VulnerableCode Package Details - pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.5

Vulnerabilities affecting this package (78)

Advisory	Summary	Fixed in package version
GHSA-hgrr-935x-pq79 Aliases: CVE-2025-61795	Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …	9.0.110 Vulnerable
GHSA-wmwf-9ccg-fff5 Aliases: CVE-2025-55752	Apache Tomcat Vulnerable to Relative Path Traversal The fix for bug 60013 introduced a regression where the rewritten URL was …	9.0.109 Vulnerable
GHSA-h2fw-rfh5-95r3 Aliases: CVE-2025-46701	Apache Tomcat - CGI security constraint bypass Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security …	9.0.105 Vulnerable
GHSA-wr62-c79q-cv37 Aliases: CVE-2025-52520	Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits For some unlikely configurations of multipart upload, …	9.0.107 Vulnerable
GHSA-25xr-qj8w-c4vf Aliases: CVE-2025-53506	Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams Uncontrolled Resource Consumption vulnerability in Apache Tomcat if …	9.0.107 Vulnerable
GHSA-gqp3-2cvr-x8m3 Aliases: CVE-2025-48989	Apache Tomcat Improper Resource Shutdown or Release vulnerability Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable …	9.0.108 Vulnerable
GHSA-83qj-6fr2-vhqg Aliases: CVE-2025-24813	Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Path Equivalence: 'file.Name' (Internal Dot) leading to …	9.0.99 Vulnerable
GHSA-p22x-g9px-3945 Aliases: CVE-2022-42252	Apache Tomcat may reject request containing invalid Content-Length header If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to …	9.0.68 Vulnerable
GHSA-9xcj-c8cr-8c3c Aliases: CVE-2019-17563	In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation …	9.0.30 Vulnerable
GHSA-27hp-xhwr-wr2m Aliases: CVE-2024-56337	Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects …	9.0.98 Vulnerable
GHSA-5j33-cvvr-w245 Aliases: CVE-2024-50379	Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat …	9.0.98 Vulnerable
GHSA-wm9w-rjj3-j356 Aliases: CVE-2024-34750	Apache Tomcat - Denial of Service Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing …	9.0.90 Vulnerable
GHSA-g8pj-r55q-5c2v Aliases: CVE-2023-42795	Apache Tomcat Incomplete Cleanup vulnerability Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from …	9.0.81 Vulnerable
GHSA-r6j3-px5g-cq3x Aliases: CVE-2023-45648	Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 …	9.0.81 Vulnerable
GHSA-qppj-fm5r-hxr3 Aliases: CVE-2023-44487	HTTP/2 Stream Cancellation Attack ## HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that …	9.0.81 Vulnerable
GHSA-q3mw-pvr8-9ggc Aliases: CVE-2023-41080	Apache Tomcat Open Redirect vulnerability URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue …	9.0.80 Vulnerable
GHSA-9m3c-qcxr-9x87 Aliases: CVE-2026-25854	Apache Tomcat has an Open Redirect vulnerability Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via …	9.0.116 Vulnerable
GHSA-gx5v-xp9w-j4cg Aliases: CVE-2026-41284	Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-5mp6-jrq3-r938 Aliases: CVE-2026-43513	Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …	9.0.118 Vulnerable
GHSA-5m62-pw8w-7w9f Aliases: CVE-2026-43515	Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable
GHSA-fv25-8xcx-gqjc Aliases: CVE-2026-42498	Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …	9.0.118 Vulnerable
GHSA-h6fc-48rj-7qqh Aliases: CVE-2026-43512	Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-9m89-8frq-c98c Aliases: CVE-2026-43514	Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …	9.0.118 Vulnerable
