org.apache.tomcat:tomcat-coyote (Maven)
Advisories
103
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 11.0.25 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.apache.tomcat</groupId><artifactId>tomcat-coyote</artifactId><version>11.0.25</version></dependency>gradle
implementation("org.apache.tomcat:tomcat-coyote:11.0.25")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-f525-44xv-f2qj Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation |
Critical EPSS 0.75% |
>= 9.0.115, < 9.0.121 | 9.0.121 |
| GHSA-f525-44xv-f2qj Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation |
Critical EPSS 0.75% |
>= 11.0.20, < 11.0.25 | 11.0.25 |
| GHSA-f525-44xv-f2qj Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation |
Critical EPSS 0.75% |
>= 10.1.53, < 10.1.59 | 10.1.59 |
| GHSA-r29c-68gh-xp6x Apache Tomcat - HTTP/2 request headers not validated |
Critical EPSS 1.70% |
>= 8.5.0, < 9.0.118 | 9.0.118 |
| GHSA-r29c-68gh-xp6x Apache Tomcat - HTTP/2 request headers not validated |
Critical EPSS 1.70% |
>= 11.0.0-M1, < 11.0.22 | 11.0.22 |
| GHSA-r29c-68gh-xp6x Apache Tomcat - HTTP/2 request headers not validated |
Critical EPSS 1.70% |
>= 10.1.0-M1, < 10.1.55 | 10.1.55 |
| GHSA-8mc5-53m5-3qj2 Apache Tomcat has an Improper Input Validation vulnerability |
Medium EPSS 0.31% |
>= 11.0.15, < 11.0.20 | 11.0.20 |
| GHSA-8mc5-53m5-3qj2 Apache Tomcat has an Improper Input Validation vulnerability |
Medium EPSS 0.31% |
>= 9.0.113, < 9.0.116 | 9.0.116 |
| GHSA-8mc5-53m5-3qj2 Apache Tomcat has an Improper Input Validation vulnerability |
Medium EPSS 0.31% |
>= 10.1.50, < 10.1.53 | 10.1.53 |
| GHSA-69cc-cv78-qc8g Apache Tomcat: Configured cipher preference order not preserved |
High EPSS 0.26% |
>= 9.0.114, < 9.0.116 | 9.0.116 |
| GHSA-69cc-cv78-qc8g Apache Tomcat: Configured cipher preference order not preserved |
High EPSS 0.26% |
>= 11.0.16, < 11.0.20 | 11.0.20 |
| GHSA-69cc-cv78-qc8g Apache Tomcat: Configured cipher preference order not preserved |
High EPSS 0.26% |
>= 10.1.51, < 10.1.53 | 10.1.53 |
| GHSA-563x-q5rq-57qp Apache Tomcat has an HTTP Request/Response Smuggling vulnerability |
High EPSS 0.70% |
>= 11.0.0-M1, < 11.0.20 | 11.0.20 |
| GHSA-563x-q5rq-57qp Apache Tomcat has an HTTP Request/Response Smuggling vulnerability |
High EPSS 0.70% |
>= 7.0.0, < 9.0.116 | 9.0.116 |
| GHSA-563x-q5rq-57qp Apache Tomcat has an HTTP Request/Response Smuggling vulnerability |
High EPSS 0.70% |
>= 10.1.0-M1, < 10.1.52 | 10.1.52 |
| GHSA-mgp5-rv84-w37q Apache Tomcat has an Improper Input Validation vulnerability |
High EPSS 0.57% |
>= 9.0.83, < 9.0.115 | 9.0.115 |
| GHSA-mgp5-rv84-w37q Apache Tomcat has an Improper Input Validation vulnerability |
High EPSS 0.57% |
>= 10.1.0-M7, < 10.1.52 | 10.1.52 |
| GHSA-mgp5-rv84-w37q Apache Tomcat has an Improper Input Validation vulnerability |
High EPSS 0.57% |
>= 11.0.0-M1, < 11.0.18 | 11.0.18 |
| GHSA-qq5r-98hh-rxc9 Apache Tomcat - Security constraint bypass with HTTP/0.9 |
Low EPSS 0.55% |
< 9.0.113 | 9.0.113 |
| GHSA-qq5r-98hh-rxc9 Apache Tomcat - Security constraint bypass with HTTP/0.9 |
Low EPSS 0.55% |
>= 11.0.0-M1, < 11.0.15 | 11.0.15 |
| GHSA-qq5r-98hh-rxc9 Apache Tomcat - Security constraint bypass with HTTP/0.9 |
Low EPSS 0.55% |
>= 10.1.0-M1, < 10.1.50 | 10.1.50 |
| GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass |
Critical EPSS 0.27% |
>= 11.0.0-M1, < 11.0.15 | 11.0.15 |
| GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass |
Critical EPSS 0.27% |
>= 10.1.0-M1, < 10.1.50 | 10.1.50 |
| GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass |
Critical EPSS 0.27% |
>= 9.0.0-M1, < 9.0.113 | 9.0.113 |
| GHSA-fpj8-gq4v-p354 Apache Tomcat - Client certificate verification bypass |
Critical EPSS 0.27% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-gqp3-2cvr-x8m3 Apache Tomcat Improper Resource Shutdown or Release vulnerability |
High EPSS 3.69% |
>= 11.0.0-M1, < 11.0.10 | 11.0.10 |
| GHSA-gqp3-2cvr-x8m3 Apache Tomcat Improper Resource Shutdown or Release vulnerability |
High EPSS 3.69% |
>= 10.1.0-M1, < 10.1.44 | 10.1.44 |
| GHSA-gqp3-2cvr-x8m3 Apache Tomcat Improper Resource Shutdown or Release vulnerability |
High EPSS 3.69% |
>= 9.0.0.M1, < 9.0.108 | 9.0.108 |
| GHSA-25xr-qj8w-c4vf Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams |
High EPSS 2.13% |
>= 11.0.0-M1, < 11.0.9 | 11.0.9 |
| GHSA-25xr-qj8w-c4vf Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams |
High EPSS 2.13% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-25xr-qj8w-c4vf Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams |
High EPSS 2.13% |
>= 9.0.0.M1, < 9.0.107 | 9.0.107 |
| GHSA-25xr-qj8w-c4vf Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams |
High EPSS 2.13% |
>= 10.1.0-M1, < 10.1.43 | 10.1.43 |
| GHSA-4j3c-42xv-3f84 Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector |
High EPSS 2.07% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-4j3c-42xv-3f84 Apache Tomcat is vulnerable to resource exhaustion when using the APR/Native connector |
High EPSS 2.07% |
>= 9.0.0.M1, < 9.0.107 | 9.0.107 |
| GHSA-3p2h-wqq4-wf4h Apache Tomcat Denial of Service via invalid HTTP priority header |
High EPSS 61.32% |
>= 9.0.76, < 9.0.104 | 9.0.104 |
| GHSA-3p2h-wqq4-wf4h Apache Tomcat Denial of Service via invalid HTTP priority header |
High EPSS 61.32% |
>= 10.1.10, < 10.1.40 | 10.1.40 |
| GHSA-3p2h-wqq4-wf4h Apache Tomcat Denial of Service via invalid HTTP priority header |
High EPSS 61.32% |
>= 11.0.0-M2, < 11.0.6 | 11.0.6 |
| GHSA-3p2h-wqq4-wf4h Apache Tomcat Denial of Service via invalid HTTP priority header |
High EPSS 61.32% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-qvf5-hvjx-wm27 Apache Tomcat Request and/or response mix-up |
Medium EPSS 2.10% |
>= 11.0.0-M23, < 11.0.0 | 11.0.0 |
| GHSA-qvf5-hvjx-wm27 Apache Tomcat Request and/or response mix-up |
Medium EPSS 2.10% |
>= 9.0.92, < 9.0.96 | 9.0.96 |
| GHSA-qvf5-hvjx-wm27 Apache Tomcat Request and/or response mix-up |
Medium EPSS 2.10% |
>= 10.1.27, < 10.1.31 | 10.1.31 |
| GHSA-7jqf-v358-p8g7 Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability |
High EPSS 1.69% |
>= 8.5.35, <= 8.5.100 | No fix yet |
| GHSA-7jqf-v358-p8g7 Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability |
High EPSS 1.69% |
>= 7.0.92, <= 7.0.109 | No fix yet |
| GHSA-7jqf-v358-p8g7 Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability |
High EPSS 1.69% |
>= 11.0.0-M1, < 11.0.0-M21 | 11.0.0-M21 |
| GHSA-7jqf-v358-p8g7 Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability |
High EPSS 1.69% |
>= 10.1.0-M1, < 10.1.25 | 10.1.25 |
| GHSA-7jqf-v358-p8g7 Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability |
High EPSS 1.69% |
>= 9.0.13, < 9.0.90 | 9.0.90 |
| GHSA-wm9w-rjj3-j356 Apache Tomcat - Denial of Service |
High EPSS 4.60% |
>= 10.1.0-M1, < 10.1.25 | 10.1.25 |
| GHSA-wm9w-rjj3-j356 Apache Tomcat - Denial of Service |
