CVE-2024-38286 — Apache Tomcat: Denial of Service

Description

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89.

The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.

Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Tomcat	11.0.0-M1 – ≤ 11.0.0-M20, 10.1.0-M1 – ≤ 10.1.24, 9.0.13 – ≤ 9.0.89, 8.5.35 – ≤ 8.5.100, 7.0.92 – ≤ 7.0.109	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	tomcat10	10.1.25-1	—
Debian 14	tomcat9	9.0.70-2	—
Debian 13	tomcat10	10.1.25-1	—
Debian 13	tomcat9	9.0.70-2	—
Debian 12	tomcat10	10.1.34-0+deb12u1	DSA-5845-1
Debian 12	tomcat9	9.0.70-2	—
Debian 11	tomcat9	9.0.43-2~deb11u11	DLA-4017-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 25.10	tomcat9	9.0.70-2ubuntu3	—

Show 4 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 24.04 LTS	tomcat10	10.1.16-1ubuntu0.1~esm2	USN-7562-1
Ubuntu Pro 24.04 LTS	tomcat9	9.0.70-2ubuntu0.1+esm2	USN-7562-1
Ubuntu Pro 22.04 LTS	tomcat9	9.0.58-1ubuntu0.2+esm3	USN-7562-1
Ubuntu Pro 20.04 LTS	tomcat9	9.0.31-1ubuntu0.9+esm2	USN-7562-1
Ubuntu Pro 18.04 LTS	tomcat8	8.5.39-1ubuntu1~18.04.3+esm5	USN-7562-1
Ubuntu Pro 18.04 LTS	tomcat9	9.0.16-3ubuntu0.18.04.2+esm7	USN-7562-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	tomcat9 +7	1:9.0.110-2.el10_2	RHSA-2026:18536
RHEL 9	tomcat +7	1:9.0.87-1.el9_4.2	RHSA-2024:5693
RHEL 8	tomcat +7	1:9.0.87-1.el8_10.2	RHSA-2024:5694

Show 13 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 10.0 EUS	tomcat9 +7	1:9.0.120-1.el10_0	RHSA-2026:67163
RHEL 9.2 EUS	pki-servlet-engine +1	1:9.0.50-1.el9_2.1	RHSA-2024:8494
RHEL 9.2 EUS	tomcat +7	1:9.0.87-1.el9_2.2	RHSA-2024:5696
RHEL 9.0 EUS	pki-servlet-engine +1	1:9.0.43-4.el9_0.1	RHSA-2024:8528
RHEL 8.8 EUS	apache-commons-collections	3.2.2-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	apache-commons-lang	2.6-21.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	apache-commons-net	3.6-3.module+el8.3.0+6805+72837426	RHSA-2024:8543
RHEL 8.8 EUS	bea-stax +1	1.2.0-16.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	glassfish-fastinfoset	1.2.13-9.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	glassfish-jaxb +3	2.2.11-11.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	glassfish-jaxb-api	2.2.12-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	jackson-core +2	2.10.0-1.module+el8.2.0+5059+3eb3af25	RHSA-2024:8543
RHEL 8.8 EUS	jackson-jaxrs-providers +1	2.9.9-1.module+el8.1.0+3832+9784644d	RHSA-2024:8543
RHEL 8.8 EUS	jackson-module-jaxb-annotations	2.7.6-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	jakarta-commons-httpclient	1:3.1-28.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	javassist +1	3.18.1-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	jss +1	4.9.4-1.module+el8.7.0+15532+95bac9ee	RHSA-2024:8543
RHEL 8.8 EUS	ldapjdk +1	4.23.0-1.module+el8.5.0+11983+6ba118b4	RHSA-2024:8543
RHEL 8.8 EUS	pki-core +9	10.14.3-3.module+el8.8.0+22366+77f9de5e	RHSA-2024:8543
RHEL 8.8 EUS	pki-servlet-engine	1:9.0.62-1.module+el8.8.0+22367+4894538d	RHSA-2024:8543
RHEL 8.8 EUS	python-nss +2	1.0.1-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	relaxngDatatype	2011.1-7.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	resteasy	3.0.26-7.module+el8.8.0+22365+b433a336	RHSA-2024:8543
RHEL 8.8 EUS	slf4j +1	1.7.25-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	stax-ex	1.7.7-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8543
RHEL 8.8 EUS	tomcat +7	1:9.0.87-1.el8_8.3	RHSA-2024:5695
RHEL 8.8 EUS	tomcatjss	7.7.1-2.module+el8.8.0+22366+77f9de5e	RHSA-2024:8543
RHEL 8.8 EUS	velocity	1.7-24.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	xalan-j2	2.7.1-38.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	xerces-j2	2.11.0-34.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	xml-commons-apis	1.4.01-25.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	xml-commons-resolver	1.2-26.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.8 EUS	xmlstreambuffer	1.5.4-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8543
RHEL 8.8 EUS	xsom	0-19.20110809svn.module+el8.1.0+3366+6dfb954c	RHSA-2024:8543
RHEL 8.6 TUS	apache-commons-collections	3.2.2-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	apache-commons-lang	2.6-21.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	apache-commons-net	3.6-3.module+el8.3.0+6805+72837426	RHSA-2024:8572
RHEL 8.6 TUS	bea-stax +1	1.2.0-16.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	glassfish-fastinfoset	1.2.13-9.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	glassfish-jaxb +3	2.2.11-11.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	glassfish-jaxb-api	2.2.12-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	jackson-core +2	2.10.0-1.module+el8.2.0+5059+3eb3af25	RHSA-2024:8572
RHEL 8.6 TUS	jackson-jaxrs-providers +1	2.9.9-1.module+el8.1.0+3832+9784644d	RHSA-2024:8572
RHEL 8.6 TUS	jackson-module-jaxb-annotations	2.7.6-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	jakarta-commons-httpclient	1:3.1-28.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	javassist +1	3.18.1-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	pki-servlet-engine +1	1:9.0.30-3.module+el8.6.0+22385+e922a50e.1	RHSA-2024:8572
RHEL 8.6 TUS	python-nss +2	1.0.1-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	relaxngDatatype	2011.1-7.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	resteasy	3.0.26-6.module+el8.4.0+8891+bb8828ef	RHSA-2024:8572
RHEL 8.6 TUS	slf4j +1	1.7.25-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	stax-ex	1.7.7-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8572
RHEL 8.6 TUS	velocity	1.7-24.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	xalan-j2	2.7.1-38.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	xerces-j2	2.11.0-34.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	xml-commons-apis	1.4.01-25.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	xml-commons-resolver	1.2-26.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 TUS	xmlstreambuffer	1.5.4-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8572
RHEL 8.6 TUS	xsom	0-19.20110809svn.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	apache-commons-collections	3.2.2-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	apache-commons-lang	2.6-21.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	apache-commons-net	3.6-3.module+el8.3.0+6805+72837426	RHSA-2024:8572
RHEL 8.6 E4S	bea-stax +1	1.2.0-16.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	glassfish-fastinfoset	1.2.13-9.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	glassfish-jaxb +3	2.2.11-11.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	glassfish-jaxb-api	2.2.12-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	jackson-core +2	2.10.0-1.module+el8.2.0+5059+3eb3af25	RHSA-2024:8572
RHEL 8.6 E4S	jackson-jaxrs-providers +1	2.9.9-1.module+el8.1.0+3832+9784644d	RHSA-2024:8572
RHEL 8.6 E4S	jackson-module-jaxb-annotations	2.7.6-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	jakarta-commons-httpclient	1:3.1-28.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	javassist +1	3.18.1-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	pki-servlet-engine +1	1:9.0.30-3.module+el8.6.0+22385+e922a50e.1	RHSA-2024:8572
RHEL 8.6 E4S	python-nss +2	1.0.1-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	relaxngDatatype	2011.1-7.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	resteasy	3.0.26-6.module+el8.4.0+8891+bb8828ef	RHSA-2024:8572
RHEL 8.6 E4S	slf4j +1	1.7.25-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	stax-ex	1.7.7-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8572
RHEL 8.6 E4S	velocity	1.7-24.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	xalan-j2	2.7.1-38.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	xerces-j2	2.11.0-34.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	xml-commons-apis	1.4.01-25.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	xml-commons-resolver	1.2-26.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 E4S	xmlstreambuffer	1.5.4-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8572
RHEL 8.6 E4S	xsom	0-19.20110809svn.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	apache-commons-collections	3.2.2-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	apache-commons-lang	2.6-21.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	apache-commons-net	3.6-3.module+el8.3.0+6805+72837426	RHSA-2024:8572
RHEL 8.6 AUS	bea-stax +1	1.2.0-16.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	glassfish-fastinfoset	1.2.13-9.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	glassfish-jaxb +3	2.2.11-11.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	glassfish-jaxb-api	2.2.12-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	jackson-core +2	2.10.0-1.module+el8.2.0+5059+3eb3af25	RHSA-2024:8572
RHEL 8.6 AUS	jackson-jaxrs-providers +1	2.9.9-1.module+el8.1.0+3832+9784644d	RHSA-2024:8572
RHEL 8.6 AUS	jackson-module-jaxb-annotations	2.7.6-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	jakarta-commons-httpclient	1:3.1-28.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	javassist +1	3.18.1-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	pki-servlet-engine +1	1:9.0.30-3.module+el8.6.0+22385+e922a50e.1	RHSA-2024:8572
RHEL 8.6 AUS	python-nss +2	1.0.1-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	relaxngDatatype	2011.1-7.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	resteasy	3.0.26-6.module+el8.4.0+8891+bb8828ef	RHSA-2024:8572
RHEL 8.6 AUS	slf4j +1	1.7.25-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	stax-ex	1.7.7-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8572
RHEL 8.6 AUS	velocity	1.7-24.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	xalan-j2	2.7.1-38.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	xerces-j2	2.11.0-34.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	xml-commons-apis	1.4.01-25.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	xml-commons-resolver	1.2-26.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.6 AUS	xmlstreambuffer	1.5.4-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8572
RHEL 8.6 AUS	xsom	0-19.20110809svn.module+el8.1.0+3366+6dfb954c	RHSA-2024:8572
RHEL 8.4 TUS	apache-commons-collections	3.2.2-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	apache-commons-lang	2.6-21.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	apache-commons-net	3.6-3.module+el8.3.0+6805+72837426	RHSA-2024:8497
RHEL 8.4 TUS	bea-stax +1	1.2.0-16.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	glassfish-fastinfoset	1.2.13-9.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	glassfish-jaxb +3	2.2.11-11.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	glassfish-jaxb-api	2.2.12-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	jackson-core +2	2.10.0-1.module+el8.2.0+5059+3eb3af25	RHSA-2024:8497
RHEL 8.4 TUS	jackson-jaxrs-providers +1	2.9.9-1.module+el8.1.0+3832+9784644d	RHSA-2024:8497
RHEL 8.4 TUS	jackson-module-jaxb-annotations	2.7.6-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	jakarta-commons-httpclient	1:3.1-28.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	javassist +1	3.18.1-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	pki-servlet-engine +1	1:9.0.30-1.module+el8.4.0+22383+8a8bb077.1	RHSA-2024:8497
RHEL 8.4 TUS	python-nss +2	1.0.1-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	relaxngDatatype	2011.1-7.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	resteasy	3.0.26-6.module+el8.4.0+8891+bb8828ef	RHSA-2024:8497
RHEL 8.4 TUS	slf4j +1	1.7.25-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	stax-ex	1.7.7-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8497
RHEL 8.4 TUS	velocity	1.7-24.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	xalan-j2	2.7.1-38.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	xerces-j2	2.11.0-34.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	xml-commons-apis	1.4.01-25.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	xml-commons-resolver	1.2-26.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 TUS	xmlstreambuffer	1.5.4-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8497
RHEL 8.4 TUS	xsom	0-19.20110809svn.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	apache-commons-collections	3.2.2-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	apache-commons-lang	2.6-21.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	apache-commons-net	3.6-3.module+el8.3.0+6805+72837426	RHSA-2024:8497
RHEL 8.4 E4S	bea-stax +1	1.2.0-16.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	glassfish-fastinfoset	1.2.13-9.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	glassfish-jaxb +3	2.2.11-11.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	glassfish-jaxb-api	2.2.12-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	jackson-core +2	2.10.0-1.module+el8.2.0+5059+3eb3af25	RHSA-2024:8497
RHEL 8.4 E4S	jackson-jaxrs-providers +1	2.9.9-1.module+el8.1.0+3832+9784644d	RHSA-2024:8497
RHEL 8.4 E4S	jackson-module-jaxb-annotations	2.7.6-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	jakarta-commons-httpclient	1:3.1-28.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	javassist +1	3.18.1-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	pki-servlet-engine +1	1:9.0.30-1.module+el8.4.0+22383+8a8bb077.1	RHSA-2024:8497
RHEL 8.4 E4S	python-nss +2	1.0.1-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	relaxngDatatype	2011.1-7.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	resteasy	3.0.26-6.module+el8.4.0+8891+bb8828ef	RHSA-2024:8497
RHEL 8.4 E4S	slf4j +1	1.7.25-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	stax-ex	1.7.7-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8497
RHEL 8.4 E4S	velocity	1.7-24.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	xalan-j2	2.7.1-38.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	xerces-j2	2.11.0-34.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	xml-commons-apis	1.4.01-25.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	xml-commons-resolver	1.2-26.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 E4S	xmlstreambuffer	1.5.4-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8497
RHEL 8.4 E4S	xsom	0-19.20110809svn.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	apache-commons-collections	3.2.2-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	apache-commons-lang	2.6-21.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	apache-commons-net	3.6-3.module+el8.3.0+6805+72837426	RHSA-2024:8497
RHEL 8.4 AUS	bea-stax +1	1.2.0-16.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	glassfish-fastinfoset	1.2.13-9.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	glassfish-jaxb +3	2.2.11-11.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	glassfish-jaxb-api	2.2.12-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	jackson-core +2	2.10.0-1.module+el8.2.0+5059+3eb3af25	RHSA-2024:8497
RHEL 8.4 AUS	jackson-jaxrs-providers +1	2.9.9-1.module+el8.1.0+3832+9784644d	RHSA-2024:8497
RHEL 8.4 AUS	jackson-module-jaxb-annotations	2.7.6-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	jakarta-commons-httpclient	1:3.1-28.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	javassist +1	3.18.1-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	pki-servlet-engine +1	1:9.0.30-1.module+el8.4.0+22383+8a8bb077.1	RHSA-2024:8497
RHEL 8.4 AUS	python-nss +2	1.0.1-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	relaxngDatatype	2011.1-7.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	resteasy	3.0.26-6.module+el8.4.0+8891+bb8828ef	RHSA-2024:8497
RHEL 8.4 AUS	slf4j +1	1.7.25-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	stax-ex	1.7.7-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8497
RHEL 8.4 AUS	velocity	1.7-24.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	xalan-j2	2.7.1-38.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	xerces-j2	2.11.0-34.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	xml-commons-apis	1.4.01-25.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	xml-commons-resolver	1.2-26.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.4 AUS	xmlstreambuffer	1.5.4-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8497
RHEL 8.4 AUS	xsom	0-19.20110809svn.module+el8.1.0+3366+6dfb954c	RHSA-2024:8497
RHEL 8.2 AUS	apache-commons-collections	3.2.2-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	apache-commons-lang	2.6-21.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	bea-stax +1	1.2.0-16.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	glassfish-fastinfoset	1.2.13-9.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	glassfish-jaxb +3	2.2.11-11.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	glassfish-jaxb-api	2.2.12-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	jackson-core +2	2.10.0-1.module+el8.2.0+5059+3eb3af25	RHSA-2024:8567
RHEL 8.2 AUS	jackson-jaxrs-providers +1	2.9.9-1.module+el8.1.0+3832+9784644d	RHSA-2024:8567
RHEL 8.2 AUS	jackson-module-jaxb-annotations	2.7.6-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	jakarta-commons-httpclient	1:3.1-28.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	javassist +1	3.18.1-8.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	pki-servlet-engine +1	1:9.0.7-16.module+el8.2.0+22384+93cade87.1	RHSA-2024:8567
RHEL 8.2 AUS	python-nss +2	1.0.1-10.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	relaxngDatatype	2011.1-7.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	resteasy	3.0.26-3.module+el8.2.0+5723+4574fbff	RHSA-2024:8567
RHEL 8.2 AUS	slf4j +1	1.7.25-4.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	stax-ex	1.7.7-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8567
RHEL 8.2 AUS	velocity	1.7-24.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	xalan-j2	2.7.1-38.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	xerces-j2	2.11.0-34.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	xml-commons-apis	1.4.01-25.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	xml-commons-resolver	1.2-26.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
RHEL 8.2 AUS	xmlstreambuffer	1.5.4-8.module+el8.2.0+5723+4574fbff	RHSA-2024:8567
RHEL 8.2 AUS	xsom	0-19.20110809svn.module+el8.1.0+3366+6dfb954c	RHSA-2024:8567
Red Hat JBoss Web Server 6	jws6-tomcat +9	10.1.8-10.redhat_00018.1.el8jws	RHSA-2024:4976
Red Hat JBoss Web Server 5	jws5-tomcat +11	9.0.87-5.redhat_00005.1.el7jws	RHSA-2024:5024

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 12 SP5	tomcat	9.0.36-3.130.1	SUSE-SU-2026:1058-1, SUSE-SU-2024:3510-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 12 SP5	tomcat	9.0.36-3.130.1	SUSE-SU-2024:3510-1

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat:tomcat-coyote	>= 11.0.0-M1, < 11.0.0-M21	11.0.0-M21	GHSA-7jqf-v358-p8g7
Maven	org.apache.tomcat:tomcat-coyote	>= 10.1.0-M1, < 10.1.25	10.1.25	GHSA-7jqf-v358-p8g7
Maven	org.apache.tomcat:tomcat-coyote	>= 9.0.13, < 9.0.90	9.0.90	GHSA-7jqf-v358-p8g7
Maven	org.apache.tomcat:tomcat-coyote	>= 8.5.35, <= 8.5.100	—	GHSA-7jqf-v358-p8g7
Maven	org.apache.tomcat:tomcat-coyote	>= 7.0.92, <= 7.0.109	—	GHSA-7jqf-v358-p8g7
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 11.0.0-M1, < 11.0.0-M21	11.0.0-M21	GHSA-7jqf-v358-p8g7
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 10.1.0-M1, < 10.1.25	10.1.25	GHSA-7jqf-v358-p8g7
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 9.0.13, < 9.0.90	9.0.90	GHSA-7jqf-v358-p8g7
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 8.5.35, <= 8.5.100	—	GHSA-7jqf-v358-p8g7
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 7.0.92, <= 7.0.109	—	GHSA-7jqf-v358-p8g7

