org.apache.tomcat.embed:tomcat-embed-core
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Maven
- Vulnerability status
- affected by 9 advisory(ies)
Advisories (78)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-23hv-mwm6-g8jf Apache Tomcat Session Fixation vulnerability | 11.0.0-M1 – < 11.0.8 ; 10.1.0-M1 – < 10.1.42 ; 9.0.0.M1 – < 9.0.106 | Not affected |
| GHSA-25xr-qj8w-c4vf Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams | 8.5.0 – 8.5.100 ; 9.0.0.M1 – < 9.0.107 ; 10.1.0-M1 – < 10.1.43 ; … | Not affected |
| GHSA-27hp-xhwr-wr2m Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | 11.0.0-M1 – < 11.0.2 ; 10.1.0-M1 – < 10.1.34 ; 9.0.0.M1 – < 9.0.98 | Not affected |
| GHSA-2rvv-w9r2-rg7m Information Disclosure in Apache Tomcat | 10.0.0-M1 – < 10.0.0-M10 ; 9.0.0 – < 9.0.40 ; 8.5.0 – < 8.5.60 ; … | Not affected |
| GHSA-344f-f5vg-2jfj Potential remote code execution in Apache Tomcat | 10.0.0-M1 – < 10.0.0-M5 ; 9.0.0 – < 9.0.35 ; 8.0.0 – < 8.5.55 ; … | Not affected |
| GHSA-3p2h-wqq4-wf4h Apache Tomcat Denial of Service via invalid HTTP priority header | 9.0.76 – < 9.0.104 ; 10.1.10 – < 10.1.40 ; 11.0.0-M2 – < 11.0.6 ; … | Not affected |
| GHSA-3vx3-xf6q-r5xp Exposure of Resource to Wrong Sphere in Apache Tomcat | 9.0.0.M1 – < 9.0.0.M18 ; 8.5.0 – < 8.5.13 ; 8.0.0 – < 8.0.42 ; … | Not affected |
| GHSA-42wg-hm62-jcwg Apache Tomcat installer for Windows has an untrusted search path vulnerability | 11.0.0-M1 – < 11.0.8 ; 10.1.0 – < 10.1.42 ; 9.0.23 – < 9.0.106 | Not affected |
| GHSA-46j3-r4pj-4835 The host name verification missing in Apache Tomcat | 9.0.0 – < 9.0.10 ; 8.5.0 – < 8.5.32 ; 8.0.0 – < 8.0.53 ; … | Not affected |
| GHSA-4j3c-42xv-3f84 Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector | 9.0.0.M1 – < 9.0.107 ; 8.5.0 – 8.5.100 | Not affected |
| GHSA-53hp-jpwq-2jgq Uncontrolled Resource Consumption in Apache Tomcat | 10.0.0-M1 – < 10.0.0-M5 ; 9.0.0.M1 – < 9.0.35 ; 8.5.0 – < 8.5.55 | Not affected |
| GHSA-563x-q5rq-57qp Apache Tomcat has an HTTP Request/Response Smuggling vulnerability | 7.0.0 – < 9.0.116 ; 10.1.0-M1 – < 10.1.52 ; 11.0.0-M1 – < 11.0.20 | Not affected |
| GHSA-5j33-cvvr-w245 Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability | 11.0.0-M1 – < 11.0.2 ; 10.1.0-M1 – < 10.1.34 ; 9.0.0.M1 – < 9.0.98 ; … | Not affected |
| GHSA-5m62-pw8w-7w9f Apache Tomcat - Security constraints not correctly applied | < 9.0.118 ; 10.1.0-M1 – < 10.1.55 ; 11.0.0-M1 – < 11.0.22 | Affected |
| GHSA-5mp6-jrq3-r938 Apache Tomcat: LockOutRealm treats user names as case-sensitive | < 9.0.118 ; 10.1.0-M1 – < 10.1.55 ; 11.0.0-M1 – < 11.0.22 | Affected |
| GHSA-5q99-f34m-67gc Apache Tomcat Open Redirect vulnerability | 8.5.0 – < 8.5.34 ; 7.0.23 – < 7.0.91 ; 9.0.0 – < 9.0.12 | Not affected |
| GHSA-69cc-cv78-qc8g Apache Tomcat: Configured cipher preference order not preserved | 9.0.114 – < 9.0.116 ; 10.1.51 – < 10.1.53 ; 11.0.16 – < 11.0.20 | Not affected |
| GHSA-6rxj-58jh-436r Apache Tomcat unauthorized access vulnerability | 9.0.0 – < 9.0.5 ; 8.5.0 – < 8.5.28 ; 8.0.0 – < 8.0.51 ; … | Not affected |
| GHSA-6v52-mj5r-7j2m Apache Tomcat Race Condition vulnerability | 9.0.0.M9 – < 9.0.10 ; 8.5.5 – < 8.5.32 | Not affected |
| GHSA-767j-jfh2-jvrc Potential HTTP request smuggling in Apache Tomcat | 7.0.98 – < 7.0.100 ; 8.5.48 – < 8.5.51 ; 9.0.28 – < 9.0.31 | Not affected |
| GHSA-7jqf-v358-p8g7 Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability | 11.0.0-M1 – < 11.0.0-M21 ; 10.1.0-M1 – < 10.1.25 ; 9.0.13 – < 9.0.90 ; … | Not affected |
| GHSA-7w75-32cg-r6g2 Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests | 8.5.0 – < 8.5.99 ; 9.0.0-M1 – < 9.0.86 ; 10.1.0-M1 – < 10.1.19 ; … | Not affected |
| GHSA-83qj-6fr2-vhqg Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT | 11.0.0-M1 – < 11.0.3 ; 10.1.0-M1 – < 10.1.35 ; 9.0.0.M1 – < 9.0.99 ; … | Not affected |
| GHSA-8mc5-53m5-3qj2 Apache Tomcat has an Improper Input Validation vulnerability | 9.0.113 – < 9.0.116 ; 10.1.50 – < 10.1.53 ; 11.0.15 – < 11.0.20 | Not affected |
| GHSA-8vmx-qmch-mpqg Apache Tomcat OS Command Injection vulnerability | 9.0.0.M1 – < 9.0.17 ; 8.0.0 – < 8.5.40 ; 7.0.0 – < 7.0.94 | Not affected |
| GHSA-9hg2-395j-83rm Expected Behavior Violation in Apache Tomcat | 9.0.0.M1 – < 9.0.0.M19 ; 8.5.0 – < 8.5.13 | Not affected |
| GHSA-9m3c-qcxr-9x87 Apache Tomcat has an Open Redirect vulnerability | 8.5.30 – < 9.0.116 ; 10.1.0-M1 – < 10.1.53 ; 11.0.0-M1 – < 11.0.20 | Not affected |
| GHSA-9m89-8frq-c98c Apache Tomcat - AJP secret compared in non-constant time | < 9.0.118 ; 10.1.0-M1 – < 10.1.55 ; 11.0.0-M1 – < 11.0.22 | Affected |
| GHSA-9xcj-c8cr-8c3c In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack | < 7.0.99 ; 8.0.0 – < 8.5.50 ; 9.0.0 – < 9.0.30 | Affected |
| GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability | 11.0.0-M1 – < 11.0.25 ; 10.1.0-M1 – < 10.1.58 ; 9.0.0.M1 – < 9.0.121 ; … | Not affected |
| GHSA-c9hw-wf7x-jp9j Improper Privilege Management in Tomcat | 9.0.0 – < 9.0.31 ; 8.0.0 – < 8.5.51 ; 7.0.0 – < 7.0.100 | Not affected |
| GHSA-cx6h-86xw-9x34 Apache Tomcat - Fix for CVE-2023-24998 was incomplete | 11.0.0-M2 – < 11.0.0-M5 ; 10.1.5 – < 10.1.8 ; 9.0.71 – < 9.0.74 | Not affected |
| GHSA-f4qf-m5gf-8jm8 Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information | 8.5.7 – < 8.5.64 ; 9.0.0-M11 – < 9.0.44 | Not affected |
| GHSA-f525-44xv-f2qj Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation | 11.0.20 – < 11.0.25 ; 10.1.53 – < 10.1.59 ; 9.0.115 – < 9.0.121 | Not affected |
| GHSA-f98p-9pp6-7q6c Apache Tomcat Cross-site scripting (XSS) vulnerability | 5.5.9 – < 5.5.27 ; 6.0.0 – < 6.0.18 | Not affected |
| GHSA-fccv-jmmp-qg76 Apache Tomcat Improper Input Validation vulnerability | 11.0.0-M1 – < 11.0.0-M11 ; 10.1.0-M1 – < 10.1.16 ; 9.0.0-M1 – < 9.0.83 ; … | Not affected |
| GHSA-ff77-26x5-69cr Apache Tomcat Rewrite rule bypass | 9.0.76 – < 9.0.104 ; 10.1.10 – < 10.1.40 ; 11.0.0-M2 – < 11.0.6 ; … | Not affected |
| GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass | 11.0.0-M1 – < 11.0.15 ; 10.1.0-M1 – < 10.1.50 ; 9.0.0-M1 – < 9.0.113 ; … | Not affected |
| GHSA-fv25-8xcx-gqjc Apache Tomcat - WebSocket authentication header exposure | < 9.0.118 ; 10.1.0-M1 – < 10.1.55 ; 11.0.0-M1 – < 11.0.22 | Affected |
| GHSA-g8pj-r55q-5c2v Apache Tomcat Incomplete Cleanup vulnerability | 10.1.0-M1 – < 10.1.14 ; 9.0.0-M1 – < 9.0.81 ; 8.5.0 – < 8.5.94 ; … | Not affected |
| GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability | 11.0.0-M1 – < 11.0.25 ; 10.1.0-M1 – < 10.1.58 ; 9.0.0-M1 – < 9.0.121 ; … | Not affected |
| GHSA-gqp3-2cvr-x8m3 Apache Tomcat Improper Resource Shutdown or Release vulnerability | 11.0.0-M1 – < 11.0.10 ; 10.1.0-M1 – < 10.1.44 ; 9.0.0.M1 – < 9.0.108 | Not affected |
| GHSA-gx5v-xp9w-j4cg Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling | < 9.0.118 ; 10.1.0-M1 – < 10.1.55 ; 11.0.0-M1 – < 11.0.22 | Affected |
| GHSA-h2fw-rfh5-95r3 Apache Tomcat - CGI security constraint bypass | 9.0.0.M1 – < 9.0.105 ; 10.1.0-M1 – < 10.1.41 ; 11.0.0-M1 – < 11.0.7 ; … | Not affected |
| GHSA-h3gc-qfqq-6h8f Apache Tomcat - DoS in multipart upload | 11.0.0-M1 – < 11.0.8 ; 10.1.0-M1 – < 10.1.42 ; 9.0.0.M1 – < 9.0.106 ; … | Not affected |
| GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability | 11.0.0-M1 – < 11.0.25 ; 10.1.0-M1 – < 10.1.58 ; 9.0.0-M1 – < 9.0.121 ; … | Not affected |
| GHSA-h6fc-48rj-7qqh Apache Tomcat - Digest authenticator will authenticate any unknown user | < 9.0.118 ; 10.1.0-M1 – < 10.1.55 ; 11.0.0-M1 – < 11.0.22 | Affected |
| GHSA-hfrx-6qgj-fp6c Apache Commons FileUpload denial of service vulnerability | 10.1.0-M1 – < 10.1.5 ; 11.0.0-M2 – < 11.0.0-M5 ; 8.5.85 – < 8.5.88 ; … | Not affected |
| GHSA-hgrr-935x-pq79 Apache Tomcat Vulnerable to Improper Resource Shutdown or Release | 11.0.0-M1 – < 11.0.12 ; 10.1.0-M1 – < 10.1.47 ; 9.0.0.M1 – < 9.0.110 ; … | Not affected |
| GHSA-hh3j-x4mc-g48r Insufficiently Protected Credentials in Apache Tomcat | < 7.0.99 ; 8.0.0 – < 8.5.49 ; 9.0.0 – < 9.0.29 | Affected |
| GHSA-j39c-c8hj-x4j3 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat | 10.0.0-M1 – < 10.0.2 ; 9.0.0-M1 – < 9.0.43 ; 8.5.0 – < 8.5.63 | Not affected |
| GHSA-jgwr-3qm3-26f3 Potential remote code execution in Apache Tomcat | 10.0.0-M1 – < 10.0.2 ; 9.0.0 – < 9.0.41 ; 8.0.0 – < 8.5.61 ; … | Not affected |
| GHSA-jjpq-gp5q-8q6w Cross-site scripting in Apache Tomcat | 9.0.0 – < 9.0.17 ; 8.5.0 – < 8.5.40 ; 7.0.0 – < 7.0.94 | Not affected |
| GHSA-jx6h-3fjx-cgv5 Apache Tomcat information exposure vulnerability | 9.0.0M1 – < 9.0.5 ; 8.5.0 – < 8.5.28 ; 7.0.0 – < 7.0.85 | Not affected |
| GHSA-m59c-jpc8-m2x4 In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder | 9.0.0.M9 – < 9.0.8 ; 8.5.0 – < 8.5.31 ; 8.0.0RC1 – < 8.0.51 ; … | Not affected |
| GHSA-mgp5-rv84-w37q Apache Tomcat has an Improper Input Validation vulnerability | 11.0.0-M1 – < 11.0.18 ; 10.1.0-M7 – < 10.1.52 ; 9.0.83 – < 9.0.115 | Not affected |
| GHSA-mppv-79ch-vw6q Apache Tomcat vulnerable to information leak | 11.0.0-M5 – < 11.0.0-M6 ; 10.1.8 – < 10.1.9 ; 9.0.74 – < 9.0.75 | Not affected |
| GHSA-p22x-g9px-3945 Apache Tomcat may reject request containing invalid Content-Length header | 8.5.0 – < 8.5.83 ; 9.0.0-M1 – < 9.0.68 ; 10.0.0-M1 – < 10.0.27 ; … | Not affected |
| GHSA-pjfr-qf3p-3q25 When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server | 7.0.0 – < 7.0.79 | Not affected |
| GHSA-q3mw-pvr8-9ggc Apache Tomcat Open Redirect vulnerability | 8.5.0 – < 8.5.93 ; 9.0.0-M1 – < 9.0.80 ; 10.1.0-M1 – < 10.1.13 ; … | Not affected |
| GHSA-q4hg-rmq2-52q9 Improper Locking in Apache Tomcat | 9.0.0.M1 – < 9.0.20 ; 8.5.0 – < 8.5.41 | Not affected |
| GHSA-qcxh-w3j9-58qr Apache Tomcat Denial of Service vulnerability | 9.0.0 – < 9.0.16 ; 8.0.0 – < 8.5.38 | Not affected |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack | 11.0.0-M1 – < 11.0.0-M12 ; 10.0.0 – < 10.1.14 ; 9.0.0 – < 9.0.81 ; … | Not affected |
| GHSA-qvf5-hvjx-wm27 Apache Tomcat Request and/or response mix-up | 9.0.92 – < 9.0.96 ; 10.1.27 – < 10.1.31 ; 11.0.0-M23 – < 11.0.0 | Not affected |
| GHSA-qxf4-chvg-4r8r Potential HTTP request smuggling in Apache Tomcat | < 7.0.100 ; 8.0.0 – < 8.5.51 ; 9.0.0 – < 9.0.31 | Affected |
| GHSA-r29c-68gh-xp6x Apache Tomcat - HTTP/2 request headers not validated | 8.5.0 – < 9.0.118 ; 10.1.0-M1 – < 10.1.55 ; 11.0.0-M1 – < 11.0.22 | Not affected |
| GHSA-r4x2-3cq5-hqvp The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins | 9.0.0.M1 – < 9.0.9 ; 8.5.0 – < 8.5.32 ; 8.0.0RC1 – < 8.0.53 ; … | Not affected |
| GHSA-r6j3-px5g-cq3x Apache Tomcat Improper Input Validation vulnerability | 11.0.0-M1 – < 11.0.0-M12 ; 10.1.0-M1 – < 10.1.14 ; 9.0.0-M1 – < 9.0.81 ; … | Not affected |
| GHSA-rq2w-37h9-vg94 Apache Tomcat improperly escapes input from JsonErrorReportValve | 8.5.83 – < 8.5.84 ; 9.0.40 – < 9.0.69 ; 10.1.0 – < 10.1.2 | Not affected |
| GHSA-rv64-5gf8-9qq8 Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve | 9.0.40 – < 9.0.116 ; 10.1.0-M1 – < 10.1.54 ; 11.0.0-M1 – < 11.0.21 | Not affected |
| GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences | 11.0.0-M1 – < 11.0.11 ; 10.1.0-M1 – < 10.1.45 ; 9.0.40 – < 9.0.109 ; … | Not affected |
| GHSA-wc4r-xq3c-5cf3 Apache Tomcat - Security constraint bypass for pre/post-resources | 11.0.0-M1 – < 11.0.8 ; 10.1.0-M1 – < 10.1.42 ; 9.0.0.M1 – < 9.0.106 ; … | Not affected |
| GHSA-wf5v-jhxj-q632 Denial of service in Apache Tomcat | 8.0.0-RC1 – < 8.0.4 | Not affected |
| GHSA-wm9w-rjj3-j356 Apache Tomcat - Denial of Service | 11.0.0-M1 – < 11.0.0-M21 ; 10.1.0-M1 – < 10.1.25 ; 9.0.0-M1 – < 9.0.90 ; … | Not affected |
| GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal | 11.0.0-M1 – < 11.0.11 ; 10.1.0-M1 – < 10.1.45 ; 9.0.0-M11 – < 9.0.109 ; … | Not affected |
| GHSA-wr62-c79q-cv37 Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits | 11.0.0-M1 – < 11.0.9 ; 10.1.0-M1 – < 10.1.43 ; 9.0.0.M1 – < 9.0.107 ; … | Not affected |
| GHSA-x4m4-345f-5h5g Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File | 9.0.13 – < 9.0.117 ; 10.1.0-M1 – < 10.1.54 ; 11.0.0-M1 – < 11.0.21 | Not affected |
| GHSA-xjgh-84hx-56c5 Unrestricted Upload of File with Dangerous Type Apache Tomcat | 9.0.0.M1 – < 9.0.1 ; 8.5.0 – < 8.5.23 ; 8.0.0-RC1 – < 8.0.47 ; … | Not affected |
Withdrawn advisories (1)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-r53m-pfr5-7v87 Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core · withdrawn
Sources
| Source | Licence |
|---|