Time-of-check Time-of-use (TOCTOU) Race Condition

Overview org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition due to a race condition in the setting of permissions for Unix domain sockets. An attacker can gain...

Always-Incorrect Control Flow Implementation

Overview org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to the incomplete logging of the effective web.xml when special roles and empty authorization...

Detection of Error Condition Without Action

Overview org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Detection of Error Condition Without Action due to improper handling of invalid certificate revocation list CRL configurations in the FFM connector. An...

be.dabla:grizzly-spring-boot-jasper (>=2.0, <=2.7), co.cask.tephra:tephra-examples (>=0.6.2, <=0.7.1) +341 more potentially affected by CVE-2026-55276 via org.apache.tomcat:tomcat-util-scan (>=9.0.0.m1, <=9.0.118)

org.apache.tomcat:tomcat-util-scan MAVEN version =9.0.0.m1, =2.0, =0.6.2, =0.6.0, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =5.9.6, =1.10, =1.10, =2.6.0, =2.8.0 - com.codedx:webapp-runner 9.0.65.0 - com.codedx:webapp-runner-main 9.0.65.0 - com.codedx:webapp-runner-memcached 9.0.65.0 -...

org.apache.tomcat:tomcat-catalina (>=11.0.0-m1, <=11.0.0-m11), org.apache.tomcat:tomcat-catalina-ant (>=11.0.0-m1, <=11.0.0-m11) +6 more potentially affected by CVE-2023-42795 via org.apache.tomcat:tomcat-util (>=11.0.0-m1, <=11.0.0-m11)

org.apache.tomcat:tomcat-util MAVEN version =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m11 Source cves: CVE-2023-42795 Source advisory: OSV:GHSA-G8PJ-R55Q-5C2V...

org.apache.tomcat:tomcat-catalina (>=11.0.0-m1, <=11.0.0-m11), org.apache.tomcat:tomcat-catalina-ant (>=11.0.0-m1, <=11.0.0-m11) +6 more potentially affected by CVE-2023-42795 via org.apache.tomcat:tomcat-util (>=11.0.0-m1, <=11.0.0-m11)

org.apache.tomcat:tomcat-util MAVEN version =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m11 Source cves: CVE-2023-42795 Source advisory: GHSA-G8PJ-R55Q-5C2V...

org.apache.tomcat:tomcat-catalina (>=11.0.0-m1, <=11.0.0-m11), org.apache.tomcat:tomcat-catalina-ant (>=11.0.0-m1, <=11.0.0-m11) +6 more potentially affected by CVE-2023-42795 via org.apache.tomcat:tomcat-util (>=11.0.0-m1, <=11.0.0-m11)

org.apache.tomcat:tomcat-util MAVEN version =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m11 Source cves: CVE-2023-42795 Source advisory: MEND:CVE-2023-42795...

com.github.mjeanroy:junit-servers-tomcat (>=2.1.1, <=3.0.0), com.github.mjeanroy:junit-servers-tomcat-8 (3.0.0) +12 more potentially affected by CVE-2022-45143 via org.apache.tomcat:tomcat-util (8.5.83)

org.apache.tomcat:tomcat-util MAVEN version 8.5.83 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-util and may be impacted: - com.github.mjeanroy:junit-servers-tomcat =2.1.1, =1.3.7, =17.0.0.final, =17.0.0.final, =17.0.1.final...

be.dabla:grizzly-spring-boot-jasper (>=2.4, <=2.7), com.armanbilge:http4s-tomcat-server_2.12 (>=1.0-148-8da8898, <=1.0-377-020cf9e) +162 more potentially affected by CVE-2022-45143 via org.apache.tomcat:tomcat-util (>=9.0.40, <=9.0.68)

org.apache.tomcat:tomcat-util MAVEN version =9.0.40, =2.4, =1.0-148-8da8898, =1.0-148-8da8898, =1.0-148-8da8898, =3.0.11, =5.9.6, =3.3.7, =1.7.0, =6.35, =6.39 and more Source cves: CVE-2022-45143 Source advisory: MEND:CVE-2022-45143...

com.ebay:lightning-client (0.9.0), com.ebay:lightning-core (0.9.0) +12 more potentially affected by CVE-2014-0099 via org.apache.tomcat:tomcat-util (>=8.0.1, <=8.0.5)

org.apache.tomcat:tomcat-util MAVEN version =8.0.1, =1.8.2, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =0.7, =0.15 Source cves: CVE-2014-0099 Source advisory: GHSA-XH5X-J8JF-PCPX...

com.ebay:lightning-client (0.9.0), com.ebay:lightning-core (0.9.0) +12 more potentially affected by CVE-2014-0099 via org.apache.tomcat:tomcat-util (>=8.0.1, <=8.0.5)

org.apache.tomcat:tomcat-util MAVEN version =8.0.1, =1.8.2, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =8.0.1, =0.7, =0.15 Source cves: CVE-2014-0099 Source advisory: OSV:GHSA-XH5X-J8JF-PCPX...

com.flowcentraltech.flowcentral:flowcentral-tomcat (1.0.64), com.github.dblock.waffle:waffle-tomcat9 (1.8.1) +11 more potentially affected by CVE-2016-8745 via org.apache.tomcat:tomcat-util (>=9.0.0.m1, <=9.0.0.m13)

org.apache.tomcat:tomcat-util MAVEN version =9.0.0.m1, =9.0.0.m1, =9.0.0.m1, =9.0.0.m1, =9.0.0.m1, =9.0.0.m1, =9.0.0.m1, =9.0.0.m1, =9.0.0.m1, =9.0.0.m1, =9.0.0.m1, =9.0.0.m13 Source cves: CVE-2016-8745 Source advisory: GHSA-W3J5-Q8F2-3CQQ...

ai.foremast.metrics:foremast-spring-4x-k8s-metrics (>=0.1.6, <=0.2.0), br.com.caelum.vraptor:vraptor-test (>=2.0.0, <=4.0.0) +277 more potentially affected by CVE-2016-8745 via org.apache.tomcat:tomcat-util (>=7.0.0, <=7.0.73)

org.apache.tomcat:tomcat-util MAVEN version =7.0.0, =0.1.6, =2.0.0, =2.0.0, =1.2.4, =1.0-release, =1.0-release, =0.1, =0.4, =3.0.0, =1.0.0, =1.2.1, =1.2.7 and more Source cves: CVE-2016-8745 Source advisory: GHSA-W3J5-Q8F2-3CQQ...

Denial Of Service (DoS)

tomcat-util is vulnerable to denial of service DoS attacks. The attack exists due to not proper handling of overflow in the decodeHasArray function in UTF-8 decoder...

Directory Traversal

tomcat-util is vulnerable to directory traversal attacks. The vulnerability exists due to the ability to include ../, ..\, and ..%5C characters in the URL, allowing directory traversal attacks...

Session Hijacking

tomcat-util is vulnerable to session hijacking attacks. The vulnerability exists due to tomcat-util incorrectly treating single quotes as delimiters in cookies, allowing sensitive information such as session ID to be leaked. This issue is also CVE-2007-3385...

Replay Attack

tomcat-util is vulnerable to replay attacks. The vulnerability exists due to the improper handling of empty requests to the SSL port, allowing a duplicate copy of a recent request to be replayed...

Denial Of Service (DoS)

tomcat-util is vulnerable to denial of service DoS attacks. The attack exists due to not proper handling of overflow in the decodeHasArray function in UTF-8 decoder...

br.com.caelum.vraptor:vraptor-test (>=2.0.0, <=4.0.0), br.net.woodstock.rockframework:rockframework-struts2 (>=2.0.0, <=2.0.8) +177 more potentially affected by CVE-2014-0099 via org.apache.tomcat:tomcat-util (>=7.0.0, <=7.0.53)

org.apache.tomcat:tomcat-util MAVEN version =7.0.0, =2.0.0, =2.0.0, =1.2.4, =1.0-release, =1.0-release, =0.1, =0.4, =3.0.0, =1.0.0, =1.2.1, =1.3, =1.4.2 and more Source cves: CVE-2014-0099 Source advisory: MEND:CVE-2014-0099...