Skip to content
OpenAdvisories

Package · Maven

org.apache.tomcat:tomcat-util

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • Critical 9.1
    CVE-2026-53434

    Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector

    Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users ar…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven
  • Medium 5.3
    CVE-2023-42795

    Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

    Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomc…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven
  • High 7.5
    CVE-2022-45143

    Apache Tomcat: JsonErrorReportValve escaping

    The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to s…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat9 Debian Ubuntu Maven
  • High 7.5
    CVE-2016-8745 EPSS 16%

    Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat

    A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processo…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • Medium —
    CVE-2014-0099

    Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat

    Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Conte…

    org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-util Ubuntu Maven