Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.78
purl pkg:maven/org.apache.tomcat/tomcat-catalina@7.0.78
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 10.0
Vulnerabilities affecting this package (25)
Advisory Summary Fixed in package version
CVE-2019-17563

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a … There are no reported fixed by versions.
CVE-2019-0221

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided …
9.0.19
Vulnerable
9.0.20
Vulnerable
8.5.40
Vulnerable
8.5.41
Vulnerable
7.0.94
Vulnerable
CVE-2019-0232

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and …
9.0.19
Vulnerable
9.0.20
Vulnerable
9.0.21
Vulnerable
9.0.22
Vulnerable
9.0.24
Vulnerable
9.0.26
Vulnerable
9.0.27
Vulnerable
9.0.29
Vulnerable
9.0.30
Vulnerable
9.0.31
Vulnerable
9.0.33
Vulnerable
9.0.34
Vulnerable
9.0.35
Vulnerable
9.0.36
Vulnerable
9.0.37
Vulnerable
8.5.40
Vulnerable
8.5.41
Vulnerable
8.5.42
Vulnerable
8.5.43
Vulnerable
8.5.46
Vulnerable
8.5.47
Vulnerable
8.5.50
Vulnerable
8.5.51
Vulnerable
8.5.53
Vulnerable
7.0.94
Vulnerable
7.0.96
Vulnerable
8.5.55
Vulnerable
8.5.56
Vulnerable
7.0.99
Vulnerable
7.0.100
Vulnerable
7.0.103
Vulnerable
7.0.104
Vulnerable
8.5.57
Vulnerable
CVE-2018-1305

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and …
9.0.8
Vulnerable
9.0.10
Vulnerable
9.0.16
Vulnerable
9.0.19
Vulnerable
9.0.20
Vulnerable
9.0.21
Vulnerable
9.0.22
Vulnerable
9.0.24
Vulnerable
9.0.26
Vulnerable
9.0.27
Vulnerable
9.0.29
Vulnerable
9.0.30
Vulnerable
9.0.31
Vulnerable
9.0.33
Vulnerable
9.0.34
Vulnerable
9.0.35
Vulnerable
9.0.36
Vulnerable
9.0.37
Vulnerable
8.5.28
Vulnerable
8.5.30
Vulnerable
8.5.31
Vulnerable
8.5.32
Vulnerable
8.5.34
Vulnerable
8.5.35
Vulnerable
8.5.37
Vulnerable
8.5.38
Vulnerable
8.5.39
Vulnerable
8.5.40
Vulnerable
8.5.41
Vulnerable
8.5.42
Vulnerable
8.5.43
Vulnerable
8.5.46
Vulnerable
8.5.47
Vulnerable
8.5.50
Vulnerable
8.5.51
Vulnerable
8.5.53
Vulnerable
7.0.85
Vulnerable
7.0.90
Vulnerable
7.0.91
Vulnerable
7.0.94
Vulnerable
7.0.96
Vulnerable
8.5.55
Vulnerable
8.5.56
Vulnerable
7.0.99
Vulnerable
7.0.100
Vulnerable
7.0.103
Vulnerable
7.0.104
Vulnerable
8.5.57
Vulnerable
7.0.105
Vulnerable
CVE-2018-11784

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a …
9.0.16
Vulnerable
9.0.19
Vulnerable
9.0.20
Vulnerable
9.0.21
Vulnerable
9.0.22
Vulnerable
9.0.24
Vulnerable
9.0.26
Vulnerable
9.0.27
Vulnerable
9.0.29
Vulnerable
9.0.30
Vulnerable
9.0.31
Vulnerable
9.0.33
Vulnerable
9.0.34
Vulnerable
9.0.35
Vulnerable
9.0.36
Vulnerable
9.0.37
Vulnerable
8.5.34
Vulnerable
8.5.35
Vulnerable
8.5.37
Vulnerable
8.5.38
Vulnerable
8.5.39
Vulnerable
8.5.40
Vulnerable
8.5.41
Vulnerable
8.5.42
Vulnerable
8.5.43
Vulnerable
8.5.46
Vulnerable
8.5.47
Vulnerable
8.5.50
Vulnerable
8.5.51
Vulnerable
8.5.53
Vulnerable
7.0.91
Vulnerable
7.0.94
Vulnerable
7.0.96
Vulnerable
8.5.55
Vulnerable
8.5.56
Vulnerable
7.0.99
Vulnerable
7.0.100
Vulnerable
7.0.103
Vulnerable
7.0.104
Vulnerable
8.5.57
Vulnerable
7.0.105
Vulnerable
GHSA-gx5v-xp9w-j4cg
Aliases:
CVE-2026-41284
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …
9.0.118
Vulnerable
GHSA-5mp6-jrq3-r938
Aliases:
CVE-2026-43513
Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …
9.0.118
Vulnerable
GHSA-5m62-pw8w-7w9f
Aliases:
CVE-2026-43515
Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …
9.0.118
Vulnerable
GHSA-fv25-8xcx-gqjc
Aliases:
CVE-2026-42498
Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …
9.0.118
Vulnerable
GHSA-h6fc-48rj-7qqh
Aliases:
CVE-2026-43512
Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …
9.0.118
Vulnerable
GHSA-9m89-8frq-c98c
Aliases:
CVE-2026-43514
Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …
9.0.118
Vulnerable
CVE-2017-7674

