Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat@9.0.0-M1 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-4vww-mc66-62m6
Aliases: CVE-2021-33037 |
HTTP Request Smuggling in Apache Tomcat Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not … |
Vulnerable |
|
GHSA-jx7c-7mj5-9438
Aliases: CVE-2021-43980 |
Apache Tomcat Race Condition vulnerability The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to … |
Vulnerable |
|
GHSA-g8pj-r55q-5c2v
Aliases: CVE-2023-42795 |
Apache Tomcat Incomplete Cleanup vulnerability Incomplete Cleanup vulnerability in Apache Tomcat. When recycling various internal objects in Apache Tomcat from … |
Vulnerable |
|
GHSA-r6j3-px5g-cq3x
Aliases: CVE-2023-45648 |
Apache Tomcat Improper Input Validation vulnerability Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 … |
Vulnerable |
|
GHSA-q3mw-pvr8-9ggc
Aliases: CVE-2023-41080 |
Apache Tomcat Open Redirect vulnerability URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue … |
Vulnerable |
|
GHSA-fpj8-gq4v-p354
Aliases: CVE-2025-66614 |
Apache Tomcat - Client certificate verification bypass Improper Input Validation vulnerability. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, … |
Vulnerable |
|
GHSA-gcx9-497g-6cp6
Aliases: CVE-2026-65182 |
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads … |
Vulnerable |
|
GHSA-h3x4-894j-xpx5
Aliases: CVE-2026-68525 |
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows … |
Vulnerable |
|
CVE-2026-73180
|
Low: Authenticated WebSocket session survives end of HTTP session |
Vulnerable |
|
CVE-2026-68525
|
Low: Redirect after FORM authentication may bypass method specific constraints |
Vulnerable |
|
CVE-2026-65927
|
Important: RewriteValve [N] restarts at the second rule and may bypass access control |
Vulnerable |
|
CVE-2026-55957
|
Important: Authentication bypass with JNDIRealm and GSSAPI authenticated bind |
Vulnerable |
|
CVE-2024-52316
|
Low: Authentication Bypass |
Vulnerable |
|
CVE-2024-34750
|
Important: Denial of Service |
Vulnerable |
|
CVE-2024-23672
|
Important: Denial of Service |
Vulnerable |
|
CVE-2024-24549
|
Important: Denial of Service |
Vulnerable |
|
CVE-2023-46589
|
Important: Request smuggling |
Vulnerable |
|
CVE-2023-45648
|
Important: Request smuggling |
Vulnerable |
|
CVE-2023-44487
|
Important: Denial of Service |
Vulnerable |
|
CVE-2023-42795
|
Important: Information Disclosure |
Vulnerable |
|
CVE-2023-41080
|
Moderate: Open redirect |
Vulnerable |
|
CVE-2023-28708
|
Important: Apache Tomcat information disclosure |
Vulnerable |
|
CVE-2023-24998
|
Important: Apache Tomcat denial of service |
Vulnerable |
|
CVE-2022-42252
|
Low: Apache Tomcat request smuggling |
Vulnerable |
|
CVE-2021-43980
|
High: Information Disclosure |
Vulnerable |
|
CVE-2021-41079
|
Important: Denial of Service |
Vulnerable |
|
CVE-2020-17527
|
Moderate: HTTP/2 request header mix-up |
Vulnerable |