# org.apache.tomcat:tomcat-coyote (Maven) vulnerabilities 34 known vulnerabilities (2 critical, 16 high, 5 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 11.0.27 (Oct 6, 2026): no advisory affects it - Newest unaffected release: 11.0.27 (Oct 6, 2026), the latest release - Dependents: 30 - Releases: 473 since 7.0.0 (Jul 12, 2010) - Registry: https://central.sonatype.com/artifact/org.apache.tomcat/tomcat-coyote - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-65637: 9.0.115 to 9.0.120 (9.0.121 is outside it); 10.1.53 to 10.1.57 (10.1.59 is outside it); 11.0.20 to 11.0.24 (11.0.25 is outside it) - CVE-2026-41293: 8.5.0 to 9.0.117 (9.0.118 is outside it); 10.1.0-M1 to 10.1.54 (10.1.55 is outside it); 11.0.0-M1 to 11.0.21 (11.0.22 is outside it) - CVE-2026-32990: 9.0.113 to 9.0.115 (9.0.116 is outside it); 10.1.50 to 10.1.52 (10.1.53 is outside it); 11.0.15 to 11.0.18 (11.0.20 is outside it) - CVE-2026-29129: 9.0.115 (9.0.116 is outside it); 10.1.52 (10.1.53 is outside it); 11.0.18 (11.0.20 is outside it) - CVE-2026-24880: 7.0.0 to 9.0.115 (9.0.116 is outside it); 10.1.0-M1 to 10.1.50 (10.1.52 is outside it); 11.0.0-M1 to 11.0.18 (11.0.20 is outside it) - CVE-2026-24734: 9.0.83 to 9.0.113 (9.0.115 is outside it); 10.1.0-M7 to 10.1.50 (10.1.52 is outside it); 11.0.0-M1 to 11.0.15 (11.0.18 is outside it) - CVE-2026-24733: 7.0.0 to 9.0.112 (9.0.113 is outside it); 10.1.0-M1 to 10.1.49 (10.1.50 is outside it); 11.0.0-M1 to 11.0.14 (11.0.15 is outside it) - CVE-2025-66614: 8.5.0 to 9.0.112 (9.0.113 is outside it); 10.1.0-M1 to 10.1.49 (10.1.50 is outside it); 11.0.0-M1 to 11.0.14 (11.0.15 is outside it) - CVE-2025-48989: 9.0.0.M1 to 9.0.107 (9.0.108 is outside it); 10.1.0-M1 to 10.1.43 (10.1.44 is outside it); 11.0.0-M1 to 11.0.9 (11.0.10 is outside it) - CVE-2025-53506: 8.5.0 to 9.0.106 (9.0.107 is outside it); 10.1.0-M1 to 10.1.42 (10.1.43 is outside it); 11.0.0-M1 to 11.0.8 (11.0.9 is outside it) - CVE-2025-52434: 8.5.0 to 9.0.106 (9.0.107 is outside it) - CVE-2025-31650: 8.5.0 to 8.5.100 (9.0.0.M1 is outside it); 9.0.76 to 9.0.102 (9.0.104 is outside it); 10.1.10 to 10.1.39 (10.1.40 is outside it); 11.0.0-M3 to 11.0.5 (11.0.6 is outside it) - CVE-2024-52317: 9.0.93 to 9.0.95 (9.0.96 is outside it); 10.1.28 to 10.1.30 (10.1.31 is outside it); 11.0.0-M24 to 11.0.0-M26 (11.0.0 is outside it) - CVE-2024-38286: 7.0.92 to 7.0.109 (8.0.0-RC1 is outside it); 8.5.35 to 8.5.100 (9.0.0.M1 is outside it); 9.0.13 to 9.0.89 (9.0.90 is outside it); 10.1.0-M1 to 10.1.24 (10.1.25 is outside it); 11.0.0-M1 to 11.0.0-M20 (11.0.0-M21 is outside it) - CVE-2024-34750: 8.5.0 to 9.0.89 (9.0.90 is outside it); 10.1.0-M1 to 10.1.24 (10.1.25 is outside it); 11.0.0-M1 to 11.0.0-M20 (11.0.0-M21 is outside it) - CVE-2024-24549: 8.5.0 to 8.5.98 (8.5.99 is outside it); 9.0.0.M1 to 9.0.85 (9.0.86 is outside it); 10.1.0-M1 to 10.1.18 (10.1.19 is outside it); 11.0.0-M1 to 11.0.0-M16 (11.0.0-M17 is outside it) - CVE-2024-21733: 8.5.8 to 8.5.63 (8.5.64 is outside it); 9.0.0.M1 to 9.0.43 (9.0.44 is outside it) - CVE-2023-46589: 11.0.0-M1 to 11.0.0-M10 (11.0.0-M11 is outside it) - CVE-2023-45648: 8.5.0 to 8.5.93 (8.5.94 is outside it); 9.0.0.M1 to 9.0.80 (9.0.81 is outside it); 10.1.0-M1 to 10.1.13 (10.1.14 is outside it); 11.0.0-M1 to 11.0.0-M11 (11.0.0-M12 is outside it) - CVE-2023-42794: 8.5.85 to 8.5.93 (8.5.94 is outside it); 9.0.70 to 9.0.80 (9.0.81 is outside it) - CVE-2023-44487: 8.5.0 to 8.5.93 (8.5.94 is outside it); 9.0.1 to 9.0.80 (9.0.81 is outside it); 10.0.0 to 10.1.13 (10.1.14 is outside it); 11.0.0-M1 to 11.0.0-M11 (11.0.0-M12 is outside it) - CVE-2023-34981: 8.5.88 (8.5.89 is outside it) - CVE-2023-28709: 8.5.85 to 8.5.87 (8.5.88 is outside it) - CVE-2023-24998: 8.5.85 to 8.5.87 (8.5.88 is outside it); 9.0.0.M1 to 9.0.70 (9.0.71 is outside it); 10.1.0-M1 to 10.1.4 (10.1.5 is outside it); 11.0.0-M3 to 11.0.0-M4 (11.0.0-M5 is outside it) - CVE-2022-42252: 9.0.0.M1 to 9.0.67 (9.0.68 is outside it); 10.0.0-M1 to 10.0.26 (10.0.27 is outside it); 10.1.0-M1 to 10.1.0 (10.1.1 is outside it) - CVE-2021-25122: 10.0.0-M1 to 10.0.0 (10.0.2 is outside it) - CVE-2020-17527: 8.5.0 to 8.5.59 (8.5.60 is outside it); 9.0.0.M1 to 9.0.39 (9.0.40 is outside it); 10.0.0-M1 to 10.0.0-M9 (10.0.0-M10 is outside it) - CVE-2020-13943: 8.5.0 to 8.5.57 (8.5.58 is outside it); 9.0.0.M1 to 9.0.37 (9.0.38 is outside it); 10.0.0-M1 to 10.0.0-M7 (10.0.0-M8 is outside it) - CVE-2020-13934: 8.5.2 to 8.5.55 (8.5.56 is outside it); 9.0.0.M6 to 9.0.35 (9.0.36 is outside it); 10.0.0-M1 to 10.0.0-M5 (10.0.0-M6 is outside it) - CVE-2019-0199: 8.0.1 to 8.5.37 (8.5.38 is outside it); 9.0.1 to 9.0.14 (9.0.16 is outside it) - CVE-2017-5651: 8.5.0 to 8.5.12 (8.5.13 is outside it); 9.0.0.M1 to 9.0.0.M18 (9.0.0.M19 is outside it) - CVE-2016-6816: 7.0.0 to 7.0.72 (7.0.73 is outside it); 8.0.0-RC1 to 8.0.38 (8.0.39 is outside it); 8.5.0 to 8.5.6 (8.5.8 is outside it); 9.0.0.M1 to 9.0.0.M11 (9.0.0.M13 is outside it) - CVE-2014-0095: 8.0.0-RC1 to 8.0.3 (8.0.5 is outside it) - CVE-2014-0075: 7.0.0 to 7.0.52 (7.0.53 is outside it); 8.0.1 to 8.0.3 (8.0.5 is outside it) ## Advisories (34) ### [CVE-2026-65637](https://cve.now/CVE-2026-65637): Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete - Severity: Critical 9.8 - Published: Aug 25, 2026 - Affected: from 11.0.20, fixed in 11.0.25; from 10.1.53, fixed in 10.1.59; from 9.0.115, fixed in 9.0.121. - Fixed in 9.0.121 (released Aug 12, 2026, 13 days before disclosure), 10.1.59 (released Aug 13, 2026, 12 days before disclosure) and 11.0.25 (released Aug 12, 2026, 13 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2026-41293](https://cve.now/CVE-2026-41293): Apache Tomcat: HTTP/2 request headers not validated - Severity: Critical 9.8 - Published: May 12, 2026 - Affected: from 8.5.0, fixed in 9.0.118; from 10.1.0-M1, fixed in 10.1.55; from 11.0.0-M1, fixed in 11.0.22. - Fixed in 9.0.118 (released May 1, 2026, 11 days before disclosure), 10.1.55 (released May 5, 2026, 7 days before disclosure) and 11.0.22 (released May 1, 2026, 11 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2026-32990](https://cve.now/CVE-2026-32990): Apache Tomcat: Fix for CVE-2025-66614 is incomplete - Severity: Medium 5.3 - Published: Apr 9, 2026 - Affected: from 9.0.113, fixed in 9.0.116; from 10.1.50, fixed in 10.1.53; from 11.0.15, fixed in 11.0.20. - Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.53 (released Mar 18, 2026, 22 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2026-29129](https://cve.now/CVE-2026-29129): Apache Tomcat: TLS cipher order is not preserved - Severity: High 7.5 - Published: Apr 9, 2026 - Affected: from 9.0.114, fixed in 9.0.116; from 10.1.51, fixed in 10.1.53; from 11.0.16, fixed in 11.0.20. - Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.53 (released Mar 18, 2026, 22 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2026-24880](https://cve.now/CVE-2026-24880): Apache