Search for packages
| purl | pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@10.1.8 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-hgrr-935x-pq79
Aliases: CVE-2025-61795 |
Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of … |
Vulnerable |
|
GHSA-vfww-5hm6-hx2j
Aliases: CVE-2025-55754 |
Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences Tomcat did not escape ANSI escape sequences in … |
Vulnerable |
|
GHSA-wmwf-9ccg-fff5
Aliases: CVE-2025-55752 |
Apache Tomcat Vulnerable to Relative Path Traversal The fix for bug 60013 introduced a regression where the rewritten URL was … |
Vulnerable |
|
GHSA-42wg-hm62-jcwg
Aliases: CVE-2025-49124 |
Apache Tomcat installer for Windows has an untrusted search path vulnerability Untrusted Search Path vulnerability in Apache Tomcat installer for … |
Vulnerable |
|
GHSA-h2fw-rfh5-95r3
Aliases: CVE-2025-46701 |
Apache Tomcat - CGI security constraint bypass Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security … |
Vulnerable |
|
GHSA-wr62-c79q-cv37
Aliases: CVE-2025-52520 |
Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits For some unlikely configurations of multipart upload, … |
Vulnerable |
|
GHSA-25xr-qj8w-c4vf
Aliases: CVE-2025-53506 |
Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams Uncontrolled Resource Consumption vulnerability in Apache Tomcat if … |
Vulnerable |
|
GHSA-gqp3-2cvr-x8m3
Aliases: CVE-2025-48989 |
Apache Tomcat Improper Resource Shutdown or Release vulnerability Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable … |
Vulnerable |
|
GHSA-83qj-6fr2-vhqg
Aliases: CVE-2025-24813 |
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Path Equivalence: 'file.Name' (Internal Dot) leading to … |
Vulnerable |
|
GHSA-27hp-xhwr-wr2m
Aliases: CVE-2024-56337 |
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects … |
Vulnerable |
|
GHSA-5j33-cvvr-w245
Aliases: CVE-2024-50379 |
Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat … |
Vulnerable |
|
GHSA-wm9w-rjj3-j356
Aliases: CVE-2024-34750 |
Apache Tomcat - Denial of Service Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing … |
Vulnerable |
|
GHSA-g8pj-r55q-5c2v
Aliases: CVE-2023-42795 |
Apache Tomcat Incomplete Cleanup vulnerability Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from … |
Vulnerable |
|
GHSA-r6j3-px5g-cq3x
Aliases: CVE-2023-45648 |
Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 … |
Vulnerable |
|
GHSA-qppj-fm5r-hxr3
Aliases: CVE-2023-44487 |
HTTP/2 Stream Cancellation Attack ## HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that … |
Vulnerable |
|
GHSA-mppv-79ch-vw6q
Aliases: CVE-2023-34981 |
Apache Tomcat vulnerable to information leak A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 … |
Vulnerable |
|
GHSA-q3mw-pvr8-9ggc
Aliases: CVE-2023-41080 |
Apache Tomcat Open Redirect vulnerability URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue … |
Vulnerable |
|
GHSA-rv64-5gf8-9qq8
Aliases: CVE-2026-34483 |
Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve Improper Encoding or Escaping of Output … |
Vulnerable |
|
GHSA-9m3c-qcxr-9x87
Aliases: CVE-2026-25854 |
Apache Tomcat has an Open Redirect vulnerability Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via … |
Vulnerable |
|
GHSA-mgp5-rv84-w37q
Aliases: CVE-2026-24734 |
Apache Tomcat has an Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using … |
Vulnerable |
|
GHSA-gx5v-xp9w-j4cg
Aliases: CVE-2026-41284 |
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
Vulnerable |
|
GHSA-5mp6-jrq3-r938
Aliases: CVE-2026-43513 |
Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This … |
Vulnerable |
|
GHSA-5m62-pw8w-7w9f
Aliases: CVE-2026-43515 |
Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
Vulnerable |
|
GHSA-fv25-8xcx-gqjc
Aliases: CVE-2026-42498 |
Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache … |
Vulnerable |
|
GHSA-h6fc-48rj-7qqh
Aliases: CVE-2026-43512 |
Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 … |
Vulnerable |
|
