VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.65

Vulnerabilities affecting this package (29)

Advisory	Summary	Fixed in package version
GHSA-gx5v-xp9w-j4cg Aliases: CVE-2026-41284	Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-5mp6-jrq3-r938 Aliases: CVE-2026-43513	Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …	9.0.118 Vulnerable
GHSA-5m62-pw8w-7w9f Aliases: CVE-2026-43515	Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable
GHSA-fv25-8xcx-gqjc Aliases: CVE-2026-42498	Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …	9.0.118 Vulnerable
GHSA-h6fc-48rj-7qqh Aliases: CVE-2026-43512	Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-9m89-8frq-c98c Aliases: CVE-2026-43514	Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …	9.0.118 Vulnerable
CVE-2017-12616	Information Exposure When using a `VirtualDirContext` with Apache Tomcat it is possible to bypass security constraints and/or view the source …	7.0.52 Vulnerable 7.0.78 Vulnerable 7.0.81 Vulnerable
CVE-2016-3092	Denial of Service The MultipartStream class in this package allows remote attackers to cause a denial of service (CPU consumption) …	7.0.70 Vulnerable 8.0.36 Vulnerable 8.5.3 Vulnerable 9.0.0.M8 Vulnerable
CVE-2017-7674	Insufficient Verification of Data Authenticity The CORS Filter in Apache Tomcat did not add an HTTP Vary header indicating that …	7.0.79 Vulnerable 8.5.16 Vulnerable 9.0.0.M22 Vulnerable
CVE-2021-24122	Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP …	9.0.40 Vulnerable 8.5.60 Vulnerable 7.0.107 Vulnerable 10.0.0-M10 Vulnerable
GHSA-cw54-59pw-4g8c Aliases: CVE-2016-8735	Apache Tomcat Improper Access Control vulnerability Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x …	7.0.73 Vulnerable 7.0.73 Vulnerable
GHSA-v646-rx6w-r3qq Aliases: CVE-2016-5388	Improper Access Control in Apache Tomcat Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is …	7.0.72 Vulnerable 7.0.72 Vulnerable
GHSA-jjpq-gp5q-8q6w Aliases: CVE-2019-0221	Cross-site scripting in Apache Tomcat The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 …	7.0.94 Vulnerable 7.0.94 Vulnerable
CVE-2026-41293 Aliases: GHSA-r29c-68gh-xp6x	Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	10.1.55 Vulnerable 9.0.118 Vulnerable 11.0.22 Vulnerable 10.1.55 Vulnerable 9.0.118 Vulnerable 11.0.22 Vulnerable
CVE-2024-52316 Aliases: GHSA-xcpr-7mr4-h4xq	Apache Tomcat - Authentication Bypass Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom …	9.0.96 Vulnerable 10.1.30 Vulnerable 11.0.1 Vulnerable 9.0.96 Vulnerable 10.1.30 Vulnerable 11.0.1 Vulnerable
CVE-2026-24880 Aliases: GHSA-563x-q5rq-57qp	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …	10.1.52 Vulnerable 9.0.116 Vulnerable 11.0.20 Vulnerable 10.1.52 Vulnerable 9.0.116 Vulnerable 11.0.20 Vulnerable
CVE-2017-12615	Unrestricted Upload of File with Dangerous Type When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible …	7.0.52 Vulnerable 7.0.78 Vulnerable 7.0.81 Vulnerable 7.0.52 Vulnerable 7.0.78 Vulnerable 7.0.81 Vulnerable
CVE-2016-6797 Aliases: GHSA-q6x7-f33r-3wxx	Incorrect Authorization The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 …	7.0.72 Vulnerable 8.5.5 Vulnerable 9.0.0.M10 Vulnerable 8.0.37 Vulnerable 7.0.72 Vulnerable 8.5.5 Vulnerable 9.0.0.M10 Vulnerable 8.0.37 Vulnerable
CVE-2016-5018 Aliases: GHSA-4v3g-g84w-hv7r	Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, …	7.0.72 Vulnerable 8.5.5 Vulnerable 9.0.0.M10 Vulnerable 8.0.37 Vulnerable 7.0.72 Vulnerable 8.5.5 Vulnerable 9.0.0.M10 Vulnerable 8.0.37 Vulnerable
CVE-2016-8745 Aliases: GHSA-w3j5-q8f2-3cqq	Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat A bug in the error handling of the send …	7.0.75 Vulnerable 8.0.41 Vulnerable 8.5.9 Vulnerable 7.0.75 Vulnerable 8.0.41 Vulnerable 8.5.9 Vulnerable
GHSA-9xv2-5v5q-p794 Aliases: CVE-2026-65905	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	There are no reported fixed by versions.
GHSA-gcx9-497g-6cp6 Aliases: CVE-2026-65182	Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads …	There are no reported fixed by versions.
GHSA-h3x4-894j-xpx5 Aliases: CVE-2026-68525	Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows …	There are no reported fixed by versions.
GHSA-3vx3-xf6q-r5xp Aliases: CVE-2017-5648	Exposure of Resource to Wrong Sphere in Apache Tomcat While investigating bug 60718, it was noticed that some calls to …	9.0.0.M18 Vulnerable 8.5.13 Vulnerable 8.0.42 Vulnerable 7.0.76 Vulnerable 9.0.0.M18 Vulnerable 8.5.13 Vulnerable 8.0.42 Vulnerable 7.0.76 Vulnerable 7.0.76 Vulnerable
GHSA-xjgh-84hx-56c5 Aliases: CVE-2017-12617	Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, …	9.0.1 Vulnerable 8.5.23 Vulnerable 8.0.47 Vulnerable 7.0.82 Vulnerable 9.0.1 Vulnerable 8.5.23 Vulnerable 8.0.47 Vulnerable 7.0.82 Vulnerable 9.0.1 Vulnerable 7.0.82 Vulnerable
GHSA-8qq4-8jvq-mfw4 Aliases: CVE-2017-12616	Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat When using a VirtualDirContext with Apache Tomcat 7.0.0 to …	7.0.81 Vulnerable 7.0.81 Vulnerable 7.0.81 Vulnerable
GHSA-xcpr-7mr4-h4xq Aliases: CVE-2024-52316	Apache Tomcat - Authentication Bypass Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom …	9.0.96 Vulnerable 11.0.1 Vulnerable 9.0.96 Vulnerable
GHSA-344f-f5vg-2jfj Aliases: CVE-2020-9484	Potential remote code execution in Apache Tomcat When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to …	10.0.0-M5 Vulnerable 7.0.104 Vulnerable 10.0.0-M5 Vulnerable 7.0.104 Vulnerable 7.0.104 Vulnerable
CVE-2026-65905 Aliases: GHSA-9xv2-5v5q-p794	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	9.0.121 Vulnerable 11.0.25 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0