VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat-coyote@9.0.16

Vulnerabilities affecting this package (36)

Advisory	Summary	Fixed in package version
CVE-2019-10072	The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions …	8.5.50 Vulnerable 9.0.30 Vulnerable 8.5.41 Vulnerable 9.0.20 Vulnerable 9.0.35 Vulnerable
CVE-2020-1938	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats …	9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.35 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable 9.0.34 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable
CVE-2020-1935	In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an …	9.0.31 Vulnerable 9.0.33 Vulnerable 9.0.35 Vulnerable 8.5.51 Vulnerable 8.5.53 Vulnerable 8.5.55 Vulnerable 8.5.56 Vulnerable 8.5.57 Vulnerable 7.0.100 Vulnerable 7.0.103 Vulnerable 7.0.104 Vulnerable 7.0.105 Vulnerable 9.0.34 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable
CVE-2020-11996	A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to …	8.5.56 Vulnerable 8.5.57 Vulnerable 9.0.36 Vulnerable 9.0.37 Vulnerable
GHSA-25xr-qj8w-c4vf Aliases: CVE-2025-53506	Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams Uncontrolled Resource Consumption vulnerability in Apache Tomcat if …	9.0.107 Vulnerable
GHSA-gqp3-2cvr-x8m3 Aliases: CVE-2025-48989	Apache Tomcat Improper Resource Shutdown or Release vulnerability Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable …	9.0.108 Vulnerable
GHSA-p22x-g9px-3945 Aliases: CVE-2022-42252	Apache Tomcat may reject request containing invalid Content-Length header If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to …	9.0.68 Vulnerable
GHSA-vvw4-rfwf-p6hx Aliases: CVE-2020-17527	Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat While investigating bug 64830 it was discovered that Apache …	9.0.40 Vulnerable
GHSA-wm9w-rjj3-j356 Aliases: CVE-2024-34750	Apache Tomcat - Denial of Service Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing …	9.0.90 Vulnerable
GHSA-r6j3-px5g-cq3x Aliases: CVE-2023-45648	Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 …	9.0.81 Vulnerable
GHSA-qppj-fm5r-hxr3 Aliases: CVE-2023-44487	HTTP/2 Stream Cancellation Attack ## HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that …	9.0.81 Vulnerable
CVE-2022-42252	Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 …	9.0.68 Vulnerable 10.0.27 Vulnerable 10.1.1 Vulnerable 8.5.83 Vulnerable
CVE-2020-1938	Improper Input Validation When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache …	9.0.31 Vulnerable 8.5.51 Vulnerable 7.0.100 Vulnerable
CVE-2023-41080	URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 …	9.0.80 Vulnerable 8.5.93 Vulnerable 10.1.13 Vulnerable
CVE-2020-13935	Loop with Unreachable Exit Condition (Infinite Loop) The payload length in a WebSocket frame was not correctly validated in Apache …	8.5.57 Vulnerable 7.0.105 Vulnerable 9.0.37 Vulnerable 10.0.2 Vulnerable
CVE-2020-13943	HTTP Request Smuggling If a `HTTP/2` client connecting to Apache Tomcat exceeded the agreed maximum number of concurrent streams for …	9.0.38 Vulnerable 8.5.58 Vulnerable
CVE-2021-33037	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Apache Tomcat does not correctly parse the HTTP transfer-encoding request header in …	9.0.48 Vulnerable 8.5.68 Vulnerable 10.0.7 Vulnerable
CVE-2020-17527	Information Exposure While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header …	10.0.2 Vulnerable 9.0.40 Vulnerable 8.5.60 Vulnerable
CVE-2020-1935	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) In Apache Tomcat M1 to to to the HTTP header parsing code …	9.0.31 Vulnerable 8.5.51 Vulnerable 7.0.100 Vulnerable
CVE-2020-11996	Uncontrolled Resource Consumption A specially crafted sequence of `HTTP/2` requests sent to Apache Tomcat could trigger high CPU usage for …	8.5.56 Vulnerable 9.0.36 Vulnerable
CVE-2021-24122	Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP …	10.0.0-M10 Vulnerable 9.0.40 Vulnerable 8.5.60 Vulnerable 7.0.107 Vulnerable
GHSA-f4qf-m5gf-8jm8 Aliases: CVE-2024-21733	Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information Generation of Error Message Containing Sensitive Information vulnerability in …	9.0.44 Vulnerable 9.0.44 Vulnerable
GHSA-hfrx-6qgj-fp6c Aliases: CVE-2023-24998	Apache Commons FileUpload denial of service vulnerability Apache Commons FileUpload before 1.5 does not limit the number of request parts …	9.0.71 Vulnerable 9.0.71 Vulnerable
GHSA-qq5r-98hh-rxc9 Aliases: CVE-2026-24733	Apache Tomcat - Security constraint bypass with HTTP/0.9 Improper Input Validation vulnerability in Apache Tomcat. Tomcat did not limit HTTP/0.9 …	9.0.113 Vulnerable
GHSA-4j3c-42xv-3f84 Aliases: CVE-2025-52434	Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization …	9.0.107 Vulnerable
GHSA-7jqf-v358-p8g7 Aliases: CVE-2024-38286	Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability Allocation of Resources Without Limits or Throttling vulnerability in Apache …	9.0.90 Vulnerable
CVE-2025-52434 Aliases: GHSA-4j3c-42xv-3f84	Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector Concurrent Execution using Shared Resource with Improper Synchronization …	9.0.107 Vulnerable
CVE-2025-48989 Aliases: GHSA-gqp3-2cvr-x8m3	Apache Tomcat Improper Resource Shutdown or Release vulnerability Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable …	11.0.10 Vulnerable 10.1.44 Vulnerable 9.0.108 Vulnerable 11.0.10 Vulnerable 10.1.44 Vulnerable 9.0.108 Vulnerable
CVE-2020-13934 Aliases: GHSA-vf77-8h7g-gghp	Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat An h2c direct connection to Apache …	8.5.56 Vulnerable 9.0.36 Vulnerable 10.0.0-M6 Vulnerable 8.5.56 Vulnerable 9.0.36 Vulnerable 10.0.0-M6 Vulnerable
CVE-2021-43980	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in …	There are no reported fixed by versions.
GHSA-r29c-68gh-xp6x Aliases: CVE-2026-41293	Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable
GHSA-fpj8-gq4v-p354 Aliases: CVE-2025-66614	Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, …	9.0.113 Vulnerable 9.0.113 Vulnerable
GHSA-f268-65qc-98vg Aliases: CVE-2020-13943	Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 …	10.0.0-M8 Vulnerable 9.0.38 Vulnerable 9.0.38 Vulnerable
GHSA-vf77-8h7g-gghp Aliases: CVE-2020-13934	Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat An h2c direct connection to Apache …	10.0.0-M6 Vulnerable 9.0.36 Vulnerable 9.0.36 Vulnerable
GHSA-7w75-32cg-r6g2 Aliases: CVE-2024-24549	Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests Denial of Service due to improper …	11.0.0-M17 Vulnerable 10.1.19 Vulnerable 9.0.86 Vulnerable 9.0.86 Vulnerable
GHSA-563x-q5rq-57qp Aliases: CVE-2026-24880	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …	9.0.116 Vulnerable 11.0.20 Vulnerable 9.0.116 Vulnerable

Next non-vulnerable version	9.0.122
Latest non-vulnerable version	11.0.26
Risk score	10.0

Advisory	Summary	Aliases
CVE-2018-8037	If an async request was completed by the application at the same time as the container triggered the async timeout, …
CVE-2019-17569	The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The …
CVE-2019-0199	The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS …
GHSA-qcxh-w3j9-58qr	Apache Tomcat Denial of Service vulnerability The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted …	CVE-2019-0199