Tomcat: Request smuggling via invalid chunk extension - Severity: High 7.5 - Published: Apr 9, 2026 - Affected: from 7.0.0, fixed in 9.0.116; from 10.1.0-M1, fixed in 10.1.52; from 11.0.0-M1, fixed in 11.0.20. - Fixed in 9.0.116 (released Mar 16, 2026, 24 days before disclosure), 10.1.52 (released Jan 23, 2026, 76 days before disclosure) and 11.0.20 (released Mar 16, 2026, 24 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2026-24734](https://cve.now/CVE-2026-24734): Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass - Severity: High 7.4 - Published: Feb 17, 2026 - Affected: from 11.0.0-M1, fixed in 11.0.18; from 10.1.0-M7, fixed in 10.1.52; from 9.0.83, fixed in 9.0.115. - Fixed in 9.0.115 (released Jan 21, 2026, 27 days before disclosure), 10.1.52 (released Jan 23, 2026, 25 days before disclosure) and 11.0.18 (released Jan 23, 2026, 25 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2026-24733](https://cve.now/CVE-2026-24733): Apache Tomcat: Security constraint bypass with HTTP/0.9 - Severity: Medium 6.5 - Published: Feb 17, 2026 - Affected: from 11.0.0-M1, fixed in 11.0.15; from 10.1.0-M1, fixed in 10.1.50; fixed in 9.0.113. - Fixed in 9.0.113 (released Dec 2, 2025, 77 days before disclosure), 10.1.50 (released Dec 2, 2025, 77 days before disclosure) and 11.0.15 (released Dec 2, 2025, 77 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2025-66614](https://cve.now/CVE-2025-66614): Apache Tomcat: Client certificate verification bypass due to virtual host mapping - Severity: High 7.6 - Published: Feb 17, 2026 - Affected: from 11.0.0-M1, fixed in 11.0.15; from 10.1.0-M1, fixed in 10.1.50; from 9.0.0-M1, fixed in 9.0.113; from 8.5.0, through 8.5.100. - Fixed in 9.0.113 (released Dec 2, 2025, 77 days before disclosure), 10.1.50 (released Dec 2, 2025, 77 days before disclosure) and 11.0.15 (released Dec 2, 2025, 77 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2025-48989](https://cve.now/CVE-2025-48989): Apache Tomcat: h2 DoS - Made You Reset - Severity: High 7.5 - Published: Aug 13, 2025 - Affected: from 11.0.0-M1, fixed in 11.0.10; from 10.1.0-M1, fixed in 10.1.44; from 9.0.0.M1, fixed in 9.0.108. - Fixed in 9.0.108 (released Jul 31, 2025, 13 days before disclosure), 10.1.44 (released Aug 4, 2025, 9 days before disclosure) and 11.0.10 (released Jul 31, 2025, 13 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2025-53506](https://cve.now/CVE-2025-53506): Apache Tomcat: DoS via excessive h2 streams at connection start - Severity: High 7.5 - Published: Jul 10, 2025 - Affected: from 11.0.0-M1, fixed in 11.0.9; from 10.1.0-M1, fixed in 10.1.43; from 9.0.0.M1, fixed in 9.0.107; from 8.5.0, through 8.5.100. - Fixed in 9.0.107 (released Jul 2, 2025, 8 days before disclosure), 10.1.43 (released Jul 1, 2025, 9 days before disclosure) and 11.0.9 (released Jul 1, 2025, 9 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2025-52434](https://cve.now/CVE-2025-52434): Apache Tomcat: APR/Native Connector crash leading to DoS - Severity: High 7.5 - Published: Jul 10, 2025 - Affected: from 9.0.0.M1, fixed in 9.0.107; from 8.5.0, through 8.5.100. - Fixed in 9.0.107 (released Jul 2, 2025, 8 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2025-31650](https://cve.now/CVE-2025-31650): Apache Tomcat: DoS via malformed HTTP/2 PRIORITY\_UPDATE frame - Severity: High 7.5 - Published: Apr 28, 2025 - Affected: from 