Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.0.M21
purl pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.0.M21
Next non-vulnerable version 9.0.122
Latest non-vulnerable version 11.0.26
Risk score 10.0
Vulnerabilities affecting this package (5)
Advisory Summary Fixed in package version
CVE-2020-13935
Aliases:
GHSA-m7jv-hq7h-mq7c
Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …
8.5.57
Vulnerable
9.0.37
Vulnerable
10.0.0-M7
Vulnerable
7.0.105
Vulnerable
8.5.57
Vulnerable
9.0.37
Vulnerable
10.0.0-M7
Vulnerable
7.0.105
Vulnerable
GHSA-m7jv-hq7h-mq7c
Aliases:
CVE-2020-13935
Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …
9.0.37
Vulnerable
9.0.37
Vulnerable
GHSA-v682-8vv8-vpwr
Aliases:
CVE-2024-23672
Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections …
11.0.0-M17
Vulnerable
10.1.19
Vulnerable
9.0.86
Vulnerable
9.0.86
Vulnerable
CVE-2026-87022

Improper Handling of Length Parameter Inconsistency Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling …
10.1.60
Not vulnerable
9.0.122
Not vulnerable
11.0.26
Not vulnerable
CVE-2026-76183

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. …
10.1.60
Not vulnerable
9.0.122
Not vulnerable
11.0.26
Not vulnerable
This package is not known to fix any advisories.