GHSA-9m89-8frq-c98c
Aliases: CVE-2026-43514 |
Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to … |
Vulnerable |
|
GHSA-23hv-mwm6-g8jf
Aliases: CVE-2025-55668 |
Apache Tomcat Session Fixation vulnerability Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from … |
Vulnerable |
|
GHSA-7jqf-v358-p8g7
Aliases: CVE-2024-38286 |
Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability Allocation of Resources Without Limits or Throttling vulnerability in Apache … |
Vulnerable |
|
CVE-2025-48989
Aliases: GHSA-gqp3-2cvr-x8m3 |
Apache Tomcat Improper Resource Shutdown or Release vulnerability Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2025-61795
Aliases: GHSA-hgrr-935x-pq79 |
Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2023-34981
|
Exposure of Sensitive Information to an Unauthorized Actor A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2025-55668
Aliases: GHSA-23hv-mwm6-g8jf |
Apache Tomcat Session Fixation vulnerability Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-29145
Aliases: GHSA-95jq-rwvf-vjx4 |
Apache Tomcat: CLIENT_CERT authentication does not fail as expected CLIENT_CERT authentication does not fail as expected for some scenarios when … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-x4m4-345f-5h5g
Aliases: CVE-2026-34487 |
Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File Insertion of Sensitive Information into Log File vulnerability in … |
Vulnerable Vulnerable |
|
GHSA-r29c-68gh-xp6x
Aliases: CVE-2026-41293 |
Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
Vulnerable Vulnerable |
|
GHSA-fpj8-gq4v-p354
Aliases: CVE-2025-66614 |
Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, … |
Vulnerable Vulnerable |
|
GHSA-9xv2-5v5q-p794
Aliases: CVE-2026-65905 |
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … | There are no reported fixed by versions. |
|
GHSA-gcx9-497g-6cp6
Aliases: CVE-2026-65182 |
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads … | There are no reported fixed by versions. |
|
GHSA-h3x4-894j-xpx5
Aliases: CVE-2026-68525 |
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows … | There are no reported fixed by versions. |
|
GHSA-wc4r-xq3c-5cf3
Aliases: CVE-2025-49125 |
Apache Tomcat - Security constraint bypass for pre/post-resources Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-h3gc-qfqq-6h8f
Aliases: CVE-2025-48988 |
Apache Tomcat - DoS in multipart upload Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-xjgh-84hx-56c5
Aliases: CVE-2017-12617 |
Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, … |
Vulnerable |
|
GHSA-7w75-32cg-r6g2
Aliases: CVE-2024-24549 |
Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests Denial of Service due to improper … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-fccv-jmmp-qg76
Aliases: CVE-2023-46589 |
Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 … |
Vulnerable Vulnerable |
|
GHSA-563x-q5rq-57qp
Aliases: CVE-2026-24880 |
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-55956
|
Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-55955
|
Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-55276
Aliases: GHSA-mqg3-r7h5-24x4 |
Apache Tomcat - Logged effective web.xml is incomplete Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-65905
Aliases: GHSA-9xv2-5v5q-p794 |
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … |
Vulnerable Vulnerable |
|
CVE-2026-59083
Aliases: GHSA-hcjr-322h-429r |
Apache Tomcat - Incorrect URL decoding in RewriteValve may allow security control bypass Improper Handling of URL Encoding (Hex Encoding) … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-53404
|
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain … |
Vulnerable Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-cx6h-86xw-9x34
|
Apache Tomcat - Fix for CVE-2023-24998 was incomplete The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were … |
CVE-2023-28709
|
|
CVE-2023-28709
|
Off-by-one Error The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 … |