High EPSS 4.60% |
>= 8.5.0, <= 8.5.100 | No fix yet |
| GHSA-wm9w-rjj3-j356 Apache Tomcat - Denial of Service |
High EPSS 4.60% |
>= 11.0.0-M1, < 11.0.0-M21 | 11.0.0-M21 |
| GHSA-wm9w-rjj3-j356 Apache Tomcat - Denial of Service |
High EPSS 4.60% |
>= 9.0.0-M1, < 9.0.90 | 9.0.90 |
| GHSA-7w75-32cg-r6g2 Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests |
High EPSS 23.07% |
>= 11.0.0-M1, < 11.0.0-M17 | 11.0.0-M17 |
| GHSA-7w75-32cg-r6g2 Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests |
High EPSS 23.07% |
>= 8.5.0, < 8.5.99 | 8.5.99 |
| GHSA-7w75-32cg-r6g2 Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests |
High EPSS 23.07% |
>= 9.0.0-M1, < 9.0.86 | 9.0.86 |
| GHSA-7w75-32cg-r6g2 Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests |
High EPSS 23.07% |
>= 10.1.0-M1, < 10.1.19 | 10.1.19 |
| GHSA-f4qf-m5gf-8jm8 Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information |
Medium EPSS 14.29% |
>= 8.5.7, < 8.5.64 | 8.5.64 |
| GHSA-f4qf-m5gf-8jm8 Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information |
Medium EPSS 14.29% |
>= 9.0.0-M11, < 9.0.44 | 9.0.44 |
| GHSA-fccv-jmmp-qg76 Apache Tomcat Improper Input Validation vulnerability |
High EPSS 2.65% |
>= 11.0.0-M1, < 11.0.0-M11 | 11.0.0-M11 |
| GHSA-r6j3-px5g-cq3x Apache Tomcat Improper Input Validation vulnerability |
Medium EPSS 5.88% |
>= 11.0.0-M1, < 11.0.0-M12 | 11.0.0-M12 |
| GHSA-r6j3-px5g-cq3x Apache Tomcat Improper Input Validation vulnerability |
Medium EPSS 5.88% |
>= 10.1.0-M1, < 10.1.14 | 10.1.14 |
| GHSA-r6j3-px5g-cq3x Apache Tomcat Improper Input Validation vulnerability |
Medium EPSS 5.88% |
>= 8.5.0, < 8.5.94 | 8.5.94 |
| GHSA-r6j3-px5g-cq3x Apache Tomcat Improper Input Validation vulnerability |
Medium EPSS 5.88% |
>= 9.0.0-M1, < 9.0.81 | 9.0.81 |
| GHSA-jm7m-8jh6-29hp Apache Tomcat Incomplete Cleanup vulnerability |
Medium EPSS 2.30% |
>= 9.0.70, < 9.0.81 | 9.0.81 |
| GHSA-jm7m-8jh6-29hp Apache Tomcat Incomplete Cleanup vulnerability |
Medium EPSS 2.30% |
>= 8.5.85, < 8.5.94 | 8.5.94 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 9.0.0, < 9.0.81 | 9.0.81 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 11.0.0-M1, < 11.0.0-M12 | 11.0.0-M12 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 8.5.0, < 8.5.94 | 8.5.94 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 11.0.0-M1, < 11.0.0-M12 | 11.0.0-M12 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 10.0.0, < 10.1.14 | 10.1.14 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 9.0.0, < 9.0.81 | 9.0.81 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 8.5.0, < 8.5.94 | 8.5.94 |
| GHSA-qppj-fm5r-hxr3 HTTP/2 Stream Cancellation Attack Known exploited |
Medium EPSS 100.00% |
>= 10.0.0, < 10.1.14 | 10.1.14 |
| GHSA-mppv-79ch-vw6q Apache Tomcat vulnerable to information leak |
High EPSS 1.12% |
>= 8.5.88, < 8.5.89 | 8.5.89 |
| GHSA-cx6h-86xw-9x34 Apache Tomcat - Fix for CVE-2023-24998 was incomplete |
High EPSS 48.03% |
>= 8.5.85, < 8.5.88 | 8.5.88 |
| GHSA-hfrx-6qgj-fp6c Apache Commons FileUpload denial of service vulnerability |
High EPSS 48.79% |
>= 8.5.85, < 8.5.88 | 8.5.88 |
| GHSA-hfrx-6qgj-fp6c Apache Commons FileUpload denial of service vulnerability |
High EPSS 48.79% |
>= 9.0.0-M1, < 9.0.71 | 9.0.71 |
| GHSA-hfrx-6qgj-fp6c Apache Commons FileUpload denial of service vulnerability |
High EPSS 48.79% |
>= 11.0.0-M2, < 11.0.0-M5 | 11.0.0-M5 |
