VulnerableCode Package Details - pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@8.5.28

Search for packages

Advisory	Summary	Fixed in package version
CVE-2018-8034	The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions …	8.5.32 Vulnerable 8.5.33 Vulnerable 8.5.34 Vulnerable 8.5.35 Vulnerable 8.5.37 Vulnerable 8.5.38 Vulnerable 8.5.39 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 8.5.42 Vulnerable 8.5.43 Vulnerable 8.5.45 Vulnerable 8.5.46 Vulnerable 9.0.10 Vulnerable 9.0.11 Vulnerable 9.0.12 Vulnerable 9.0.13 Vulnerable 9.0.14 Vulnerable 9.0.16 Vulnerable 9.0.17 Vulnerable 9.0.19 Vulnerable 9.0.20 Vulnerable 9.0.21 Vulnerable 9.0.22 Vulnerable 9.0.24 Vulnerable 9.0.26 Vulnerable 9.0.30 Vulnerable
CVE-2020-13935	The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, …	8.5.57 Vulnerable 9.0.37 Vulnerable 10.0.0-M7 Vulnerable
CVE-2023-41080	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 …	8.5.93 Vulnerable 9.0.80 Vulnerable 10.1.13 Vulnerable
CVE-2023-46589	Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from …	8.5.96 Vulnerable 9.0.83 Vulnerable 10.1.16 Vulnerable
CVE-2021-24122	Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP …	7.0.107 Not vulnerable 8.5.60 Vulnerable 9.0.40 Vulnerable 10.0.0-M10 Not vulnerable
CVE-2021-43980	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in …	There are no reported fixed by versions.
CVE-2020-13935 Aliases: GHSA-m7jv-hq7h-mq7c	Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …	8.5.57 Vulnerable 9.0.37 Vulnerable 10.0.0-M7 Vulnerable 7.0.105 Vulnerable 8.5.57 Vulnerable 9.0.37 Vulnerable 10.0.0-M7 Vulnerable 7.0.105 Vulnerable
GHSA-m7jv-hq7h-mq7c Aliases: CVE-2020-13935	Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …	8.5.57 Vulnerable 8.5.57 Vulnerable
GHSA-v682-8vv8-vpwr Aliases: CVE-2024-23672	Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections …	11.0.0-M17 Vulnerable 10.1.19 Vulnerable 9.0.86 Vulnerable 8.5.99 Not vulnerable 8.5.99 Not vulnerable

Advisory

Summary

Fixed in package version

CVE-2018-8034

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions …

8.5.32
Vulnerable

8.5.33
Vulnerable

8.5.34
Vulnerable

8.5.35
Vulnerable

8.5.37
Vulnerable

8.5.38
Vulnerable

8.5.39
Vulnerable

8.5.40
Vulnerable

8.5.41
Vulnerable

8.5.42
Vulnerable

8.5.43
Vulnerable

8.5.45
Vulnerable

8.5.46
Vulnerable

9.0.10
Vulnerable

9.0.11
Vulnerable

9.0.12
Vulnerable

9.0.13
Vulnerable

9.0.14
Vulnerable

9.0.16
Vulnerable

9.0.17
Vulnerable

9.0.19
Vulnerable

9.0.20
Vulnerable

9.0.21
Vulnerable

9.0.22
Vulnerable

9.0.24
Vulnerable

9.0.26
Vulnerable

9.0.30
Vulnerable

CVE-2020-13935

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, …

8.5.57
Vulnerable

9.0.37
Vulnerable

10.0.0-M7
Vulnerable

CVE-2023-41080

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 …

8.5.93
Vulnerable

9.0.80
Vulnerable

10.1.13
Vulnerable

CVE-2023-46589

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from …

8.5.96
Vulnerable

9.0.83
Vulnerable

10.1.16
Vulnerable

CVE-2021-24122

Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP …

7.0.107
Not vulnerable

8.5.60
Vulnerable

9.0.40
Vulnerable

10.0.0-M10
Not vulnerable

CVE-2021-43980

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in …

There are no reported fixed by versions.

CVE-2020-13935
Aliases:
GHSA-m7jv-hq7h-mq7c

Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …

8.5.57
Vulnerable

9.0.37
Vulnerable

10.0.0-M7
Vulnerable

7.0.105
Vulnerable

8.5.57
Vulnerable

9.0.37
Vulnerable

10.0.0-M7
Vulnerable

7.0.105
Vulnerable

GHSA-m7jv-hq7h-mq7c
Aliases:
CVE-2020-13935

Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …

8.5.57
Vulnerable

GHSA-v682-8vv8-vpwr
Aliases:
CVE-2024-23672

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections …

11.0.0-M17
Vulnerable

10.1.19
Vulnerable

9.0.86
Vulnerable

8.5.99
Not vulnerable

Next non-vulnerable version	8.5.99
Latest non-vulnerable version	11.0.26
Risk score	10.0