VulnerableCode Package Details - pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.27

Search for packages

Advisory	Summary	Fixed in package version
CVE-2020-13935	The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, …	8.5.57 Vulnerable 9.0.37 Vulnerable 10.0.0-M7 Vulnerable
CVE-2023-41080	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 …	8.5.93 Vulnerable 9.0.80 Vulnerable 10.1.13 Vulnerable
CVE-2023-46589	Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from …	8.5.96 Vulnerable 9.0.83 Vulnerable 10.1.16 Vulnerable
CVE-2021-24122	Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP …	7.0.107 Not vulnerable 8.5.60 Vulnerable 9.0.40 Vulnerable 10.0.0-M10 Not vulnerable
CVE-2021-43980	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in …	There are no reported fixed by versions.
CVE-2020-13935 Aliases: GHSA-m7jv-hq7h-mq7c	Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …	8.5.57 Vulnerable 9.0.37 Vulnerable 10.0.0-M7 Vulnerable 7.0.105 Vulnerable 8.5.57 Vulnerable 9.0.37 Vulnerable 10.0.0-M7 Vulnerable 7.0.105 Vulnerable
GHSA-m7jv-hq7h-mq7c Aliases: CVE-2020-13935	Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …	9.0.37 Vulnerable 9.0.37 Vulnerable
GHSA-v682-8vv8-vpwr Aliases: CVE-2024-23672	Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections …	11.0.0-M17 Vulnerable 10.1.19 Vulnerable 9.0.86 Vulnerable 9.0.86 Vulnerable
CVE-2026-87022	Improper Handling of Length Parameter Inconsistency Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling …	10.1.60 Not vulnerable 9.0.122 Not vulnerable 11.0.26 Not vulnerable
CVE-2026-76183	Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. …	10.1.60 Not vulnerable 9.0.122 Not vulnerable 11.0.26 Not vulnerable

Advisory

Summary

Fixed in package version

CVE-2020-13935

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, …

8.5.57
Vulnerable

9.0.37
Vulnerable

10.0.0-M7
Vulnerable

CVE-2023-41080

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 …

8.5.93
Vulnerable

9.0.80
Vulnerable

10.1.13
Vulnerable

CVE-2023-46589

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from …

8.5.96
Vulnerable

9.0.83
Vulnerable

10.1.16
Vulnerable

CVE-2021-24122

Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP …

7.0.107
Not vulnerable

8.5.60
Vulnerable

9.0.40
Vulnerable

10.0.0-M10
Not vulnerable

CVE-2021-43980

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in …

There are no reported fixed by versions.

CVE-2020-13935
Aliases:
GHSA-m7jv-hq7h-mq7c

Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …

8.5.57
Vulnerable

9.0.37
Vulnerable

10.0.0-M7
Vulnerable

7.0.105
Vulnerable

8.5.57
Vulnerable

9.0.37
Vulnerable

10.0.0-M7
Vulnerable

7.0.105
Vulnerable

GHSA-m7jv-hq7h-mq7c
Aliases:
CVE-2020-13935

Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …

9.0.37
Vulnerable

GHSA-v682-8vv8-vpwr
Aliases:
CVE-2024-23672

Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections …

11.0.0-M17
Vulnerable

10.1.19
Vulnerable

9.0.86
Vulnerable

CVE-2026-87022

Improper Handling of Length Parameter Inconsistency Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling …

10.1.60
Not vulnerable

9.0.122
Not vulnerable

11.0.26
Not vulnerable

CVE-2026-76183

Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. …

10.1.60
Not vulnerable

9.0.122
Not vulnerable

11.0.26
Not vulnerable

Next non-vulnerable version	9.0.122
Latest non-vulnerable version	11.0.26
Risk score	10.0