Insufficient Verification of Data Authenticity The CORS Filter in Apache Tomcat did not add an HTTP Vary header indicating that …
7.0.79
Vulnerable
8.5.16
Vulnerable
9.0.0.M22
Vulnerable
CVE-2021-24122

Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP …
9.0.40
Vulnerable
8.5.60
Vulnerable
7.0.107
Vulnerable
10.0.0-M10
Vulnerable
GHSA-jjpq-gp5q-8q6w
Aliases:
CVE-2019-0221
Cross-site scripting in Apache Tomcat The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 …
7.0.94
Vulnerable
7.0.94
Vulnerable
CVE-2026-41293
Aliases:
GHSA-r29c-68gh-xp6x
Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …
10.1.55
Vulnerable
9.0.118
Vulnerable
11.0.22
Vulnerable
10.1.55
Vulnerable
9.0.118
Vulnerable
11.0.22
Vulnerable
CVE-2024-52316
Aliases:
GHSA-xcpr-7mr4-h4xq
Apache Tomcat - Authentication Bypass Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom …
9.0.96
Vulnerable
10.1.30
Vulnerable
11.0.1
Vulnerable
9.0.96
Vulnerable
10.1.30
Vulnerable
11.0.1
Vulnerable
CVE-2026-24880
Aliases:
GHSA-563x-q5rq-57qp
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …
10.1.52
Vulnerable
9.0.116
Vulnerable
11.0.20
Vulnerable
10.1.52
Vulnerable
9.0.116
Vulnerable
11.0.20
Vulnerable
GHSA-9xv2-5v5q-p794
Aliases:
CVE-2026-65905
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST … There are no reported fixed by versions.
GHSA-gcx9-497g-6cp6
Aliases:
CVE-2026-65182
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads … There are no reported fixed by versions.
GHSA-h3x4-894j-xpx5
Aliases:
CVE-2026-68525
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows … There are no reported fixed by versions.
GHSA-xjgh-84hx-56c5
Aliases:
CVE-2017-12617
Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, …
9.0.1
Vulnerable
8.5.23
Vulnerable
8.0.47
Vulnerable
7.0.82
Vulnerable
9.0.1
Vulnerable
8.5.23
Vulnerable
8.0.47
Vulnerable
7.0.82
Vulnerable
9.0.1
Vulnerable
7.0.82
Vulnerable
GHSA-8qq4-8jvq-mfw4
Aliases:
CVE-2017-12616
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat When using a VirtualDirContext with Apache Tomcat 7.0.0 to …
7.0.81
Vulnerable
7.0.81
Vulnerable
7.0.81
Vulnerable
GHSA-xcpr-7mr4-h4xq
Aliases:
CVE-2024-52316
Apache Tomcat - Authentication Bypass Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom …
9.0.96
Vulnerable
11.0.1
Vulnerable
9.0.96
Vulnerable
GHSA-344f-f5vg-2jfj
Aliases:
CVE-2020-9484
Potential remote code execution in Apache Tomcat When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to …
10.0.0-M5
Vulnerable
7.0.104
Vulnerable
10.0.0-M5
Vulnerable
7.0.104
Vulnerable
7.0.104
Vulnerable
CVE-2026-65905
Aliases:
GHSA-9xv2-5v5q-p794
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …
9.0.121
Vulnerable
11.0.25
Vulnerable
Vulnerabilities fixed by this package (6)

Advisory Summary Aliases
CVE-2011-1088
Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via …
CVE-2019-0199
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS …
CVE-2011-1582
Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured …
CVE-2016-0706
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on …
CVE-2017-12616
Information Exposure When using a `VirtualDirContext` with Apache Tomcat it is possible to bypass security constraints and/or view the source …
CVE-2017-12615
Unrestricted Upload of File with Dangerous Type When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible …