Debian Tomcat9 vulnerabilities

CVE-2020-13934 [HIGH] CVE-2020-13934: tomcat9 - An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.... An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service. Scope: local bookworm: resolved (fixed in 9.0.37-1) bullseye: resolved (fixe

CVE-2023-45648 [MEDIUM] CVE-2023-45648: tomcat10 - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 t... Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the poss

CVE-2025-48988 [HIGH] CVE-2025-48988: tomcat10 - Allocation of Resources Without Limits or Throttling vulnerability in Apache Tom... Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be

CVE-2021-33037 [MEDIUM] CVE-2021-33037: tomcat9 - Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did no... Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/

CVE-2025-48976 [HIGH] CVE-2025-48976: libcommons-fileupload-java - Allocation of resources for multipart headers with insufficient limits enabled a... Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue. Scope: local bookworm: open bullseye: r

CVE-2021-25122 [HIGH] CVE-2021-25122: tomcat9 - When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1... When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request. Scope: local bookworm: resolved (fixed in 9.0.43-1) bullseye: reso

CVE-2024-24549 [HIGH] CVE-2024-24549: tomcat10 - Denial of Service due to improper input validation vulnerability for HTTP/2 requ... Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, f

CVE-2020-17527 [HIGH] CVE-2020-17527: tomcat9 - While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to ... While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connect

CVE-2020-11996 [HIGH] CVE-2020-11996: tomcat9 - A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 ... A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive. Scope: local bookworm: resolved (fixed in 9.0.36-1) bullseye: r

CVE-2025-49125 [HIGH] CVE-2025-49125: tomcat10 - Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache... Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those secur

CVE-2016-3092 [HIGH] CVE-2016-3092: libcommons-fileupload-java - The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in ... The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string. Scope: local bookworm: resolved (fixed in 1.3.2-1) bulls

CVE-2022-25762 [HIGH] CVE-2022-25762: tomcat9 - If a web application sends a WebSocket message concurrently with the WebSocket c... If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the

CVE-2019-17563 [HIGH] CVE-2019-17563: tomcat9 - When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8... When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability. Scope: local boo

CVE-2025-46701 [HIGH] CVE-2025-46701: tomcat10 - Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servl... Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104. The following versions we

CVE-2025-48989 [HIGH] CVE-2025-48989: tomcat10 - Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat... Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or

CVE-2021-24122 [MEDIUM] CVE-2021-24122: tomcat9 - When serving resources from a network location using the NTFS file system, Apach... When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the i

CVE-2024-34750 [HIGH] CVE-2024-34750: tomcat10 - Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption v... Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain ope

CVE-2023-46589 [HIGH] CVE-2023-46589: tomcat10 - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 t... Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to t

CVE-2025-53506 [HIGH] CVE-2025-53506: tomcat10 - Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 cl... Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE

CVE-2021-30640 [MEDIUM] CVE-2021-30640: tomcat9 - A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authent... A vulnerability in the JNDI Realm of Apache Tomcat allows an attacker to authenticate using variations of a valid user name and/or to bypass some of the protection provided by the LockOut Realm. This issue affects Apache Tomcat 10.0.0-M1 to 10.0.5; 9.0.0.M1 to 9.0.45; 8.5.0 to 8.5.65. Scope: local bookworm: resolved (fixed in 9.0.43-2) bullseye: resolved (fixed in