VulnerableCode Package Details - pkg:maven/org.apache.tomcat/tomcat@8.5.30

Vulnerabilities affecting this package (101)

Advisory	Summary	Fixed in package version
CVE-2024-23672	Important: Denial of Service	8.5.99 Vulnerable
CVE-2024-24549	Important: Denial of Service	8.5.99 Vulnerable
CVE-2023-46589	Important: Request smuggling	8.5.96 Vulnerable
CVE-2023-45648	Important: Request smuggling	8.5.94 Vulnerable
CVE-2023-44487	Important: Denial of Service	8.5.94 Vulnerable
CVE-2023-42795	Important: Information Disclosure	8.5.94 Vulnerable
CVE-2023-41080	Moderate: Open redirect	8.5.93 Vulnerable
CVE-2023-28708	Important: Apache Tomcat information disclosure	8.5.86 Vulnerable
CVE-2023-24998	Important: Apache Tomcat denial of service	8.5.85 Vulnerable
CVE-2022-42252	Low: Apache Tomcat request smuggling	8.5.83 Vulnerable
CVE-2021-43980	High: Information Disclosure	8.5.78 Vulnerable
CVE-2022-25762	Important: Request mix-up	8.5.76 Vulnerable
CVE-2021-33037	Important: Request Smuggling	8.5.68 Vulnerable
CVE-2021-30640	Low: Authentication weakness	8.5.66 Vulnerable
CVE-2021-41079	Important: Denial of Service	8.5.64 Vulnerable
CVE-2024-21733	Important: Information Disclosure	8.5.64 Vulnerable
CVE-2020-9484	Low: Fix for CVE-2020-9484 was incomplete	8.5.63 Vulnerable 8.5.55 Vulnerable
CVE-2021-25122	Important: Request mix-up with h2c	8.5.63 Vulnerable
CVE-2021-24122	Important: Information disclosure	8.5.60 Vulnerable
CVE-2020-17527	Moderate: HTTP/2 request header mix-up	8.5.60 Vulnerable
CVE-2020-13943	Moderate: HTTP/2 request mix-up	8.5.58 Vulnerable
CVE-2020-13935	Important: WebSocket DoS	8.5.57 Vulnerable
CVE-2020-13934	Moderate: HTTP/2 DoS	8.5.57 Vulnerable
CVE-2020-11996	Important: HTTP/2 DoS	8.5.56 Vulnerable
CVE-2020-1938	Important: AJP Request Injection and potential Remote Code Execution	8.5.51 Vulnerable
CVE-2020-1935	Low: HTTP Request Smuggling	8.5.51 Vulnerable
CVE-2019-17563	Low: Session fixation	8.5.50 Vulnerable
CVE-2019-12418	Moderate: Local Privilege Escalation	8.5.49 Vulnerable
CVE-2019-10072	Important: Denial of Service	8.5.41 Vulnerable
CVE-2019-0232	Important: Remote Code Execution on Windows	8.5.40 Vulnerable
CVE-2019-0221	Low: XSS in SSI printenv	8.5.40 Vulnerable
CVE-2019-0199	Important: Denial of Service	8.5.38 Vulnerable
CVE-2018-11784	Moderate: Open Redirect	8.5.34 Vulnerable
CVE-2018-8034	Low: host name verification missing in WebSocket client	8.5.32 Vulnerable
CVE-2018-8014	Low: CORS filter has insecure defaults	8.0.53 Vulnerable 8.5.32 Vulnerable
CVE-2018-8037	Important: Information Disclosure	8.5.32 Vulnerable
CVE-2018-1336	Important: A bug in the UTF-8 decoder can lead to DoS	8.5.31 Vulnerable
CVE-2016-6797	Low: Unrestricted Access to Global Resources	8.5.5 Vulnerable
CVE-2016-6796	Low: Security Manager Bypass	8.5.5 Vulnerable
CVE-2016-6794	Low: System Property Disclosure	8.5.5 Vulnerable
CVE-2016-5018	Low: Security Manager Bypass	8.5.5 Vulnerable
CVE-2016-0762	Low: Timing Attack	8.5.5 Vulnerable
CVE-2016-3092	Moderate: Denial of Service	8.5.3 Vulnerable
CVE-2013-4286	Important: Information disclosure	There are no reported fixed by versions.
CVE-2018-8014	Low: CORS filter has insecure defaults	There are no reported fixed by versions.
GHSA-4vww-mc66-62m6 Aliases: CVE-2021-33037	HTTP Request Smuggling in Apache Tomcat Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not …	8.5.68 Vulnerable
GHSA-44qp-qhfv-c7f6 Aliases: CVE-2021-30639	Improper Handling of Exceptional Conditions in Apache Tomcat A vulnerability in Apache Tomcat allows an attacker to remotely trigger a …	8.5.65 Vulnerable
GHSA-36qh-35cm-5w2w Aliases: CVE-2021-30640	Authentication Bypass by Alternate Name in Apache Tomcat A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker …	8.5.65 Vulnerable
GHSA-59g9-7gfx-c72p Aliases: CVE-2021-41079	Infinite loop in Tomcat due to parsing error Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 …	8.5.64 Vulnerable
GHSA-hgrr-935x-pq79 Aliases: CVE-2025-61795	Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …	There are no reported fixed by versions.
GHSA-wmwf-9ccg-fff5 Aliases: CVE-2025-55752	Apache Tomcat Vulnerable to Relative Path Traversal The fix for bug 60013 introduced a regression where the rewritten URL was …	There are no reported fixed by versions.
GHSA-9f3j-pm6f-9fm5 Aliases: CVE-2022-23181	Race condition in Apache Tomcat The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into …	8.5.75 Vulnerable
GHSA-h3ch-5pp2-vh6w Aliases: CVE-2022-25762	Improper socket reuse in Apache Tomcat If a web application sends a WebSocket message concurrently with the WebSocket connection closing …	8.5.75 Vulnerable
GHSA-jx7c-7mj5-9438 Aliases: CVE-2021-43980	Apache Tomcat Race Condition vulnerability The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to …	8.5.78 Vulnerable
GHSA-g8pj-r55q-5c2v Aliases: CVE-2023-42795	Apache Tomcat Incomplete Cleanup vulnerability Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from …	8.5.94 Vulnerable
GHSA-r6j3-px5g-cq3x Aliases: CVE-2023-45648	Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 …	8.5.94 Vulnerable
GHSA-q3mw-pvr8-9ggc Aliases: CVE-2023-41080	Apache Tomcat Open Redirect vulnerability URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue …	8.5.93 Vulnerable
GHSA-9m3c-qcxr-9x87 Aliases: CVE-2026-25854	Apache Tomcat has an Open Redirect vulnerability Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via …	9.0.116 Vulnerable
GHSA-gx5v-xp9w-j4cg Aliases: CVE-2026-41284	Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-5mp6-jrq3-r938 Aliases: CVE-2026-43513	Apache Tomcat: LockOutRealm treats user names as case-sensitive Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This …	9.0.118 Vulnerable
GHSA-5m62-pw8w-7w9f Aliases: CVE-2026-43515	Apache Tomcat - Security constraints not correctly applied Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable
GHSA-fv25-8xcx-gqjc Aliases: CVE-2026-42498	Apache Tomcat - WebSocket authentication header exposure Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache …	9.0.118 Vulnerable
GHSA-h6fc-48rj-7qqh Aliases: CVE-2026-43512	Apache Tomcat - Digest authenticator will authenticate any unknown user Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 …	9.0.118 Vulnerable
GHSA-9m89-8frq-c98c Aliases: CVE-2026-43514	Apache Tomcat - AJP secret compared in non-constant time Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to …	9.0.118 Vulnerable
GHSA-qxf4-chvg-4r8r Aliases: CVE-2020-1935	Potential HTTP request smuggling in Apache Tomcat In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 …	8.5.51 Vulnerable
CVE-2022-42252 Aliases: GHSA-p22x-g9px-3945	Improper Input Validation If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was …	8.5.83 Vulnerable 10.0.27 Vulnerable 10.1.1 Vulnerable 9.0.68 Vulnerable
CVE-2019-12418	Insufficiently Protected Credentials When Apache Tomcat is configured with the JMX Remote Lifecycle Listener, a local attacker without access to …	8.5.49 Vulnerable 7.0.99 Vulnerable 9.0.29 Vulnerable
CVE-2020-1938	Improper Input Validation When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache …	8.5.51 Vulnerable 7.0.100 Vulnerable 9.0.31 Vulnerable
CVE-2019-0232	Improper Input Validation When running on Windows with `enableCmdLineArguments` enabled, the CGI Servlet in Apache Tomcat is vulnerable to Remote …	8.5.40 Vulnerable 7.0.94 Vulnerable 9.0.19 Vulnerable
CVE-2019-17563	Session Fixation When using `FORM` authentication with Apache Tomcat there is a narrow window where an attacker could perform a …	8.5.50 Vulnerable 7.0.99 Vulnerable 9.0.30 Vulnerable
CVE-2019-10072	HTTP/2 DoS The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache …	8.5.41 Vulnerable 9.0.20 Vulnerable
CVE-2024-21733 Aliases: GHSA-f4qf-m5gf-8jm8	Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from …	8.5.64 Vulnerable 9.0.44 Vulnerable
CVE-2021-30640	Improper Authentication A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a …	8.5.66 Vulnerable 7.0.109 Vulnerable 9.0.46 Vulnerable 10.0.6 Vulnerable
CVE-2020-17527	Information Exposure While investigating bug it was discovered that Apache Tomcat to to to could re-use an HTTP request header …	8.5.60 Vulnerable 10.0.2 Vulnerable 9.0.40 Vulnerable
CVE-2020-1935	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) In Apache Tomcat, the HTTP header parsing code used an approach to …	8.5.51 Vulnerable 7.0.100 Vulnerable 9.0.31 Vulnerable
CVE-2019-0199	Uncontrolled Resource Consumption The HTTP/2 implementation in Apache Tomcat accepted streams with excessive numbers of `SETTINGS` frames and also permitted …	8.5.38 Vulnerable 9.0.16 Vulnerable
CVE-2023-46589	Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from …	8.5.96 Vulnerable 9.0.83 Vulnerable 10.1.16 Vulnerable
CVE-2021-24122	Information Exposure When serving resources from a network location using the NTFS file system, Apache Tomcat is susceptible to JSP …	8.5.60 Vulnerable 7.0.107 Vulnerable 10.0.0-M10 Vulnerable 9.0.40 Vulnerable
GHSA-jjpq-gp5q-8q6w Aliases: CVE-2019-0221	Cross-site scripting in Apache Tomcat The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 …	8.5.40 Vulnerable 8.5.40 Vulnerable
CVE-2026-24880 Aliases: GHSA-563x-q5rq-57qp	Apache Tomcat has an HTTP Request/Response Smuggling vulnerability Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat …	11.0.20 Vulnerable 10.1.52 Vulnerable 9.0.116 Vulnerable 11.0.20 Vulnerable 10.1.52 Vulnerable 9.0.116 Vulnerable
CVE-2018-8014	Insecure Default Initialization of Resource The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable …	8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable 8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable
CVE-2025-61795 Aliases: GHSA-hgrr-935x-pq79	Apache Tomcat Vulnerable to Improper Resource Shutdown or Release If an error occurred (including exceeding limits) during the processing of …	11.0.12 Vulnerable 9.0.110 Vulnerable 10.1.47 Vulnerable 11.0.12 Vulnerable 9.0.110 Vulnerable 10.1.47 Vulnerable
CVE-2018-1305	Improper Access Control A vulnerability in Tomcat leads to the exposure of resources to users that are not authorised to …	7.0.85 Vulnerable 9.0.5 Vulnerable 7.0.85 Vulnerable 9.0.5 Vulnerable
