Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat-util@8.5.15
purl pkg:maven/org.apache.tomcat/tomcat-util@8.5.15
Next non-vulnerable version 8.5.96
Latest non-vulnerable version 11.0.25
Risk score 2.4
Vulnerabilities affecting this package (13)
Advisory Summary Fixed in package version
CVE-2018-1336

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the …
8.5.31
Vulnerable
8.5.32
Vulnerable
8.5.34
Vulnerable
8.5.35
Vulnerable
8.5.37
Vulnerable
8.5.38
Vulnerable
8.5.39
Vulnerable
8.5.40
Vulnerable
8.5.41
Vulnerable
8.5.42
Vulnerable
8.5.43
Vulnerable
8.5.45
Vulnerable
8.5.46
Vulnerable
8.5.47
Vulnerable
8.5.50
Vulnerable
8.5.51
Vulnerable
9.0.8
Vulnerable
9.0.10
Vulnerable
9.0.16
Vulnerable
9.0.19
Vulnerable
9.0.20
Vulnerable
9.0.21
Vulnerable
9.0.22
Vulnerable
9.0.24
Vulnerable
9.0.26
Vulnerable
9.0.27
Vulnerable
9.0.29
Vulnerable
9.0.30
Vulnerable
9.0.31
Vulnerable
9.0.36
Vulnerable
8.5.53
Vulnerable
8.5.54
Vulnerable
8.5.55
Vulnerable
8.5.56
Vulnerable
8.5.57
Vulnerable
9.0.33
Vulnerable
9.0.34
Vulnerable
9.0.35
Vulnerable
9.0.37
Vulnerable
GHSA-g8pj-r55q-5c2v
Aliases:
CVE-2023-42795
Apache Tomcat Incomplete Cleanup vulnerability Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from …
8.5.94
Vulnerable
CVE-2023-41080

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 …
8.5.93
Vulnerable
9.0.80
Vulnerable
10.1.13
Vulnerable
CVE-2019-0232

Improper Input Validation When running on Windows with `enableCmdLineArguments` enabled, the CGI Servlet in Apache Tomcat is vulnerable to Remote …
7.0.94
Vulnerable
8.5.40
Vulnerable
9.0.19
Vulnerable
CVE-2019-10072

Uncontrolled Resource Consumption The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in …
8.5.41
Vulnerable
9.0.20
Vulnerable
CVE-2018-8037

Information Exposure A bug in the tracking of connection closures can lead to reuse of user sessions in a new …
8.5.32
Vulnerable
9.0.10
Vulnerable
CVE-2019-0221

Cross-site Scripting The SSI `printenv` command in Apache Tomcat echoes user provided data without escaping and is, therefore, vulnerable to …
7.0.94
Vulnerable
8.5.40
Vulnerable
9.0.19
Vulnerable
CVE-2018-1336

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the …
8.5.31
Vulnerable
9.0.8
Vulnerable
7.0.88
Vulnerable
8.0.52
Not vulnerable
CVE-2020-1935

Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) In Apache Tomcat, the HTTP header parsing code used an approach to …
7.0.100
Vulnerable
8.5.51
Vulnerable
9.0.31
Vulnerable
CVE-2019-0199

Uncontrolled Resource Consumption The HTTP/2 implementation in Apache Tomcat accepted streams with excessive numbers of `SETTINGS` frames and also permitted …
8.5.38
Vulnerable
9.0.16
Vulnerable
CVE-2023-46589

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from …
8.5.96
Not vulnerable
9.0.83
Vulnerable
10.1.16
Vulnerable
CVE-2021-24122

Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP …
8.5.60
Vulnerable
9.0.40
Vulnerable
7.0.107
Not vulnerable
10.0.2
Vulnerable
CVE-2021-43980

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The simplified implementation of blocking reads and writes introduced in … There are no reported fixed by versions.
Vulnerabilities fixed by this package (1)

Advisory Summary Aliases
CVE-2020-1938
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats …