org.apache.tomcat.embed:tomcat-embed-core

Maven69 known CVEs affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting org.apache.tomcat.embed:tomcat-embed-corepage 1 of 2

CVE-2008-1947NONECVSS 0.0EG 0.0✓ Fixed in 6.0.18
2008-06-04
Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html…
CVE-2014-0095NONECVSS 0.0EG 0.0✓ Fixed in 8.0.4
2014-05-31
vulnerable: 8.0.0-RC1 ... 8.0.3 (6 versions)
java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request proces…
CVE-2017-12615HIGHCVSS 8.1EG 9.0⚠ KEV✓ Fixed in 7.0.79
2017-09-19
vulnerable: 7.0.0 ... 7.0.8 (54 versions)
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted reques…
CVE-2017-12617HIGHCVSS 8.1EG 9.0⚠ KEV✓ Fixed in 7.0.82
2017-10-04
vulnerable: 7.0.0 ... 7.0.81 (56 versions)
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible…
CVE-2017-5648CRITICALCVSS 9.1EG 9.1✓ Fixed in 7.0.76
2017-04-17
vulnerable: 7.0.0 ... 7.0.8 (51 versions)
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When runnin…
CVE-2017-5651CRITICALCVSS 9.8EG 9.8✓ Fixed in 8.5.13
2017-04-17
vulnerable: 8.5.0 ... 8.5.9 (10 versions)
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be …
CVE-2018-11784MEDIUMCVSS 4.3EG 4.3✓ Fixed in 9.0.12
2018-10-04
vulnerable: 9.0.1 ... 9.0.8 (9 versions)
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be us…
CVE-2018-1304MEDIUMCVSS 5.9EG 5.9✓ Fixed in 7.0.86
2018-02-28
vulnerable: 7.0.0 ... 7.0.85 (59 versions)
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constrai…
CVE-2018-1305MEDIUMCVSS 6.5EG 6.5✓ Fixed in 7.0.85
2018-02-23
vulnerable: 7.0.0 ... 7.0.84 (58 versions)
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in …
CVE-2018-1336HIGHCVSS 7.5EG 7.5✓ Fixed in 7.0.87
2018-08-02
vulnerable: 7.0.28 ... 7.0.86 (42 versions)
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8…
CVE-2018-8014CRITICALCVSS 9.8EG 9.8✓ Fixed in 7.0.88
2018-05-16
vulnerable: 7.0.41 ... 7.0.86 (32 versions)
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the C…
CVE-2018-8034HIGHCVSS 7.5EG 7.5✓ Fixed in 7.0.90
2018-08-01
vulnerable: 7.0.35 ... 7.0.88 (37 versions)
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
CVE-2018-8037MEDIUMCVSS 5.9EG 5.9✓ Fixed in 8.5.32
2018-08-02
vulnerable: 8.5.11 ... 8.5.9 (20 versions)
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue w…
CVE-2019-0199HIGHCVSS 7.5EG 7.5✓ Fixed in 8.5.38
2019-04-10
vulnerable: 8.0.1 ... 8.5.9 (70 versions)
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By …
CVE-2019-0221MEDIUMCVSS 6.1EG 6.1✓ Fixed in 7.0.94
2019-05-28
vulnerable: 7.0.0 ... 7.0.93 (65 versions)
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intend…
CVE-2019-0232HIGHCVSS 8.1EG 9.0✓ Fixed in 7.0.94
2019-04-15
vulnerable: 7.0.0 ... 7.0.93 (65 versions)
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command lin…
CVE-2019-10072HIGHCVSS 7.5EG 7.5✓ Fixed in 8.5.41
2019-06-21
vulnerable: 8.5.0 ... 8.5.9 (32 versions)
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (s…
CVE-2019-12418HIGHCVSS 7.0EG 7.0✓ Fixed in 9.0.29
2019-12-23
vulnerable: 9.0.1 ... 9.0.8 (21 versions)
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI regis…
CVE-2019-17563HIGHCVSS 7.5EG 7.5✓ Fixed in 9.0.30
2019-12-23
vulnerable: 9.0.1 ... 9.0.8 (22 versions)
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an expl…
CVE-2019-17569MEDIUMCVSS 4.8EG 4.8✓ Fixed in 9.0.31
2020-02-24
vulnerable: 9.0.29, 9.0.30
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possi…
CVE-2020-1935MEDIUMCVSS 4.8EG 4.8✓ Fixed in 9.0.31
2020-02-24
vulnerable: 9.0.1 ... 9.0.8 (23 versions)
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP R…
CVE-2020-1938CRITICALCVSS 9.8EG 9.8⚠ KEV✓ Fixed in 7.0.100
2020-02-24
vulnerable: 7.0.0 ... 7.0.99 (68 versions)
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are …
CVE-2020-9484HIGHCVSS 7.0EG 9.0✓ Fixed in 7.0.104
2020-05-20
vulnerable: 7.0.0 ... 7.0.99 (70 versions)
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use t…
CVE-2021-24122MEDIUMCVSS 5.9EG 5.9✓ Fixed in 7.0.107
2021-01-14
vulnerable: 7.0.0 ... 7.0.99 (73 versions)
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some confi…
CVE-2021-25122HIGHCVSS 7.5EG 7.5✓ Fixed in 8.5.63
2021-03-01
vulnerable: 8.5.0 ... 8.5.9 (50 versions)
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning use…
CVE-2021-25329HIGHCVSS 7.0EG 7.0✓ Fixed in 7.0.108
2021-03-01
vulnerable: 7.0.0 ... 7.0.99 (74 versions)
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was st…
CVE-2022-42252HIGHCVSS 7.5EG 7.5✓ Fixed in 10.1.1
2022-11-01
vulnerable: 10.1.0 ... 10.1.0-M8 (15 versions)
If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a …
CVE-2022-45143HIGHCVSS 7.5EG 7.5✓ Fixed in 10.1.2
2023-01-03
vulnerable: 10.1.0, 10.1.1
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore pos…
CVE-2023-24998HIGHCVSS 7.5EG 7.5✓ Fixed in 9.0.71
2023-02-20
vulnerable: 9.0.0.M1 ... 9.0.8 (74 versions)
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file …
CVE-2023-28709HIGHCVSS 7.5EG 7.5✓ Fixed in 9.0.74
2023-05-22
vulnerable: 9.0.71, 9.0.72, 9.0.73
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be r…
CVE-2023-34981HIGHCVSS 7.5EG 7.5✓ Fixed in 9.0.75
2023-06-21
vulnerable: 9.0.74
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at l…
CVE-2023-41080MEDIUMCVSS 6.1EG 6.1✓ Fixed in 11.0.0-M11
2023-08-25
vulnerable: 11.0.0-M1 ... 11.0.0-M9 (8 versions)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.7…
CVE-2023-42795MEDIUMCVSS 5.3EG 5.3✓ Fixed in 8.5.94
2023-10-10
vulnerable: 8.5.0 ... 8.5.93 (78 versions)
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an er…
CVE-2023-44487HIGHCVSS 7.5EG 9.0⚠ KEV✓ Fixed in 8.5.94
2023-10-10
vulnerable: 8.5.0 ... 8.5.93 (78 versions)
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2023-45648MEDIUMCVSS 5.3EG 5.3✓ Fixed in 8.5.94
2023-10-10
vulnerable: 8.5.0 ... 8.5.93 (78 versions)
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A …
CVE-2023-46589HIGHCVSS 7.5EG 7.5✓ Fixed in 8.5.96
2023-11-28
vulnerable: 8.5.0 ... 8.5.95 (80 versions)
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A t…
CVE-2024-21733MEDIUMCVSS 5.3EG 5.3✓ Fixed in 8.5.64
2024-01-19
vulnerable: 8.5.11 ... 8.5.9 (45 versions)
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are r…
CVE-2024-24549HIGHCVSS 7.5EG 7.5✓ Fixed in 11.0.0-M17
2024-03-13
vulnerable: 11.0.0-M1 ... 11.0.0-M9 (14 versions)
Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was no…
CVE-2024-34750HIGHCVSS 7.5EG 7.5
2024-07-03
vulnerable: 8.5.0 ... 8.5.99 (85 versions)
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscountin…
CVE-2024-50379CRITICALCVSS 9.8EG 9.8
2024-12-17
vulnerable: 8.5.0 ... 8.5.99 (85 versions)
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue …
CVE-2024-52317MEDIUMCVSS 6.5EG 6.5✓ Fixed in 11.0.0
2024-11-18
vulnerable: 11.0.0-M24, 11.0.0-M25, 11.0.0-M26
Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat:…
CVE-2024-56337CRITICALCVSS 9.8EG 9.8✓ Fixed in 9.0.98
2024-12-20
vulnerable: 9.0.0.M1 ... 9.0.97 (99 versions)
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were E…
CVE-2025-24813CRITICALCVSS 9.8EG 9.8⚠ KEV✓ Fixed in 11.0.3
2025-03-10
vulnerable: 11.0.0 ... 11.0.2 (26 versions)
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache…
CVE-2025-31650HIGHCVSS 7.5EG 7.5✓ Fixed in 9.0.104
2025-04-28
vulnerable: 9.0.100 ... 9.0.99 (24 versions)
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests co…
CVE-2025-31651CRITICALCVSS 9.8EG 9.8✓ Fixed in 9.0.104
2025-04-28
vulnerable: 9.0.100 ... 9.0.99 (24 versions)
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those r…
CVE-2025-46701HIGHCVSS 7.3EG 7.3✓ Fixed in 9.0.105
2025-05-29
vulnerable: 9.0.0.M1 ... 9.0.99 (104 versions)
Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apach…
CVE-2025-48989HIGHCVSS 7.5EG 7.5✓ Fixed in 9.0.108
2025-08-13
vulnerable: 9.0.0.M1 ... 9.0.99 (107 versions)
Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 th…
CVE-2025-49124HIGHCVSS 8.4EG 8.4✓ Fixed in 11.0.8
2025-06-16
vulnerable: 11.0.0 ... 11.0.7 (31 versions)
Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.…
CVE-2025-49125HIGHCVSS 7.5EG 7.5✓ Fixed in 11.0.8
2025-06-16
vulnerable: 11.0.0 ... 11.0.7 (31 versions)
Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an une…
CVE-2025-52520HIGHCVSS 7.5EG 7.5✓ Fixed in 11.0.9
2025-07-10
vulnerable: 11.0.0 ... 11.0.8 (32 versions)
For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 thr…

Check whether org.apache.tomcat.embed:tomcat-embed-core is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.apache.tomcat.embed:tomcat-embed-core CVEs against the assets you own.

Start Free Scan →