CVE-2018-8037	Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) Tomcat contains a race condition that could result in a …	8.5.32 Vulnerable 9.0.10 Vulnerable 8.5.32 Vulnerable 9.0.10 Vulnerable
CVE-2020-13934 Aliases: GHSA-vf77-8h7g-gghp	Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat An h2c direct connection to Apache …	8.5.56 Vulnerable 9.0.36 Vulnerable 10.0.0-M6 Vulnerable 8.5.56 Vulnerable 9.0.36 Vulnerable 10.0.0-M6 Vulnerable
CVE-2018-11784	URL Redirection to Untrusted Site (Open Redirect) When the default servlet in Apache Tomcat returns a redirect to a directory, …	8.5.34 Vulnerable 7.0.91 Vulnerable 9.0.12 Vulnerable 8.5.34 Vulnerable 7.0.91 Vulnerable 9.0.12 Vulnerable
CVE-2018-1336	Loop with Unreachable Exit Condition (Infinite Loop) An improper handling of overflow in the UTF-8 decoder with supplementary characters can …	8.0.52 Vulnerable 8.5.31 Vulnerable 7.0.88 Vulnerable 9.0.8 Vulnerable 8.0.52 Vulnerable 8.5.31 Vulnerable 7.0.88 Vulnerable 9.0.8 Vulnerable
CVE-2018-8034	Improper Certificate Validation The host name verification when using TLS with the `WebSocket` client was missing.	8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable 8.0.53 Vulnerable 8.5.32 Vulnerable 7.0.90 Vulnerable 9.0.10 Vulnerable
CVE-2020-11996 Aliases: GHSA-53hp-jpwq-2jgq	Uncontrolled Resource Consumption in Apache Tomcat A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, …	8.5.55 Vulnerable 9.0.35 Vulnerable 10.0.0-M5 Vulnerable 8.5.55 Vulnerable 9.0.35 Vulnerable 10.0.0-M5 Vulnerable
CVE-2021-43980 Aliases: GHSA-jx7c-7mj5-9438	Apache Tomcat Race Condition vulnerability The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to …	There are no reported fixed by versions.
CVE-2020-13935 Aliases: GHSA-m7jv-hq7h-mq7c	Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …	8.5.57 Vulnerable 7.0.105 Vulnerable 9.0.37 Vulnerable 10.0.0-M7 Vulnerable 8.5.57 Vulnerable 7.0.105 Vulnerable 9.0.37 Vulnerable 10.0.0-M7 Vulnerable
GHSA-m7jv-hq7h-mq7c Aliases: CVE-2020-13935	Infinite Loop in Apache Tomcat The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 …	8.5.57 Vulnerable 8.5.57 Vulnerable
GHSA-r29c-68gh-xp6x Aliases: CVE-2026-41293	Apache Tomcat - HTTP/2 request headers not validated Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 …	9.0.118 Vulnerable 9.0.118 Vulnerable
GHSA-fpj8-gq4v-p354 Aliases: CVE-2025-66614	Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, …	9.0.113 Vulnerable
GHSA-9xv2-5v5q-p794 Aliases: CVE-2026-65905	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	There are no reported fixed by versions.
GHSA-gcx9-497g-6cp6 Aliases: CVE-2026-65182	Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads …	There are no reported fixed by versions.
GHSA-h3x4-894j-xpx5 Aliases: CVE-2026-68525	Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows …	There are no reported fixed by versions.
CVE-2018-8014	Low: CORS filter has insecure defaults	There are no reported fixed by versions.
GHSA-53hp-jpwq-2jgq Aliases: CVE-2020-11996	Uncontrolled Resource Consumption in Apache Tomcat A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, …	10.0.0-M5 Vulnerable 8.5.55 Vulnerable 8.5.55 Vulnerable
GHSA-vf77-8h7g-gghp Aliases: CVE-2020-13934	Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat An h2c direct connection to Apache …	10.0.0-M6 Vulnerable 8.5.56 Vulnerable 8.5.56 Vulnerable
CVE-2026-65905 Aliases: GHSA-9xv2-5v5q-p794	Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST …	11.0.25 Vulnerable 9.0.121 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	10.0