GHSA-qxf4-chvg-4r8r Aliases: CVE-2020-1935	Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 …	9.0.31 Vulnerable
GHSA-c9hw-wf7x-jp9j Aliases: CVE-2020-1938	Improper Privilege Management in Tomcat When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections …	9.0.31 Vulnerable
CVE-2022-42252 Aliases: GHSA-p22x-g9px-3945	Improper Input Validation If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was …	8.5.83 Vulnerable 9.0.68 Vulnerable 10.0.27 Vulnerable 10.1.1 Vulnerable
CVE-2022-25762 Aliases: GHSA-h3ch-5pp2-vh6w	Improper Resource Shutdown or Release If a web application sends a WebSocket message concurrently with the WebSocket connection closing when …	9.0.20 Vulnerable 8.5.75 Vulnerable
CVE-2019-12418 Aliases: GHSA-hh3j-x4mc-g48r	In Apache Tomcat, a local attacker may be able to perform a man-in-the-middle attack to capture user names and passwords …	9.0.29 Vulnerable 8.5.49 Vulnerable 7.0.99 Vulnerable
CVE-2021-25329	Uncontrolled Resource Consumption The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat with a configuration edge case that was …	9.0.41 Vulnerable 7.0.107 Vulnerable 8.5.61 Vulnerable
CVE-2020-8022 Aliases: GHSA-gc58-v8h3-x2gr	A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, …	9.0.35 Vulnerable 8.0.53 Vulnerable
CVE-2020-13934	Denial of Service h2c does not release the `HTTP/1.1` processor after the upgrade to `HTTP/2.` If a sufficient number of …	9.0.37 Vulnerable 8.5.57 Vulnerable
CVE-2021-30640	Improper Authentication A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a …	8.5.66 Vulnerable 7.0.109 Vulnerable 9.0.46 Vulnerable 10.0.6 Vulnerable
CVE-2020-17527	Information Exposure While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header …	9.0.40 Vulnerable 10.0.2 Vulnerable 8.5.60 Vulnerable
CVE-2021-41079	Improper Input Validation Apache Tomcat does not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or …	8.5.64 Vulnerable 9.0.44 Vulnerable 10.0.4 Vulnerable
GHSA-f4qf-m5gf-8jm8 Aliases: CVE-2024-21733	Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information Generation of Error Message Containing Sensitive Information vulnerability in …	9.0.44 Vulnerable
GHSA-hfrx-6qgj-fp6c Aliases: CVE-2023-24998	Apache Commons FileUpload denial of service vulnerability Apache Commons FileUpload before 1.5 does not limit the number of request parts …	9.0.71 Vulnerable 9.0.71 Vulnerable
GHSA-6v52-mj5r-7j2m Aliases: CVE-2018-8037	Apache Tomcat Race Condition vulnerability If an async request was completed by the application at the same time as the …	9.0.10 Vulnerable 9.0.10 Vulnerable
GHSA-5q99-f34m-67gc Aliases: CVE-2018-11784	Apache Tomcat Open Redirect vulnerability When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and …	9.0.12 Vulnerable 9.0.12 Vulnerable
GHSA-8vmx-qmch-mpqg Aliases: CVE-2019-0232	Apache Tomcat OS Command Injection vulnerability When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 …	9.0.17 Vulnerable 9.0.17 Vulnerable
GHSA-q4hg-rmq2-52q9 Aliases: CVE-2019-10072	Improper Locking in Apache Tomcat The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on …	9.0.20 Vulnerable 9.0.20 Vulnerable
GHSA-jjpq-gp5q-8q6w Aliases: CVE-2019-0221	Cross-site scripting in Apache Tomcat The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 …	9.0.17 Vulnerable 9.0.17 Vulnerable 9.0.17 Vulnerable
