Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat-coyote@8.5.57 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-25xr-qj8w-c4vf
Aliases: CVE-2025-53506 |
Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams Uncontrolled Resource Consumption vulnerability in Apache Tomcat if … | There are no reported fixed by versions. |
|
GHSA-vvw4-rfwf-p6hx
Aliases: CVE-2020-17527 |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat While investigating bug 64830 it was discovered that Apache … |
Vulnerable |
|
GHSA-wm9w-rjj3-j356
Aliases: CVE-2024-34750 |
Apache Tomcat - Denial of Service Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing … | There are no reported fixed by versions. |
|
GHSA-r6j3-px5g-cq3x
Aliases: CVE-2023-45648 |
Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 … |
Vulnerable |
|
GHSA-qppj-fm5r-hxr3
Aliases: CVE-2023-44487 |
HTTP/2 Stream Cancellation Attack ## HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that … |
Vulnerable |
|
CVE-2022-42252
|
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2023-41080
|
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-13943
|
HTTP Request Smuggling If a `HTTP/2` client connecting to Apache Tomcat exceeded the agreed maximum number of concurrent streams for … |
Vulnerable Vulnerable |
|
CVE-2021-33037
|
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Apache Tomcat does not correctly parse the HTTP transfer-encoding request header in … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-17527
|
Information Exposure While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-24122
|
Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-f4qf-m5gf-8jm8
Aliases: CVE-2024-21733 |
Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information Generation of Error Message Containing Sensitive Information vulnerability in … |
Vulnerable |
|
GHSA-qq5r-98hh-rxc9
Aliases: CVE-2026-24733 |
Apache Tomcat - Security constraint bypass with HTTP/0.9 Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 … |
Vulnerable |
|
GHSA-4j3c-42xv-3f84
Aliases: CVE-2025-52434 |
Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization … | There are no reported fixed by versions. |
|
GHSA-7jqf-v358-p8g7
Aliases: CVE-2024-38286 |
Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability Allocation of Resources Without Limits or Throttling vulnerability in Apache … | There are no reported fixed by versions. |
|
CVE-2025-52434
Aliases: GHSA-4j3c-42xv-3f84 |
Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization … |
Vulnerable |
|
CVE-2021-43980
|
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in … | There are no reported fixed by versions. |
|
GHSA-r29c-68gh-xp6x
Aliases: CVE-2026-41293 |
Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 … |
Vulnerable |
|
GHSA-fpj8-gq4v-p354
Aliases: CVE-2025-66614 |
Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, … |
Vulnerable |
|
GHSA-3p2h-wqq4-wf4h
Aliases: CVE-2025-31650 |
Apache Tomcat Denial of Service via invalid HTTP priority header Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling … |
Vulnerable |
|
GHSA-f268-65qc-98vg
Aliases: CVE-2020-13943 |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-7w75-32cg-r6g2
Aliases: CVE-2024-24549 |
Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests Denial of Service due to improper … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-563x-q5rq-57qp
Aliases: CVE-2026-24880 |
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat … |
Vulnerable Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2018-8037
|
If an async request was completed by the application at the same time as the container triggered the async timeout, … | |
|
CVE-2019-17569
|
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The … | |
|
CVE-2020-1938
|
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats … | |
|
CVE-2019-0199
|
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS … | |
|
CVE-2020-1935
|
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an … | |
|
CVE-2020-11996
|
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to … | |
|
CVE-2020-13935
|
Loop with Unreachable Exit Condition (Infinite Loop) The payload length in a WebSocket frame was not correctly validated in Apache … |