Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.tomcat:tomcat-coyote

34 known vulnerabilities (2 critical, 16 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
11.0.27 (Oct 6, 2026): no advisory affects it
Newest unaffected release
11.0.27 (Oct 6, 2026), the latest release
Advisories
34 · 2 critical, 16 high, 5 medium, 1 low
Dependents
30
Releases
473 since 7.0.0 (Jul 12, 2010)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-65637
    Affects 9.0.115 to 9.0.120 (9.0.121 is outside it); 10.1.53 to 10.1.57 (10.1.59 is outside it); 11.0.20 to 11.0.24 (11.0.25 is outside it)
  • CVE-2026-41293
    Affects 8.5.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it)
  • CVE-2026-32990
    Affects 9.0.113 to 9.0.115 (9.0.116 is outside it); 10.1.50 to 10.1.52 (10.1.53 is outside it); 11.0.15 to 11.0.18 (11.0.20 is outside it)
  • CVE-2026-29129
    Affects 9.0.115 (9.0.116 is outside it); 10.1.52 (10.1.53 is outside it); 11.0.18 (11.0.20 is outside it)
  • CVE-2026-24880
    Affects 7.0.0 to 9.0.115 (9.0.116 is outside it); 10.1.0-M1 to 10.1.50 (10.1.52 is outside it); 11.0.0-M1 to 11.0.18 (11.0.20 is outside it)
  • CVE-2026-24734
    Affects 9.0.83 to 9.0.113 (9.0.115 is outside it); 10.1.0-M7 to 10.1.50 (10.1.52 is outside it); 11.0.0-M1 to 11.0.15 (11.0.18 is outside it)
  • CVE-2026-24733
    Affects 7.0.0 to 9.0.112 (9.0.113 is outside it); 10.1.0-M1 to 10.1.49 (10.1.50 is outside it); 11.0.0-M1 to 11.0.14 (11.0.15 is outside it)
  • CVE-2025-66614
    Affects 8.5.0 to 9.0.112 (9.0.113 is outside it); 10.1.0-M1 to 10.1.49 (10.1.50 is outside it); 11.0.0-M1 to 11.0.14 (11.0.15 is outside it)
  • CVE-2025-48989
    Affects 9.0.0.M1 to 9.0.107 (9.0.108 is outside it); 10.1.0-M1 to 10.1.43 (10.1.44 is outside it); 11.0.0-M1 to 11.0.9 (11.0.10 is outside it)
  • CVE-2025-53506
    Affects 8.5.0 to 9.0.106 (9.0.107 is outside it); 10.1.0-M1 to 10.1.42 (10.1.43 is outside it); 11.0.0-M1 to 11.0.8 (11.0.9 is outside it)
  • CVE-2025-52434
    Affects 8.5.0 to 9.0.106 (9.0.107 is outside it)
  • CVE-2025-31650
    Affects 8.5.0 to 8.5.100 (9.0.0.M1 is outside it); 9.0.76 to 9.0.102 (9.0.104 is outside it); 10.1.10 to 10.1.39 (10.1.40 is outside it); 11.0.0-M3 to 11.0.5 (11.0.6 is outside it)
Show all 34 advisoriesShow fewer advisories
  • CVE-2024-52317
    Affects 9.0.93 to 9.0.95 (9.0.96 is outside it); 10.1.28 to 10.1.30 (10.1.31 is outside it); 11.0.0-M24 to 11.0.0-M26 (11.0.0 is outside it)
  • CVE-2024-38286
    Affects 7.0.92 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.35 to 8.5.100 (9.0.0.M1 is outside it); 9.0.13 to 9.0.89 (9.0.90 is outside it); 10.1.0-M1 to 10.1.24 (10.1.25 is outside it); 11.0.0-M1 to 11.0.0-M20 (11.0.0-M21 is outside it)
  • CVE-2024-34750
    Affects 8.5.0 to 9.0.89 (9.0.90 is outside it); 10.1.0-M1 to 10.1.24 (10.1.25 is outside it); 11.0.0-M1 to 11.0.0-M20 (11.0.0-M21 is outside it)
  • CVE-2024-24549
    Affects 8.5.0 to 8.5.98 (8.5.99 is outside it); 9.0.0.M1 to 9.0.85 (9.0.86 is outside it); 10.1.0-M1 to 10.1.18 (10.1.19 is outside it); 11.0.0-M1 to 11.0.0-M16 (11.0.0-M17 is outside it)
  • CVE-2024-21733
    Affects 8.5.8 to 8.5.63 (8.5.64 is outside it); 9.0.0.M1 to 9.0.43 (9.0.44 is outside it)
  • CVE-2023-46589
    Affects 11.0.0-M1 to 11.0.0-M10 (11.0.0-M11 is outside it)
  • CVE-2023-45648
    Affects 8.5.0 to 8.5.93 (8.5.94 is outside it); 9.0.0.M1 to 9.0.80 (9.0.81 is outside it); 10.1.0-M1 to 10.1.13 (10.1.14 is outside it); 11.0.0-M1 to 11.0.0-M11 (11.0.0-M12 is outside it)
  • CVE-2023-42794
    Affects 8.5.85 to 8.5.93 (8.5.94 is outside it); 9.0.70 to 9.0.80 (9.0.81 is outside it)
  • CVE-2023-44487
    Affects 8.5.0 to 8.5.93 (8.5.94 is outside it); 9.0.1 to 9.0.80 (9.0.81 is outside it); 10.0.0 to 10.1.13 (10.1.14 is outside it); 11.0.0-M1 to 11.0.0-M11 (11.0.0-M12 is outside it)
  • CVE-2023-34981
    Affects 8.5.88 (8.5.89 is outside it)
  • CVE-2023-28709
    Affects 8.5.85 to 8.5.87 (8.5.88 is outside it)
  • CVE-2023-24998
    Affects 8.5.85 to 8.5.87 (8.5.88 is outside it); 9.0.0.M1 to 9.0.70 (9.0.71 is outside it); 10.1.0-M1 to 10.1.4 (10.1.5 is outside it); 11.0.0-M3 to 11.0.0-M4 (11.0.0-M5 is outside it)
  • CVE-2022-42252
    Affects 9.0.0.M1 to 9.0.67 (9.0.68 is outside it); 10.0.0-M1 to 10.0.26 (10.0.27 is outside it); 10.1.0-M1 to 10.1.0 (10.1.1 is outside it)
  • CVE-2021-25122
    Affects 10.0.0-M1 to 10.0.0 (10.0.2 is outside it)
  • CVE-2020-17527
    Affects 8.5.0 to 8.5.59 (8.5.60 is outside it); 9.0.0.M1 to 9.0.39 (9.0.40 is outside it); 10.0.0-M1 to 10.0.0-M9 (10.0.0-M10 is outside it)
  • CVE-2020-13943
    Affects 8.5.0 to 8.5.57 (8.5.58 is outside it); 9.0.0.M1 to 9.0.37 (9.0.38 is outside it); 10.0.0-M1 to 10.0.0-M7 (10.0.0-M8 is outside it)
  • CVE-2020-13934
    Affects 8.5.2 to 8.5.55 (8.5.56 is outside it); 9.0.0.M6 to 9.0.35 (9.0.36 is outside it); 10.0.0-M1 to 10.0.0-M5 (10.0.0-M6 is outside it)
  • CVE-2019-0199
    Affects 8.0.1 to 8.5.37 (8.5.38 is outside it); 9.0.1 to 9.0.14 (9.0.16 is outside it)
  • CVE-2017-5651
    Affects 8.5.0 to 8.5.12 (8.5.13 is outside it); 9.0.0.M1 to 9.0.0.M18 (9.0.0.M19 is outside it)
  • CVE-2016-6816
    Affects 7.0.0 to 7.0.72 (7.0.73 is outside it); 8.0.0-RC1 to 8.0.38 (8.0.39 is outside it); 8.5.0 to 8.5.6 (8.5.8 is outside it); 9.0.0.M1 to 9.0.0.M11 (9.0.0.M13 is outside it)
  • CVE-2014-0095
    Affects 8.0.0-RC1 to 8.0.3 (8.0.5 is outside it)
  • CVE-2014-0075
    Affects 7.0.0 to 7.0.52 (7.0.53 is outside it); 8.0.1 to 8.0.3 (8.0.5 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 34