GHSA-qcxh-w3j9-58qr Aliases: CVE-2019-0199	Apache Tomcat Denial of Service vulnerability The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted …	9.0.16 Vulnerable 9.0.16 Vulnerable
GHSA-4j3c-42xv-3f84 Aliases: CVE-2025-52434	Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization …	9.0.107 Vulnerable
GHSA-23hv-mwm6-g8jf Aliases: CVE-2025-55668	Apache Tomcat Session Fixation vulnerability Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from …	9.0.106 Vulnerable
CVE-2025-52434 Aliases: GHSA-4j3c-42xv-3f84	Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization …	9.0.107 Vulnerable
CVE-2025-48989 Aliases: GHSA-gqp3-2cvr-x8m3	Apache Tomcat Improper Resource Shutdown or Release vulnerability Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable …	11.0.10 Vulnerable 10.1.44 Vulnerable 9.0.108 Vulnerable 11.0.10 Vulnerable 10.1.44 Vulnerable 9.0.108 Vulnerable
CVE-2019-10072 Aliases: GHSA-q4hg-rmq2-52q9	Improper Locking The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache …	9.0.20 Vulnerable 8.5.40 Vulnerable 9.0.20 Vulnerable 8.5.40 Vulnerable
CVE-2025-61795 Aliases: GHSA-hgrr-935x-pq79	Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …	11.0.12 Vulnerable 10.1.47 Vulnerable 9.0.110 Vulnerable 11.0.12 Vulnerable 10.1.47 Vulnerable 9.0.110 Vulnerable
CVE-2025-55668 Aliases: GHSA-23hv-mwm6-g8jf	Apache Tomcat Session Fixation vulnerability Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from …	11.0.8 Vulnerable 10.1.42 Vulnerable 9.0.106 Vulnerable
CVE-2020-11996 Aliases: GHSA-53hp-jpwq-2jgq	Uncontrolled Resource Consumption in Apache Tomcat A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, …	9.0.35 Vulnerable 10.0.0-M5 Vulnerable 8.5.55 Vulnerable 9.0.35 Vulnerable 10.0.0-M5 Vulnerable 8.5.55 Vulnerable
CVE-2023-28708 Aliases: GHSA-2c9m-w27f-53rm	Unprotected Transport of Credentials When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the …	8.5.86 Vulnerable 9.0.72 Vulnerable 11.0.0 Vulnerable 10.1.6 Vulnerable 8.5.86 Vulnerable 9.0.72 Vulnerable 11.0.0 Vulnerable 10.1.6 Vulnerable
CVE-2021-43980	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in …	There are no reported fixed by versions.
GHSA-j39c-c8hj-x4j3 Aliases: CVE-2021-25122	Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat When responding to new h2c connection requests, Apache Tomcat …	9.0.43 Vulnerable 9.0.43 Vulnerable
GHSA-r29c-68gh-xp6x Aliases: CVE-2026-41293	Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable 9.0.118 Vulnerable
GHSA-fpj8-gq4v-p354 Aliases: CVE-2025-66614	Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, …	9.0.113 Vulnerable 9.0.113 Vulnerable
GHSA-9xv2-5v5q-p794 Aliases: CVE-2026-65905	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	9.0.121 Vulnerable
GHSA-gcx9-497g-6cp6 Aliases: CVE-2026-65182	Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads …	9.0.121 Vulnerable
GHSA-h3x4-894j-xpx5 Aliases: CVE-2026-68525	Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows …	9.0.121 Vulnerable
GHSA-m59c-jpc8-m2x4 Aliases: CVE-2018-1336	In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder An improper handing of overflow in …	9.0.8 Vulnerable 9.0.8 Vulnerable
GHSA-46j3-r4pj-4835 Aliases: CVE-2018-8034	The host name verification missing in Apache Tomcat The host name verification when using TLS with the WebSocket client was …	9.0.10 Vulnerable 9.0.10 Vulnerable 9.0.10 Vulnerable
GHSA-r4x2-3cq5-hqvp Aliases: CVE-2018-8014	The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins The …	There are no reported fixed by versions.
