknown user
9.0.118
Vulnerable
CVE-2026-43513

Low: LockOutRealm treats user names as case-sensitive
9.0.118
Vulnerable
CVE-2026-43514

Low: AJP secret compared in non-constant time
9.0.118
Vulnerable
CVE-2026-43515

Moderate: Security constraints not correctly applied
9.0.118
Vulnerable
Vulnerabilities fixed by this package (4)
Advisory Summary Aliases
CVE-2026-29146
Important: The fix for CVE-2026-29146 allowed the bypass of the EncryptInterceptor
CVE-2026-34483
Low: Incomplete escaping of JSON access logs
CVE-2026-34487
Low: Cloud membership for clustering component exposed the Kubernetes bearer token
CVE-2026-34500
Moderate: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled