VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat-catalina@9.0.16

Vulnerabilities affecting this package (51)

Advisory	Summary	Fixed in package version
CVE-2019-12418	When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, …	9.0.37 Vulnerable
CVE-2019-17563	When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a …	There are no reported fixed by versions.
CVE-2019-0221	The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided …	9.0.19 Vulnerable 9.0.20 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 7.0.94 Vulnerable
CVE-2019-0232	When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and …	9.0.19 Vulnerable 9.0.20 Vulnerable 9.0.21 Vulnerable 9.0.22 Vulnerable 9.0.24 Vulnerable 9.0.26 Vulnerable 9.0.27 Vulnerable 9.0.29 Vulnerable 9.0.30 Vulnerable 9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.34 Vulnerable 9.0.35 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable 8.5.40 Vulnerable 8.5.41 Vulnerable 8.5.42 Vulnerable 8.5.43 Vulnerable 8.5.46 Vulnerable 8.5.47 Vulnerable 8.5.50 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 7.0.94 Vulnerable 7.0.96 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 7.0.99 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable 8.5.57 Vulnerable
GHSA-hgrr-935x-pq79 Aliases: CVE-2025-61795	Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …	9.0.110 Vulnerable
GHSA-wmwf-9ccg-fff5 Aliases: CVE-2025-55752	Apache Tomcat Vulnerable to Relative Path Traversal The fix for bug 60013 introduced a regression where the rewritten URL was …	9.0.109 Vulnerable
GHSA-h2fw-rfh5-95r3 Aliases: CVE-2025-46701	Apache Tomcat - CGI security constraint bypass Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security …	9.0.105 Vulnerable
GHSA-wr62-c79q-cv37 Aliases: CVE-2025-52520	Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits For some unlikely configurations of multipart upload, …	9.0.107 Vulnerable
GHSA-83qj-6fr2-vhqg Aliases: CVE-2025-24813	Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT Path Equivalence: 'file.Name' (Internal Dot) leading to …	9.0.99 Vulnerable
GHSA-5j33-cvvr-w245 Aliases: CVE-2024-50379	Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat …	9.0.98 Vulnerable
GHSA-g8pj-r55q-5c2v Aliases: CVE-2023-42795	Apache Tomcat Incomplete Cleanup vulnerability Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from …	9.0.81 Vulnerable
GHSA-q3mw-pvr8-9ggc Aliases: CVE-2023-41080	Apache Tomcat Open Redirect vulnerability URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue …	9.0.80 Vulnerable
GHSA-2c9m-w27f-53rm Aliases: CVE-2023-28708	Apache Tomcat vulnerable to Unprotected Transport of Credentials When using the RemoteIpFilter with requests received from a reverse proxy via …	9.0.72 Vulnerable
GHSA-9m3c-qcxr-9x87 Aliases: CVE-2026-25854	Apache Tomcat has an Open Redirect vulnerability Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via …	9.0.116 Vulnerable
GHSA-gx5v-xp9w-j4cg Aliases: CVE-2026-41284	Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-5mp6-jrq3-r938 Aliases: CVE-2026-43513	Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …	9.0.118 Vulnerable
GHSA-5m62-pw8w-7w9f Aliases: CVE-2026-43515	Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable
GHSA-fv25-8xcx-gqjc Aliases: CVE-2026-42498	Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …	9.0.118 Vulnerable
GHSA-h6fc-48rj-7qqh Aliases: CVE-2026-43512	Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-9m89-8frq-c98c Aliases: CVE-2026-43514	Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …	9.0.118 Vulnerable
CVE-2022-25762	Improper Resource Shutdown or Release If a web application sends a WebSocket message concurrently with the WebSocket connection closing when …	9.0.21 Vulnerable 8.5.76 Vulnerable
CVE-2020-17527	Information Exposure While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header …	9.0.40 Vulnerable 8.5.60 Vulnerable 10.0.2 Vulnerable
CVE-2021-24122	Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP …	9.0.40 Vulnerable 8.5.60 Vulnerable 7.0.107 Vulnerable 10.0.0-M10 Vulnerable
GHSA-hfrx-6qgj-fp6c Aliases: CVE-2023-24998	Apache Commons FileUpload denial of service vulnerability Apache Commons FileUpload before 1.5 does not limit the number of request parts …	9.0.71 Vulnerable
GHSA-jjpq-gp5q-8q6w Aliases: CVE-2019-0221	Cross-site scripting in Apache Tomcat The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 …	9.0.17 Vulnerable 9.0.17 Vulnerable
GHSA-23hv-mwm6-g8jf Aliases: CVE-2025-55668	Apache Tomcat Session Fixation vulnerability Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from …	9.0.106 Vulnerable 9.0.106 Vulnerable
CVE-2026-41293 Aliases: GHSA-r29c-68gh-xp6x	Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	10.1.55 Vulnerable 9.0.118 Vulnerable 11.0.22 Vulnerable 10.1.55 Vulnerable 9.0.118 Vulnerable 11.0.22 Vulnerable
CVE-2024-52316 Aliases: GHSA-xcpr-7mr4-h4xq	Apache Tomcat - Authentication Bypass Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom …	9.0.96 Vulnerable 10.1.30 Vulnerable 11.0.1 Vulnerable 9.0.96 Vulnerable 10.1.30 Vulnerable 11.0.1 Vulnerable
CVE-2026-24880 Aliases: GHSA-563x-q5rq-57qp	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …	10.1.52 Vulnerable 9.0.116 Vulnerable 11.0.20 Vulnerable 10.1.52 Vulnerable 9.0.116 Vulnerable 11.0.20 Vulnerable
CVE-2025-61795 Aliases: GHSA-hgrr-935x-pq79	Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …	11.0.12 Vulnerable 10.1.47 Vulnerable 9.0.110 Vulnerable 11.0.12 Vulnerable 10.1.47 Vulnerable 9.0.110 Vulnerable
CVE-2026-29146 Aliases: GHSA-h468-7pvh-8vr8	Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects …	10.1.53 Vulnerable 9.0.116 Vulnerable 10.1.53 Vulnerable 9.0.116 Vulnerable
CVE-2025-55668 Aliases: GHSA-23hv-mwm6-g8jf	Apache Tomcat Session Fixation vulnerability Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from …	11.0.8 Vulnerable 10.1.42 Vulnerable 9.0.106 Vulnerable
CVE-2026-34487 Aliases: GHSA-x4m4-345f-5h5g	Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File Insertion of Sensitive Information into Log File vulnerability in …	9.0.117 Vulnerable 10.1.54 Vulnerable 11.0.21 Vulnerable 9.0.117 Vulnerable 10.1.54 Vulnerable 11.0.21 Vulnerable
CVE-2021-43980	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in …	There are no reported fixed by versions.
GHSA-9xv2-5v5q-p794 Aliases: CVE-2026-65905	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	9.0.121 Vulnerable
GHSA-gcx9-497g-6cp6 Aliases: CVE-2026-65182	Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads …	9.0.121 Vulnerable
GHSA-h3x4-894j-xpx5 Aliases: CVE-2026-68525	Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows …	9.0.121 Vulnerable
GHSA-wc4r-xq3c-5cf3 Aliases: CVE-2025-49125	Apache Tomcat - Security constraint bypass for pre/post-resources Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. …	11.0.8 Vulnerable 10.1.42 Vulnerable 9.0.106 Vulnerable 9.0.106 Vulnerable
GHSA-h3gc-qfqq-6h8f Aliases: CVE-2025-48988	Apache Tomcat - DoS in multipart upload Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue …	11.0.8 Vulnerable 10.1.42 Vulnerable 9.0.106 Vulnerable 9.0.106 Vulnerable
GHSA-xjgh-84hx-56c5 Aliases: CVE-2017-12617	Unrestricted Upload of File with Dangerous Type Apache Tomcat When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, …	9.0.1 Vulnerable
GHSA-xcpr-7mr4-h4xq Aliases: CVE-2024-52316	Apache Tomcat - Authentication Bypass Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom …	9.0.96 Vulnerable 11.0.1 Vulnerable 9.0.96 Vulnerable
GHSA-fccv-jmmp-qg76 Aliases: CVE-2023-46589	Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 …	9.0.83 Vulnerable 9.0.83 Vulnerable
GHSA-344f-f5vg-2jfj Aliases: CVE-2020-9484	Potential remote code execution in Apache Tomcat When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to …	10.0.0-M5 Vulnerable 9.0.35 Vulnerable 10.0.0-M5 Vulnerable 9.0.35 Vulnerable 9.0.35 Vulnerable
CVE-2026-55956	Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method …	10.1.56 Vulnerable 9.0.119 Vulnerable 11.0.23 Vulnerable
CVE-2026-65927	Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at …	9.0.121 Vulnerable 11.0.25 Vulnerable
CVE-2026-55955	Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component. This issue affects …	10.1.56 Vulnerable 9.0.119 Vulnerable 11.0.23 Vulnerable
CVE-2026-73180	Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed …	10.1.59 Vulnerable 9.0.121 Vulnerable 11.0.25 Vulnerable
CVE-2026-65905 Aliases: GHSA-9xv2-5v5q-p794	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	9.0.121 Vulnerable 11.0.25 Vulnerable
CVE-2026-59083 Aliases: GHSA-hcjr-322h-429r	Apache Tomcat - Incorrect URL decoding in RewriteValve may allow security control bypass Improper Handling of URL Encoding (Hex Encoding) …	9.0.120 Vulnerable 10.1.57 Vulnerable 11.0.24 Vulnerable
CVE-2026-53404	Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain …	10.1.56 Vulnerable 9.0.119 Vulnerable 11.0.23 Vulnerable
CVE-2026-68569	Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated …	10.1.59 Vulnerable 9.0.121 Vulnerable 11.0.25 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0

Advisory	Summary	Aliases
CVE-2011-1088	Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via …
CVE-2018-1304	The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in …
CVE-2018-8014	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, …
CVE-2018-1305	Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and …
CVE-2019-0199	The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS …
CVE-2018-11784	When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a …