GHSA-2rvv-w9r2-rg7m Aliases: CVE-2021-24122	Information Disclosure in Apache Tomcat When serving resources from a network location using the NTFS file system, Apache Tomcat versions …	10.0.0-M10 Vulnerable 9.0.40 Vulnerable 9.0.40 Vulnerable
GHSA-jgwr-3qm3-26f3 Aliases: CVE-2021-25329	Potential remote code execution in Apache Tomcat The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, …	9.0.41 Vulnerable 9.0.41 Vulnerable
GHSA-wc4r-xq3c-5cf3 Aliases: CVE-2025-49125	Apache Tomcat - Security constraint bypass for pre/post-resources Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. …	11.0.8 Vulnerable 10.1.42 Vulnerable 9.0.106 Vulnerable 9.0.106 Vulnerable
GHSA-h3gc-qfqq-6h8f Aliases: CVE-2025-48988	Apache Tomcat - DoS in multipart upload Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue …	11.0.8 Vulnerable 10.1.42 Vulnerable 9.0.106 Vulnerable 9.0.106 Vulnerable
GHSA-53hp-jpwq-2jgq Aliases: CVE-2020-11996	Uncontrolled Resource Consumption in Apache Tomcat A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, …	10.0.0-M5 Vulnerable 9.0.35 Vulnerable 9.0.35 Vulnerable
GHSA-xjgh-84hx-56c5 Aliases: CVE-2017-12617	Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, …	9.0.1 Vulnerable
GHSA-r53m-pfr5-7v87	Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core Withdrawn: Duplicate of GHSA-qcxh-w3j9-58qr	9.0.16 Vulnerable 9.0.16 Vulnerable
GHSA-hh3j-x4mc-g48r Aliases: CVE-2019-12418	Insufficiently Protected Credentials in Apache Tomcat When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured …	9.0.29 Vulnerable 9.0.29 Vulnerable
GHSA-7w75-32cg-r6g2 Aliases: CVE-2024-24549	Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests Denial of Service due to improper …	9.0.86 Vulnerable 10.1.19 Vulnerable 11.0.0-M17 Vulnerable 9.0.86 Vulnerable
GHSA-fccv-jmmp-qg76 Aliases: CVE-2023-46589	Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 …	9.0.83 Vulnerable 9.0.83 Vulnerable
GHSA-563x-q5rq-57qp Aliases: CVE-2026-24880	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …	9.0.116 Vulnerable 11.0.20 Vulnerable 9.0.116 Vulnerable
GHSA-344f-f5vg-2jfj Aliases: CVE-2020-9484	Potential remote code execution in Apache Tomcat When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to …	10.0.0-M5 Vulnerable 9.0.35 Vulnerable 10.0.0-M5 Vulnerable 9.0.35 Vulnerable 9.0.35 Vulnerable
CVE-2026-55956	Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method …	9.0.119 Vulnerable 10.1.56 Vulnerable 11.0.23 Vulnerable
CVE-2026-55276 Aliases: GHSA-mqg3-r7h5-24x4	Apache Tomcat - Logged effective web.xml is incomplete Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles …	9.0.119 Vulnerable 10.1.56 Vulnerable 11.0.23 Vulnerable
CVE-2026-65905 Aliases: GHSA-9xv2-5v5q-p794	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	9.0.121 Vulnerable 11.0.25 Vulnerable
CVE-2026-59083 Aliases: GHSA-hcjr-322h-429r	Apache Tomcat - Incorrect URL decoding in RewriteValve may allow security control bypass Improper Handling of URL Encoding (Hex Encoding) …	9.0.120 Vulnerable 10.1.57 Vulnerable 11.0.24 Vulnerable
CVE-2026-53404	Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain …	9.0.119 Vulnerable 10.1.56 Vulnerable 11.0.23 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0

Advisory	Summary	Aliases
CVE-2018-1304	Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core The URL pattern of "" (the empty string) which exactly maps to the context …	GHSA-6rxj-58jh-436r
CVE-2018-1305	Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 …	GHSA-jx6h-3fjx-cgv5
GHSA-jx6h-3fjx-cgv5	Apache Tomcat information exposure vulnerability Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to …	CVE-2018-1305
GHSA-6rxj-58jh-436r	Apache Tomcat unauthorized access vulnerability The URL pattern of "" (the empty string) which exactly maps to the context root …	CVE-2018-1304