| GHSA-hfrx-6qgj-fp6c Apache Commons FileUpload denial of service vulnerability |
High EPSS 48.79% |
>= 10.1.0-M1, < 10.1.5 | 10.1.5 |
| GHSA-p22x-g9px-3945 Apache Tomcat may reject request containing invalid Content-Length header |
High EPSS 1.78% |
>= 9.0.0-M1, < 9.0.68 | 9.0.68 |
| GHSA-p22x-g9px-3945 Apache Tomcat may reject request containing invalid Content-Length header |
High EPSS 1.78% |
>= 10.1.0-M1, < 10.1.1 | 10.1.1 |
| GHSA-p22x-g9px-3945 Apache Tomcat may reject request containing invalid Content-Length header |
High EPSS 1.78% |
>= 10.0.0-M1, < 10.0.27 | 10.0.27 |
| GHSA-wf5v-jhxj-q632 Denial of service in Apache Tomcat |
Medium EPSS 8.49% |
>= 8.0.0-RC1, < 8.0.4 | 8.0.4 |
| GHSA-475f-74wp-pqv5 Integer Overflow or Wraparound in Apache Tomcat |
Medium EPSS 17.58% |
>= 7.0.0, < 7.0.53 | 7.0.53 |
| GHSA-475f-74wp-pqv5 Integer Overflow or Wraparound in Apache Tomcat |
Medium EPSS 17.58% |
>= 8.0.0, < 8.0.4 | 8.0.4 |
| GHSA-475f-74wp-pqv5 Integer Overflow or Wraparound in Apache Tomcat |
Medium EPSS 17.58% |
< 6.0.40 | 6.0.40 |
| GHSA-9hg2-395j-83rm Expected Behavior Violation in Apache Tomcat |
Critical EPSS 7.75% |
>= 8.5.0, < 8.5.13 | 8.5.13 |
| GHSA-9hg2-395j-83rm Expected Behavior Violation in Apache Tomcat |
Critical EPSS 7.75% |
>= 9.0.0.M1, < 9.0.0.M19 | 9.0.0.M19 |
| GHSA-jc7p-5r39-9477 Improper Input Validation in Apache Tomcat |
High EPSS 39.63% |
>= 7.0.0, < 7.0.73 | 7.0.73 |
| GHSA-jc7p-5r39-9477 Improper Input Validation in Apache Tomcat |
High EPSS 39.63% |
>= 6.0.0, < 6.0.48 | 6.0.48 |
| GHSA-jc7p-5r39-9477 Improper Input Validation in Apache Tomcat |
High EPSS 39.63% |
>= 8.0.0RC1, < 8.0.39 | 8.0.39 |
| GHSA-jc7p-5r39-9477 Improper Input Validation in Apache Tomcat |
High EPSS 39.63% |
>= 9.0.0.M1, < 9.0.0.M12 | 9.0.0.M12 |
| GHSA-jc7p-5r39-9477 Improper Input Validation in Apache Tomcat |
High EPSS 39.63% |
>= 8.5.0, < 8.5.8 | 8.5.8 |
| GHSA-f268-65qc-98vg Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 52.64% |
>= 9.0.0-M1, < 9.0.38 | 9.0.38 |
| GHSA-f268-65qc-98vg Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 52.64% |
>= 8.5.0, < 8.5.58 | 8.5.58 |
| GHSA-f268-65qc-98vg Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
Medium EPSS 52.64% |
>= 10.0.0-M1, < 10.0.0-M8 | 10.0.0-M8 |
| GHSA-vvw4-rfwf-p6hx Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
High EPSS 24.62% |
>= 9.0.0-M1, < 9.0.40 | 9.0.40 |
| GHSA-vvw4-rfwf-p6hx Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
High EPSS 24.62% |
>= 10.0.0-M1, < 10.0.0-M10 | 10.0.0-M10 |
| GHSA-vvw4-rfwf-p6hx Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
High EPSS 24.62% |
>= 8.5.0, < 8.5.60 | 8.5.60 |
| GHSA-vf77-8h7g-gghp Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat |
High EPSS 64.12% |
>= 10.0.0-M1, < 10.0.0-M6 | 10.0.0-M6 |
| GHSA-vf77-8h7g-gghp Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat |
High EPSS 64.12% |
>= 8.5.1, < 8.5.56 | 8.5.56 |
| GHSA-vf77-8h7g-gghp Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat |
High EPSS 64.12% |
>= 9.0.0.M5, < 9.0.36 | 9.0.36 |
| GHSA-j39c-c8hj-x4j3 Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat |
High EPSS 18.11% |
>= 10.0.0-M1, < 10.0.2 | 10.0.2 |
| GHSA-qcxh-w3j9-58qr Apache Tomcat Denial of Service vulnerability |
High EPSS 72.86% |
>= 9.0.0, < 9.0.16 | 9.0.16 |
| GHSA-qcxh-w3j9-58qr Apache Tomcat Denial of Service vulnerability |
High EPSS 72.86% |
>= 8.0.0, < 8.5.38 | 8.5.38 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor