{"kind": "product", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "name": "tomcat10", "product": "tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS", "items": [{"id": "CVE-2026-43515", "noindex": false, "published": "2026-05-12T15:33:23.311Z", "modified": "2026-06-04T09:57:54.826Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "critical", "epss": 0.01221, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-43515", "title": "Apache Tomcat: Security constraints not correctly applied", "description": "Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", "references": ["https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb", "http://www.openwall.com/lists/oss-security/2026/05/12/11", "https://nvd.nist.gov/vuln/detail/CVE-2026-43515"], "fixes": ["10.1.16-1ubuntu0.1~esm4"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2026-43513", "noindex": false, "published": "2026-05-12T15:26:25.599Z", "modified": "2026-05-14T19:53:30.781Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00503, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-43513", "title": "Apache Tomcat: LockOutRealm treats user names as case-sensitive", "description": "Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", "references": ["https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp", "http://www.openwall.com/lists/oss-security/2026/05/12/9", "https://nvd.nist.gov/vuln/detail/CVE-2026-43513"], "fixes": ["10.1.16-1ubuntu0.1~esm4"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2026-43512", "noindex": false, "published": "2026-05-12T15:24:02.424Z", "modified": "2026-05-14T19:53:34.555Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.01326, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-43512", "title": "Apache Tomcat: Digest authenticator will authenticate any unknown user", "description": "DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.\nOlder unsupported versions any also be affect\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.", "references": ["https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73", "http://www.openwall.com/lists/oss-security/2026/05/12/8", "https://nvd.nist.gov/vuln/detail/CVE-2026-43512"], "fixes": ["10.1.16-1ubuntu0.1~esm4"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2026-41293", "noindex": false, "published": "2026-05-12T15:19:35.179Z", "modified": "2026-09-17T18:37:24.561Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.01705, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-41293", "title": "Apache Tomcat: HTTP/2 request headers not validated", "description": "Improper Input Validation vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.\nOlder, end of support versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.", "references": ["https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r", "http://www.openwall.com/lists/oss-security/2026/05/12/13", "https://nvd.nist.gov/vuln/detail/CVE-2026-41293"], "fixes": ["10.1.16-1ubuntu0.1~esm4"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2026-42498", "noindex": false, "published": "2026-05-12T15:17:56.531Z", "modified": "2026-05-13T15:59:04.361Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "severity": "high", "epss": 0.00646, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-42498", "title": "Apache Tomcat: WebSocket authentication header exposure", "description": "Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.", "references": ["https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb", "http://www.openwall.com/lists/oss-security/2026/05/12/14", "https://nvd.nist.gov/vuln/detail/CVE-2026-42498"], "fixes": ["10.1.16-1ubuntu0.1~esm4"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2026-41284", "noindex": false, "published": "2026-05-12T15:14:45.278Z", "modified": "2026-05-13T15:57:45.607Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00839, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-41284", "title": "Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling", "description": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.\nOlder, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.", "references": ["https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc", "http://www.openwall.com/lists/oss-security/2026/05/12/12", "https://nvd.nist.gov/vuln/detail/CVE-2026-41284"], "fixes": ["10.1.16-1ubuntu0.1~esm4"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2025-46701", "noindex": false, "published": "2025-05-29T19:06:04.289Z", "modified": "2025-11-03T20:04:34.067Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "severity": "high", "epss": 0.03143, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-46701", "title": "Apache Tomcat: Security constraint bypass for CGI scripts", "description": "Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.6, from 10.1.0-M1 through 10.1.40, from 9.0.0.M1 through 9.0.104.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.7, 10.1.41 or 9.0.105, which fixes the issue.", "references": ["https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j", "http://www.openwall.com/lists/oss-security/2025/05/29/4", "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"], "fixes": ["10.1.16-1ubuntu0.1~esm3"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2025-31651", "noindex": false, "published": "2025-04-28T19:17:21.721Z", "modified": "2026-02-26T18:27:59.801Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.04263, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-31651", "title": "Apache Tomcat: Bypass of rules in Rewrite Valve", "description": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible \nfor a specially crafted request to bypass some rewrite rules. If those \nrewrite rules effectively enforced security constraints, those \nconstraints could be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommende", "references": ["https://lists.apache.org/list.html?announce@tomcat.apache.org", "http://www.openwall.com/lists/oss-security/2025/04/28/3", "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"], "fixes": ["10.1.16-1ubuntu0.1~esm3"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2025-31650", "noindex": false, "published": "2025-04-28T19:14:31.107Z", "modified": "2025-11-03T19:53:11.497Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.61322, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-31650", "title": "Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame", "description": "Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\n\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.", "references": ["https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826", "http://www.openwall.com/lists/oss-security/2025/04/28/2", "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"], "fixes": ["10.1.16-1ubuntu0.1~esm3"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2025-24813", "noindex": false, "published": "2025-03-10T16:44:03.715Z", "modified": "2025-10-29T11:49:44.413Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.99942, "kev": true, "exploits": ["exploitdb", "metasploit", "nuclei", "public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-24813", "title": "Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "description": "Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\n- wr", "references": ["https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq", "http://www.openwall.com/lists/oss-security/2025/03/10/5", "https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce"], "fixes": ["10.1.16-1ubuntu0.1~esm1"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2024-54677", "noindex": false, "published": "2024-12-17T12:35:50.948Z", "modified": "2025-11-03T19:32:11.848Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.01939, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-54677", "title": "Apache Tomcat: DoS in examples web application", "description": "Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.", "references": ["https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n", "http://www.openwall.com/lists/oss-security/2024/12/17/5", "http://www.openwall.com/lists/oss-security/2024/12/17/6"], "fixes": ["10.1.16-1ubuntu0.1~esm3"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2024-50379", "noindex": false, "published": "2024-12-17T12:34:54.827Z", "modified": "2025-11-03T20:45:15.148Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.31824, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-50379", "title": "Apache Tomcat: RCE due to TOCTOU issue in JSP compilation", "description": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.", "references": ["https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r", "http://www.openwall.com/lists/oss-security/2024/12/17/4", "http://www.openwall.com/lists/oss-security/2024/12/18/2"], "fixes": ["10.1.16-1ubuntu0.1~esm3"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2024-52317", "noindex": false, "published": "2024-11-18T11:36:51.963Z", "modified": "2025-01-24T20:03:10.485Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.02097, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-52317", "title": "Apache Tomcat: Request/response mix-up with HTTP/2", "description": "Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests \ncould lead to request and/or response mix-up between users.\n\nThis issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95.\n\nUsers are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.", "references": ["https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs", "http://www.openwall.com/lists/oss-security/2024/11/18/3", "https://security.netapp.com/advisory/ntap-20250124-0004/"], "fixes": ["10.1.16-1ubuntu0.1~esm3"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2024-52316", "noindex": false, "published": "2024-11-18T11:32:22.072Z", "modified": "2025-11-04T15:59:51.152Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.06246, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-52316", "title": "Apache Tomcat: Authentication bypass when using Jakarta Authentication API", "description": "Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95.\n\nThe following versions were EOL at the time the CVE was c", "references": ["https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928", "http://www.openwall.com/lists/oss-security/2024/11/18/2", "https://security.netapp.com/advisory/ntap-20250124-0003/"], "fixes": ["10.1.16-1ubuntu0.1~esm3"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2024-38286", "noindex": false, "published": "2024-11-07T07:37:32.224Z", "modified": "2025-11-03T20:38:04.247Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "severity": "high", "epss": 0.0169, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-38286", "title": "Apache Tomcat: Denial of Service", "description": "Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89.\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.\n\n\n\nApache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake proc", "references": ["https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s", "http://www.openwall.com/lists/oss-security/2024/09/23/2", "https://security.netapp.com/advisory/ntap-20241101-0010/"], "fixes": ["10.1.16-1ubuntu0.1~esm2"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2024-34750", "noindex": false, "published": "2024-07-03T19:32:34.695Z", "modified": "2025-11-03T19:29:53.932Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.04602, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-34750", "title": "Apache Tomcat: HTTP/2 excess header handling DoS", "description": "Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. ", "references": ["https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l", "https://security.netapp.com/advisory/ntap-20240816-0004/", "https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"], "fixes": ["10.1.16-1ubuntu0.1~esm2"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2024-23672", "noindex": false, "published": "2024-03-13T15:48:42.610Z", "modified": "2025-10-29T11:57:10.244Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.02313, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-23672", "title": "Apache Tomcat: WebSocket DoS with incomplete closing handshake", "description": "Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.", "references": ["https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f", "https://security.netapp.com/advisory/ntap-20240402-0002/", "https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html"], "fixes": ["10.1.16-1ubuntu0.1~esm2"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}, {"id": "CVE-2024-24549", "noindex": false, "published": "2024-03-13T15:46:53.085Z", "modified": "2025-10-29T11:56:23.336Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.23072, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-24549", "title": "Apache Tomcat: HTTP/2 header handling DoS", "description": "Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.", "references": ["https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg", "https://security.netapp.com/advisory/ntap-20240402-0002/", "https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html"], "fixes": ["10.1.16-1ubuntu0.1~esm2"], "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}]}], "total": 18, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "tomcat10", "path": "vulns/ubuntu-pro-24.04-lts/tomcat10", "ecosystem": "Ubuntu:Pro:24.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-17T18:37:24.561Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}