  • CVE-2026-65637Critical 9.8

    Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

    Affected: from 11.0.20, fixed in 11.0.25; from 10.1.53, fixed in 10.1.59; from 9.0.115, fixed in 9.0.121.

    Fixed in 9.0.121 (released Aug 12, 2026, 13 days before disclosure), 10.1.59 (released Aug 13, 2026, 12 days before disclosure) and 11.0.25 (released Aug 12, 2026, 13 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-41293Critical 9.8

    Apache Tomcat: HTTP/2 request headers not validated

    Affected: from 8.5.0, fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22.

    Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-32990Medium 5.3

    Apache Tomcat: Fix for CVE-2025-66614 is incomplete

    Affected: from 9.0.113, fixed in 9.0.116; from 10.1.50, fixed in 10.1.53; from 11.0.15, fixed in 11.0.20.

    Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.53 (released Mar 18, 2026, 22 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: TLS cipher order is not preserved

    Affected: from 9.0.114, fixed in 9.0.116; from 10.1.51, fixed in 10.1.53; from 11.0.16, fixed in 11.0.20.

    Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.53 (released Mar 18, 2026, 22 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Request smuggling via invalid chunk extension

    Affected: from 7.0.0, fixed in 9.0.116; from 10.1.0-M1, fixed in 10.1.52; from 11.0.0-M1, fixed in 11.0.20.

    Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.52 (released Jan 23, 2026, 76 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

    Affected: from 11.0.0-M1, fixed in 11.0.18; from 10.1.0-M7, fixed in 10.1.52; from 9.0.83, fixed in 9.0.115.

    Fixed in 9.0.115 (released Jan 21, 2026, 27 days before disclosure), 10.1.52 (released Jan 23, 2026, 25 days before disclosure) and 11.0.18 (released Jan 23, 2026, 25 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2026-24733Medium 6.5

    Apache Tomcat: Security constraint bypass with HTTP/0.9

    Affected: from 11.0.0-M1, fixed in 11.0.15; from 10.1.0-M1, fixed in 10.1.50; fixed in 9.0.113.

    Fixed in 9.0.113 (released Dec 2, 2025, 77 days before disclosure), 10.1.50 (released Dec 2, 2025, 77 days before disclosure) and 11.0.15 (released Dec 2, 2025, 77 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Client certificate verification bypass due to virtual host mapping

    Affected: from 11.0.0-M1, fixed in 11.0.15; from 10.1.0-M1, fixed in 10.1.50; from 9.0.0-M1, fixed in 9.0.113; from 8.5.0, through 8.5.100.

    Fixed in 9.0.113 (released Dec 2, 2025, 77 days before disclosure), 10.1.50 (released Dec 2, 2025, 77 days before disclosure) and 11.0.15 (released Dec 2, 2025, 77 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: h2 DoS - Made You Reset

    Affected: from 11.0.0-M1, fixed in 11.0.10; from 10.1.0-M1, fixed in 10.1.44; from 9.0.0.M1, fixed in 9.0.108.

    Fixed in 9.0.108 (released Jul 31, 2025, 13 days before disclosure), 10.1.44 (released Aug 4, 2025, 9 days before disclosure) and 11.0.10 (released Jul 31, 2025, 13 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: DoS via excessive h2 streams at connection start

    Affected: from 11.0.0-M1, fixed in 11.0.9; from 10.1.0-M1, fixed in 10.1.43; from 9.0.0.M1, fixed in 9.0.107; from 8.5.0, through 8.5.100.

    Fixed in 9.0.107 (released Jul 2, 2025, 8 days before disclosure), 10.1.43 (released Jul 1, 2025, 9 days before disclosure) and 11.0.9 (released Jul 1, 2025, 9 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: APR/Native Connector crash leading to DoS

    Affected: from 9.0.0.M1, fixed in 9.0.107; from 8.5.0, through 8.5.100.

    Fixed in 9.0.107 (released Jul 2, 2025, 8 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

    Affected: from 9.0.76, fixed in 9.0.104; from 10.1.10, fixed in 10.1.40; from 11.0.0-M2, fixed in 11.0.6; from 8.5.0, through 8.5.100.

    Fixed in 9.0.104 (released Apr 4, 2025, 24 days before disclosure), 10.1.40 (released Apr 1, 2025, 27 days before disclosure) and 11.0.6 (released Apr 1, 2025, 27 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2024-52317Medium 6.5

    Apache Tomcat: Request/response mix-up with HTTP/2

    Affected: from 9.0.92, fixed in 9.0.96; from 10.1.27, fixed in 10.1.31; from 11.0.0-M23, fixed in 11.0.0.