Advisories 25

RHSA-2026:67163 Red Hat Security Advisory: tomcat9 security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
RHSA-2026:18536 Red Hat Security Advisory: tomcat9 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
RHSA-2024:8572 Red Hat Security Advisory: pki-deps:10.6 security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
RHSA-2024:8543 Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
RHSA-2024:8567 Red Hat Security Advisory: pki-deps:10.6 security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
RHSA-2024:8528 Red Hat Security Advisory: pki-servlet-engine security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
RHSA-2024:8494 Red Hat Security Advisory: pki-servlet-engine security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
RHSA-2024:8497 Red Hat Security Advisory: pki-deps:10.6 security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
RHSA-2024:5696 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
RHSA-2024:5695 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
RHSA-2024:5693 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
RHSA-2024:5694 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
RHSA-2024:5024 Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.1 release and security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
RHSA-2024:4976 Red Hat Security Advisory: Red Hat JBoss Web Server 6.0.3 release and security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
USN-7562-1 tomcat vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
SUSE-SU-2026:1058-1 Security update for tomcat SUSE / openSUSE Security Updates · Mar 27, 2026
WID-SEC-2024-2202 Apache Tomcat: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Mar 26, 2026
WID-SEC-2026-0177 Atlassian Bamboo, Bitbucket, Confluence und Jira: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 18, 2026
DSA-5845-1 tomcat10 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-4017-1 tomcat9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
SUSE-SU-2024:3510-1 Security update for tomcat SUSE / openSUSE Security Updates · Feb 4, 2026
NCSC-2026-0034 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Jan 22, 2026
NCSC-2025-0076 Kwetsbaarheden verholpen in SAP software NCSC-NL (Netherlands) · Mar 11, 2025
WID-SEC-2025-0521 SAP Patchday März 2025: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 10, 2025
NCSC-2024-0466 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Dec 6, 2024

References

https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s vendor-advisory

CNA	v3.1	8.6
EUVD	v3.1	8.6
OSV:GHSA	v3.1	8.6