9.0.76, fixed in 9.0.104; from 10.1.10, fixed in 10.1.40; from 11.0.0-M2, fixed in 11.0.6; from 8.5.0, through 8.5.100. - Fixed in 9.0.104 (released Apr 4, 2025, 24 days before disclosure), 10.1.40 (released Apr 1, 2025, 27 days before disclosure) and 11.0.6 (released Apr 1, 2025, 27 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2024-52317](https://cve.now/CVE-2024-52317): Apache Tomcat: Request/response mix-up with HTTP/2 - Severity: Medium 6.5 - Published: Nov 18, 2024 - Affected: from 9.0.92, fixed in 9.0.96; from 10.1.27, fixed in 10.1.31; from 11.0.0-M23, fixed in 11.0.0. - Fixed in 9.0.96 (released Oct 3, 2024, 46 days before disclosure), 10.1.31 (released Oct 3, 2024, 46 days before disclosure) and 11.0.0 (released Oct 3, 2024, 46 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2024-38286](https://cve.now/CVE-2024-38286): Apache Tomcat: Denial of Service - Severity: High 8.6 - Published: Nov 7, 2024 - Affected: from 11.0.0-M1, fixed in 11.0.0-M21; from 10.1.0-M1, fixed in 10.1.25; from 9.0.13, fixed in 9.0.90; from 8.5.35, through 8.5.100; from 7.0.92, through 7.0.109. - Fixed in 9.0.90 (released Jun 14, 2024, 146 days before disclosure), 10.1.25 (released Jun 14, 2024, 146 days before disclosure) and 11.0.0-M21 (released Jun 14, 2024, 146 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2024-34750](https://cve.now/CVE-2024-34750): Apache Tomcat: HTTP/2 excess header handling DoS - Severity: High 7.5 - Published: Jul 3, 2024 - Affected: from 11.0.0-M1, fixed in 11.0.0-M21; from 10.1.0-M1, fixed in 10.1.25; from 9.0.0-M1, fixed in 9.0.90; from 8.5.0, through 8.5.100. - Fixed in 9.0.90 (released Jun 14, 2024, 19 days before disclosure), 10.1.25 (released Jun 14, 2024, 19 days before disclosure) and 11.0.0-M21 (released Jun 14, 2024, 19 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2024-24549](https://cve.now/CVE-2024-24549): Apache Tomcat: HTTP/2 header handling DoS - Severity: High 7.5 - Published: Mar 13, 2024 - Affected: from 11.0.0-M1, fixed in 11.0.0-M17; from 10.1.0-M1, fixed in 10.1.19; from 9.0.0-M1, fixed in 9.0.86; from 8.5.0, fixed in 8.5.99. - Fixed in 8.5.99 (released Feb 14, 2024, 28 days before disclosure), 9.0.86 (released Feb 14, 2024, 28 days before disclosure), 10.1.19 (released Feb 14, 2024, 28 days before disclosure) and 1 other version. - The latest release, 11.0.27, is not affected. ### [CVE-2024-21733](https://cve.now/CVE-2024-21733): Apache Tomcat: Leaking of unrelated request bodies in default error page - Severity: Medium 5.3 - Published: Jan 19, 2024 - Affected: from 9.0.0-M11, fixed in 9.0.44; from 8.5.7, fixed in 8.5.64. - Fixed in 8.5.64 (released Mar 4, 2021, 1051 days before disclosure) and 9.0.44 (released Mar 4, 2021, 1051 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2023-46589](https://cve.now/CVE-2023-46589): Apache Tomcat: HTTP request smuggling via malformed trailer headers - Severity: High 7.5 - Published: Nov 28, 2023 - Affected: from 11.0.0-M1, fixed in 11.0.0-M11. - Fixed in 11.0.0-M11 (released Aug 23, 2023, 97 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2023-45648](https://cve.now/CVE-2023-45648): Apache Tomcat: Trailer header parsing too lenient - Severity: Medium 5.3 - Published: Oct 10, 2023 - Affected: from 11.0.0-M1, fixed in 11.0.0-M12; from 10.1.0-M1, fixed in 10.1.14; from 9.0.0-M1, fixed in 9.0.81; from 8.5.0, fixed in 8.5.94. - Fixed in 8.5.94 (released Oct 9, 2023, 1 day before disclosure), 9.0.81 (released Oct 9, 2023, 1 day before disclosure), 10.1.14 (released Oct 9, 2023, 1 day before disclosure) and 1 other version. - The latest release, 11.0.27, is not affected. ### [CVE-2023-42794](https://cve.now/CVE-2023-42794): Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows - Severity: Low - Published: Oct 10, 2023 - Affected: from 9.0.70, fixed in 9.0.81; from 8.5.85, fixed in 8.5.94. - Fixed in 8.5.94 (released Oct 9, 2023, 1 day before disclosure) and 9.0.81 (released Oct 9, 2023, 1 day before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2023-44487](https://cve.now/CVE-2023-44487): The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as - Severity: High 7.5 · KEV - Published: Oct 10, 2023 - Affected: from 11.0.0-M1, fixed in 11.0.0-M12; from 10.0.0, fixed in 10.1.14; from 9.0.0, fixed in 9.0.81; from 8.5.0, fixed in 8.5.94. - Fixed in 8.5.94 (released Oct 9, 2023, 1 day before disclosure), 9.0.81 (released Oct 9, 2023, 1 day before disclosure), 10.1.14 (released Oct 9, 2023, 1 day before disclosure) and 1 other version. - The latest release, 11.0.27, is not affected. ### [CVE-2023-34981](https://cve.now/CVE-2023-34981): Apache Tomcat: AJP response header mix-up - Severity: High 7.5 - Published: Jun 21, 2023 - Affected: from 8.5.88, fixed in 8.5.89. - Fixed in 8.5.89 (released May 9, 2023, 43 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2023-28709](https://cve.now/CVE-2023-28709): Apache Tomcat: Fix for CVE-2023-24998 is incomplete - Severity: Unrated - Published: May 22, 2023 - Affected: from 8.5.85, fixed in 8.5.88. - Fixed in 8.5.88 (released Apr 14, 2023, 38 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2023-24998](https://cve.now/CVE-2023-24998): Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts - Severity: High 7.5 - Published: Feb 20, 2023 - Affected: from 10.1.0-M1, fixed in 10.1.5; from 11.0.0-M2, fixed in 11.0.0-M5; from 8.5.85, fixed in 8.5.88; from 9.0.0-M1, fixed in 9.0.71. - Fixed in 8.5.88 (released Apr 14, 2023, 53 days after disclosure), 9.0.71 (released Jan 9, 2023, 42 days before disclosure), 10.1.5 (released Jan 9, 2023, 42 days before disclosure) and 1 other version. - The latest release, 11.0.27, is not affected. ### [CVE-2022-42252](https://cve.now/CVE-2022-42252): Apache Tomcat request smuggling via malformed content-length - Severity: High 7.5 - Published: Nov 1, 2022 - Affected: from 9.0.0-M1, fixed in 9.0.68; from 10.0.0-M1, fixed in 10.0.27; from 10.1.0-M1, fixed in 10.1.1. - Fixed in 9.0.68 (released Oct 3, 2022, 29 days before disclosure), 10.0.27 (released Oct 3, 2022, 29 days before disclosure) and 10.1.1 (released Oct 3, 2022, 29 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2021-25122](https://cve.now/CVE-2021-25122): Apache Tomcat h2c request mix-up - Severity: Unrated - Published: Mar 1, 2021 - Affected: from 10.0.0-M1, fixed in 10.0.2. - Fixed in 10.0.2 (released Jan 28, 2021, 32 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2020-17527](https://cve.now/CVE-2020-17527): Apache Tomcat: Request header mix-up between HTTP/2 streams - Severity: Unrated - Published: Dec 3, 2020 - Affected: from 10.0.0-M1, fixed in 10.0.0-M10; from 9.0.0-M1, fixed in 9.0.40; from 8.5.0, fixed in 8.5.60. - Fixed in 8.5.60 (released Nov 12, 2020, 21 days before disclosure), 9.0.40 (released Nov 12, 2020, 21 days before disclosure) and 10.0.0-M10 (released Nov 12, 2020, 21 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2020-13943](https://cve.now/CVE-2020-13943): If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum nu - Severity: Unrated - Published: Oct 12, 2020 - Affected: from 10.0.0-M1, fixed in 10.0.0-M8; from 9.0.0-M1, fixed in 9.0.38; from 8.5.0, fixed in 8.5.58. - Fixed in 8.5.58 (released Sep 10, 2020, 32 days before disclosure), 9.0.38 (released Sep 10, 2020, 32 days before disclosure) and 10.0.0-M8 (released Sep 9, 2020, 33 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2020-13934](https://cve.now/CVE-2020-13934): An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 proces - Severity: Unrated - Published: Jul 14, 2020 - Affected: from 10.0.0-M1, fixed in 10.0.0-M6; from 9.0.0.M5, fixed in 9.0.36; from 8.5.1, fixed in 8.5.56. - Fixed in 8.5.56 (released Jun 3, 2020, 41 days before disclosure), 9.0.36 (released Jun 3, 2020, 41 days before disclosure) and 10.0.0-M6 (released Jun 3, 2020, 41 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2019-0199](https://cve.now/CVE-2019-0199): The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS… - Severity: Unrated - Published: Apr 10, 2019 - Affected: from 9.0.0, fixed in 9.0.16; from 8.0.0, fixed in 8.5.38. - Fixed in 8.5.38 (released Feb 5, 2019, 64 days before disclosure) and 9.0.16 (released Feb 4, 2019, 65 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2017-5651](https://cve.now/CVE-2017-5651): In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send… - Severity: Unrated - Published: Apr 17, 2017 - Affected: from 9.0.0.M1, fixed in 9.0.0.M19; from 8.5.0, fixed in 8.5.13. - Fixed in 8.5.13 (released Mar 27, 2017, 21 days before disclosure) and 9.0.0.M19 (released Mar 27, 2017, 21 days before disclosure). - The latest release, 11.0.27, is not affected. ### [CVE-2016-6816](https://cve.now/CVE-2016-6816): The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the… - Severity: Unrated - Published: Mar 20, 2017 - Affected: from 9.0.0.M1, fixed in 9.0.0.M12; from 8.5.0, fixed in 8.5.8; from 8.0.0RC1, fixed in 8.0.39; from 7.0.0, fixed in 7.0.73; from 6.0.0, fixed in 6.0.48. - Fixed in 7.0.73 (released Nov 7, 2016, 133 days before disclosure, the advisory names 6.0.48, which was never published), 8.0.39 (released Nov 9, 2016, 131 days before disclosure), 8.5.8 (released Nov 3, 2016, 137 days before disclosure) and 1 other version. - The latest release, 11.0.27, is not affected. ### [CVE-2014-0095](https://cve.now/CVE-2014-0095): java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of… - Severity: Unrated - Published: May 31, 2014 - Affected: from 8.0.0-RC1, fixed in 8.0.4. - Fixed in 8.0.5 (released Mar 24, 2014, 68 days before disclosure, the advisory names 8.0.4, which was never published). - The latest release, 11.0.27, is not affected. ### [CVE-2014-0075](https://cve.now/CVE-2014-0075): Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6 - Severity: Unrated - Published: May 31, 2014 - Affected: fixed in 6.0.40; from 7.0.0, fixed in 7.0.53; from 8.0.0, fixed in 8.0.4. - Fixed in 7.0.53 (released Mar 25, 2014, 67 days before disclosure, the advisory names 6.0.40, which was never published) and 8.0.5 (released Mar 24, 2014, 68 days before disclosure, the advisory names 8.0.4, which was never published). - The latest release, 11.0.27, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.tomcat:tomcat-coyote Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.