    Fixed in 9.0.96 (released Oct 3, 2024, 46 days before disclosure), 10.1.31 (released Oct 3, 2024, 46 days before disclosure) and 11.0.0 (released Oct 3, 2024, 46 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Denial of Service

    Affected: from 11.0.0-M1, fixed in 11.0.0-M21; from 10.1.0-M1, fixed in 10.1.25; from 9.0.13, fixed in 9.0.90; from 8.5.35, through 8.5.100; from 7.0.92, through 7.0.109.

    Fixed in 9.0.90 (released Jun 14, 2024, 146 days before disclosure), 10.1.25 (released Jun 14, 2024, 146 days before disclosure) and 11.0.0-M21 (released Jun 14, 2024, 146 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: HTTP/2 excess header handling DoS

    Affected: from 11.0.0-M1, fixed in 11.0.0-M21; from 10.1.0-M1, fixed in 10.1.25; from 9.0.0-M1, fixed in 9.0.90; from 8.5.0, through 8.5.100.

    Fixed in 9.0.90 (released Jun 14, 2024, 19 days before disclosure), 10.1.25 (released Jun 14, 2024, 19 days before disclosure) and 11.0.0-M21 (released Jun 14, 2024, 19 days before disclosure).

    The latest release, 11.0.27, is not affected.

Show all 34 advisoriesShow fewer advisories

  • Apache Tomcat: HTTP/2 header handling DoS

    Affected: from 11.0.0-M1, fixed in 11.0.0-M17; from 10.1.0-M1, fixed in 10.1.19; from 9.0.0-M1, fixed in 9.0.86; from 8.5.0, fixed in 8.5.99.

    Fixed in 8.5.99 (released Feb 14, 2024, 28 days before disclosure), 9.0.86 (released Feb 14, 2024, 28 days before disclosure), 10.1.19 (released Feb 14, 2024, 28 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • CVE-2024-21733Medium 5.3

    Apache Tomcat: Leaking of unrelated request bodies in default error page

    Affected: from 9.0.0-M11, fixed in 9.0.44; from 8.5.7, fixed in 8.5.64.

    Fixed in 8.5.64 (released Mar 4, 2021, 1051 days before disclosure) and 9.0.44 (released Mar 4, 2021, 1051 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: HTTP request smuggling via malformed trailer headers

    Affected: from 11.0.0-M1, fixed in 11.0.0-M11.

    Fixed in 11.0.0-M11 (released Aug 23, 2023, 97 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2023-45648Medium 5.3

    Apache Tomcat: Trailer header parsing too lenient

    Affected: from 11.0.0-M1, fixed in 11.0.0-M12; from 10.1.0-M1, fixed in 10.1.14; from 9.0.0-M1, fixed in 9.0.81; from 8.5.0, fixed in 8.5.94.

    Fixed in 8.5.94 (released Oct 9, 2023, 1 day before disclosure), 9.0.81 (released Oct 9, 2023, 1 day before disclosure), 10.1.14 (released Oct 9, 2023, 1 day before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

    Affected: from 9.0.70, fixed in 9.0.81; from 8.5.85, fixed in 8.5.94.

    Fixed in 8.5.94 (released Oct 9, 2023, 1 day before disclosure) and 9.0.81 (released Oct 9, 2023, 1 day before disclosure).

    The latest release, 11.0.27, is not affected.

  • CVE-2023-44487High 7.5 · KEV

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    Affected: from 11.0.0-M1, fixed in 11.0.0-M12; from 10.0.0, fixed in 10.1.14; from 9.0.0, fixed in 9.0.81; from 8.5.0, fixed in 8.5.94.

    Fixed in 8.5.94 (released Oct 9, 2023, 1 day before disclosure), 9.0.81 (released Oct 9, 2023, 1 day before disclosure), 10.1.14 (released Oct 9, 2023, 1 day before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: AJP response header mix-up

    Affected: from 8.5.88, fixed in 8.5.89.

    Fixed in 8.5.89 (released May 9, 2023, 43 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Fix for CVE-2023-24998 is incomplete

    Affected: from 8.5.85, fixed in 8.5.88.

    Fixed in 8.5.88 (released Apr 14, 2023, 38 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts

    Affected: from 10.1.0-M1, fixed in 10.1.5; from 11.0.0-M2, fixed in 11.0.0-M5; from 8.5.85, fixed in 8.5.88; from 9.0.0-M1, fixed in 9.0.71.

    Fixed in 8.5.88 (released Apr 14, 2023, 53 days after disclosure), 9.0.71 (released Jan 9, 2023, 42 days before disclosure), 10.1.5 (released Jan 9, 2023, 42 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat request smuggling via malformed content-length

    Affected: from 9.0.0-M1, fixed in 9.0.68; from 10.0.0-M1, fixed in 10.0.27; from 10.1.0-M1, fixed in 10.1.1.

    Fixed in 9.0.68 (released Oct 3, 2022, 29 days before disclosure), 10.0.27 (released Oct 3, 2022, 29 days before disclosure) and 10.1.1 (released Oct 3, 2022, 29 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat h2c request mix-up

    Affected: from 10.0.0-M1, fixed in 10.0.2.

    Fixed in 10.0.2 (released Jan 28, 2021, 32 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • Apache Tomcat: Request header mix-up between HTTP/2 streams

    Affected: from 10.0.0-M1, fixed in 10.0.0-M10; from 9.0.0-M1, fixed in 9.0.40; from 8.5.0, fixed in 8.5.60.

    Fixed in 8.5.60 (released Nov 12, 2020, 21 days before disclosure), 9.0.40 (released Nov 12, 2020, 21 days before disclosure) and 10.0.0-M10 (released Nov 12, 2020, 21 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum nu

    Affected: from 10.0.0-M1, fixed in 10.0.0-M8; from 9.0.0-M1, fixed in 9.0.38; from 8.5.0, fixed in 8.5.58.

    Fixed in 8.5.58 (released Sep 10, 2020, 32 days before disclosure), 9.0.38 (released Sep 10, 2020, 32 days before disclosure) and 10.0.0-M8 (released Sep 9, 2020, 33 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 proces

    Affected: from 10.0.0-M1, fixed in 10.0.0-M6; from 9.0.0.M5, fixed in 9.0.36; from 8.5.1, fixed in 8.5.56.

    Fixed in 8.5.56 (released Jun 3, 2020, 41 days before disclosure), 9.0.36 (released Jun 3, 2020, 41 days before disclosure) and 10.0.0-M6 (released Jun 3, 2020, 41 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS…

    Affected: from 9.0.0, fixed in 9.0.16; from 8.0.0, fixed in 8.5.38.

    Fixed in 8.5.38 (released Feb 5, 2019, 64 days before disclosure) and 9.0.16 (released Feb 4, 2019, 65 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send…

    Affected: from 9.0.0.M1, fixed in 9.0.0.M19; from 8.5.0, fixed in 8.5.13.

    Fixed in 8.5.13 (released Mar 27, 2017, 21 days before disclosure) and 9.0.0.M19 (released Mar 27, 2017, 21 days before disclosure).

    The latest release, 11.0.27, is not affected.

  • The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the…

    Affected: from 9.0.0.M1, fixed in 9.0.0.M12; from 8.5.0, fixed in 8.5.8; from 8.0.0RC1, fixed in 8.0.39; from 7.0.0, fixed in 7.0.73; from 6.0.0, fixed in 6.0.48.

    Fixed in 7.0.73 (released Nov 7, 2016, 133 days before disclosure, the advisory names 6.0.48, which was never published), 8.0.39 (released Nov 9, 2016, 131 days before disclosure), 8.5.8 (released Nov 3, 2016, 137 days before disclosure) and 1 other version.

    The latest release, 11.0.27, is not affected.

  • java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of…

    Affected: from 8.0.0-RC1, fixed in 8.0.4.

    Fixed in 8.0.5 (released Mar 24, 2014, 68 days before disclosure, the advisory names 8.0.4, which was never published).

    The latest release, 11.0.27, is not affected.

  • Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6

    Affected: fixed in 6.0.40; from 7.0.0, fixed in 7.0.53; from 8.0.0, fixed in 8.0.4.

    Fixed in 7.0.53 (released Mar 25, 2014, 67 days before disclosure, the advisory names 6.0.40, which was never published) and 8.0.5 (released Mar 24, 2014, 68 days before disclosure, the advisory names 8.0.4, which was never published).

    The latest release, 11.0.27, is not affected.