Apache Tomcat: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 4

• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• Medium 5.9
  CVE-2023-42794

  Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

  Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service o…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat-coyote Maven
  Oct 10, 2023
• Medium 5.3
  CVE-2023-42795

  Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

  Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomc…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  Oct 10, 2023
• Medium 5.3
  CVE-2023-45648 Scanner template

  Apache Tomcat: Trailer header parsing too lenient

  Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, in…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven
  Oct 10, 2023

Revision history

1. 2026-06-17 #45

   Neue Updates von Oracle Linux aufgenommen

2. 2026-03-26 #44

   Neue Updates von SUSE aufgenommen

3. 2026-03-23 #43

   Neue Updates von Dell aufgenommen

4. 2026-01-25 #42

   Neue Updates von Dell aufgenommen

5. 2025-06-09 #41

   Neue Updates von Ubuntu aufgenommen

6. 2025-04-28 #40

   Neue Updates von Ubuntu aufgenommen

7. 2025-04-07 #39

   Neue Updates von Ubuntu aufgenommen

8. 2025-04-01 #38

   Neue Updates von Amazon aufgenommen

9. 2025-01-19 #37

   Neue Updates von F5 aufgenommen

10. 2024-11-17 #36

    Neue Updates von Ubuntu aufgenommen

11. 2024-11-03 #35

    Neue Updates von BROCADE aufgenommen

12. 2024-08-05 #34

    Neue Updates von HITACHI aufgenommen

13. 2024-07-18 #33

    Neue Updates von Red Hat aufgenommen

14. 2024-07-01 #32

    Neue Updates von HITACHI aufgenommen

15. 2024-06-17 #31

    Neue Updates von IBM aufgenommen

16. 2024-05-01 #30

    Neue Updates von IBM aufgenommen

17. 2024-03-18 #29

    Neue Updates von Amazon aufgenommen

18. 2024-03-12 #28

    Neue Updates von Dell aufgenommen

19. 2024-02-14 #27

    Neue Updates von SUSE aufgenommen

20. 2024-01-29 #26

    Neue Updates von HITACHI aufgenommen

21. 2024-01-28 #25

    Neue Updates von Dell aufgenommen

22. 2024-01-25 #24

    Neue Updates von Red Hat und Oracle Linux aufgenommen

23. 2024-01-24 #23

    Neue Updates von IBM aufgenommen

24. 2024-01-15 #22

    Neue Updates von IBM aufgenommen

25. 2024-01-11 #21

    Neue Updates von Oracle Linux aufgenommen

References

• Apache Tomcat 8 Changelog vom 2023-10-10
  https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94
• Apache Tomcat 9 Changelog vom 2023-10-10
  https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81
• Debian Security Advisory DSA-5522 vom 2023-10-11
  https://www.debian.org/security/2023/dsa-5522
• Debian Security Advisory DSA-5521 vom 2023-10-11
  https://www.debian.org/security/2023/dsa-5521
• Debian Security Advisory DLA-3617 vom 2023-10-13
  https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
• Amazon Linux Security Advisory ALASTOMCAT8.5-2023-016 vom 2023-10-18
  https://alas.aws.amazon.com/AL2/ALASTOMCAT8.5-2023-016.html
• Amazon Linux Security Advisory ALASTOMCAT9-2023-010 vom 2023-10-18
  https://alas.aws.amazon.com/AL2/ALASTOMCAT9-2023-010.html
• GitHub Security Advisory GHSA-G8PJ-R55Q-5C2V vom 2023-10-18
  https://github.com/vaadin/platform/releases/tag/24.2.0
• SUSE Security Update SUSE-SU-2023:4129-1 vom 2023-10-19
  https://lists.suse.com/pipermail/sle-security-updates/2023-October/016747.html
• Red Hat Security Advisory RHSA-2023:5928 vom 2023-10-20
  https://access.redhat.com/errata/RHSA-2023:5928
• Red Hat Security Advisory RHSA-2023:5929 vom 2023-10-19
  https://access.redhat.com/errata/RHSA-2023:5929
• Red Hat Security Advisory RHSA-2023:5929 vom 2023-10-19
  https://access.redhat.com/errata/RHSA-2023:5929.html
• Amazon Linux Security Advisory ALAS-2023-1868 vom 2023-10-19
  https://alas.aws.amazon.com/ALAS-2023-1868.html
• Oracle Linux Security Advisory ELSA-2023-5929 vom 2023-10-24
  https://linux.oracle.com/errata/ELSA-2023-5929.html
• Oracle Linux Security Advisory ELSA-2023-5928 vom 2023-10-25
  http://linux.oracle.com/errata/ELSA-2023-5928.html
• Red Hat Security Advisory RHSA-2023:6145 vom 2023-10-27
  https://access.redhat.com/errata/RHSA-2023:6145
• Oracle Linux Security Advisory ELSA-2023-6120 vom 2023-10-27
  https://linux.oracle.com/errata/ELSA-2023-6120.html
• Red Hat Security Advisory RHSA-2023:6207 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6207
• Red Hat Security Advisory RHSA-2023:6206 vom 2023-10-31
  https://access.redhat.com/errata/RHSA-2023:6206
• SUSE Security Update SUSE-SU-2023:4337-1 vom 2023-11-02
  https://lists.suse.com/pipermail/sle-security-updates/2023-November/016986.html
• SUSE Security Update SUSE-SU-2023:4423-1 vom 2023-11-13
  https://lists.suse.com/pipermail/sle-security-updates/2023-November/017018.html
• Camunda Security Notice 97 vom 2023-11-13
  https://docs.camunda.org/security/notices/
• IBM Security Bulletin 7072626 vom 2023-11-14
  https://www.ibm.com/support/pages/node/7072626
• Red Hat Security Advisory RHSA-2023:7247 vom 2023-11-16
  https://access.redhat.com/errata/RHSA-2023:7247
• IBM Security Bulletin 7076274 vom 2023-11-15
  https://www.ibm.com/support/pages/node/7076274
• IBM Security Bulletin
  https://www.ibm.com/support/pages/node/7082717
• Xerox Security Bulletin XRX23-021
  https://securitydocs.business.xerox.com/wp-content/uploads/2023/11/XRX23-021_FFPSv2_Win10_SecurityBulletin_Nov2023.pdf
• Red Hat Security Advisory RHSA-2023:7623 vom 2023-12-07
  https://access.redhat.com/errata/RHSA-2023:7623
• Red Hat Security Advisory RHSA-2023:7625 vom 2023-12-07
  https://access.redhat.com/errata/RHSA-2023:7625
• Red Hat Security Advisory RHSA-2023:7626 vom 2023-12-07
  https://access.redhat.com/errata/RHSA-2023:7626
• IBM Security Bulletin 7099297 vom 2023-12-18
  https://www.ibm.com/support/pages/node/7099297
• IBM Security Bulletin 7105133 vom 2024-01-05
  http://www.ibm.com/support/pages/node/7105133
• Red Hat Security Advisory RHSA-2024:0125 vom 2024-01-10
  https://access.redhat.com/errata/RHSA-2024:0125
• Oracle Linux Security Advisory ELSA-2024-0125 vom 2024-01-11
  https://linux.oracle.com/errata/ELSA-2024-0125.html
• IBM Security Bulletin 7107757 vom 2024-01-16
  https://www.ibm.com/support/pages/node/7107757
• IBM Security Bulletin 7107755 vom 2024-01-16
  https://www.ibm.com/support/pages/node/7107755
• IBM Security Bulletin 7111624 vom 2024-01-24
  https://www.ibm.com/support/pages/node/7111624
• Red Hat Security Advisory RHSA-2024:0474 vom 2024-01-25
  https://access.redhat.com/errata/RHSA-2024:0474
• Oracle Linux Security Advisory ELSA-2024-0474 vom 2024-01-25
  https://linux.oracle.com/errata/ELSA-2024-0474.html
• DELL Security Update
  https://www.dell.com/support/kbdoc/de-de/000221476/dsa-2024-058-security-update-for-dell-networker-vproxy-multiple-components-vulnerabilities
• Hitachi Vulnerability Information HITACHI-SEC-2024-107 vom 2024-01-30
  https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-107/index.html
• SUSE Security Update SUSE-SU-2024:0472-1 vom 2024-02-14
  https://lists.suse.com/pipermail/sle-security-updates/2024-February/017913.html
• Dell Security Advisory DSA-2024-133 vom 2024-03-12
  https://www.dell.com/support/kbdoc/000223002/dsa-2024-=
• Amazon Linux Security Advisory ALASTOMCAT9-2024-012 vom 2024-03-19
  https://alas.aws.amazon.com/AL2/ALASTOMCAT9-2024-012.html
• Amazon Linux Security Advisory ALAS-2024-2501 vom 2024-03-19
  https://alas.aws.amazon.com/AL2/ALAS-2024-2501.html
• IBM Security Bulletin 7114769 vom 2024-04-30
  https://www.ibm.com/support/pages/node/7114769
• IBM Security Bulletin 7156539 vom 2024-06-18
  https://www.ibm.com/support/pages/node/7156539
• Hitachi Vulnerability Information HITACHI-SEC-2024-134 vom 2024-07-02
  https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-134/index.html
• Red Hat Security Advisory RHSA-2024:4631 vom 2024-07-18
  https://access.redhat.com/errata/RHSA-2024:4631
• Hitachi Vulnerability Information HITACHI-SEC-2024-126 vom 2024-08-06
  https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-126/index.html
• Brocade Security Advisory BSA-2024-2429 vom 2024-11-02
  https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25158
• Ubuntu Security Notice USN-7106-1 vom 2024-11-18
  https://ubuntu.com/security/notices/USN-7106-1
• F5 Security Advisory K000138178 vom 2025-01-17
  https://my.f5.com/manage/s/article/K000138178
• Amazon Linux Security Advisory ALAS-2025-2812 vom 2025-04-02
  https://alas.aws.amazon.com/AL2/ALAS-2025-2812.html
• Ubuntu Security Notice USN-7410-1 vom 2025-04-07
  https://ubuntu.com/security/notices/USN-7410-1
• Ubuntu Security Notice USN-7469-1 vom 2025-04-28
  https://ubuntu.com/security/notices/USN-7469-1
• Ubuntu Security Notice USN-7469-2 vom 2025-04-28
  https://ubuntu.com/security/notices/USN-7469-2
• Ubuntu Security Notice USN-7562-1 vom 2025-06-10
  https://ubuntu.com/security/notices/USN-7562-1
• Deell Security Update
  https://www.dell.com/support/kbdoc/en-us/000281732/dsa-2025-075-security-update-for-dell-data-protection-advisor-for-multiple-component-vulnerabilities
• Dell Security Advisory DSA-2026-152 vom 2026-03-23
  https://www.dell.com/support/kbdoc/de-de/000443243/dsa-2026-152-dell-secure-connect-gateway-security-update-for-multiple-third-party-component-vulnerabilities
• SUSE Security Update SUSE-SU-2026:1058-1 vom 2026-03-26
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024949.html
• Oracle Linux Security Advisory ELSA-2026-25090 vom 2026-06-17
  https://linux.oracle.com/errata/ELSA-2026-25090.html