org.apache.tomcat:tomcat-catalina 10.1.52

Direct Vulnerabilities

Known vulnerabilities in the org.apache.tomcat:tomcat-catalina package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Always-Incorrect Control Flow Implementation org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to incorrect control flow in the `RewriteValve` process. An attacker can bypass intended rewrite rules by crafting requests that exploit the improper evaluation of OR chains in conditions. How to fix Always-Incorrect Control Flow Implementation? Upgrade `org.apache.tomcat:tomcat-catalina` to version 9.0.119, 10.1.56, 11.0.23 or higher.	[9.0.0.M1,9.0.119)[10.1.0-M1,10.1.56)[11.0.0-M1,11.0.23)
M Improper Authorization org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Improper Authorization due to the improper enforcement of security constraints in the `default servlet` when certain HTTP methods or method omissions are configured. An attacker can gain unauthorized access to protected resources by sending requests using HTTP methods that are not properly restricted. How to fix Improper Authorization? Upgrade `org.apache.tomcat:tomcat-catalina` to version 9.0.119, 10.1.56, 11.0.23 or higher.	[9.0.0.M1,9.0.119)[10.1.0-M1,10.1.56)[11.0.0-M1,11.0.23)
H Improper Authentication org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Improper Authentication in the `EncryptionInterceptor` process of the cluster component. An attacker can gain unauthorized access or perform unauthorized actions by replaying previously captured authentication data. How to fix Improper Authentication? Upgrade `org.apache.tomcat:tomcat-catalina` to version 9.0.119, 10.1.56, 11.0.23 or higher.	[9.0.13,9.0.119)[10.1.0-M1,10.1.56)[11.0.0-M1,11.0.23)
C Improper Authentication org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Improper Authentication when DIGEST authentication is configured. An attacker can gain unauthorized access by providing any unknown username, as the system will incorrectly authenticate the user. How to fix Improper Authentication? Upgrade `org.apache.tomcat:tomcat-catalina` to version 9.0.118, 10.1.55, 11.0.22 or higher.	[,9.0.118)[10.0.0-M1,10.1.55)[11.0.0-M1,11.0.22)
M Improper Handling of Case Sensitivity org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the `LockOutRealm` function. An attacker can bypass account lockout protections by submitting usernames with different letter casing. How to fix Improper Handling of Case Sensitivity? Upgrade `org.apache.tomcat:tomcat-catalina` to version 9.0.118, 10.1.55, 11.0.22 or higher.	[,9.0.118)[10.0.0-M1,10.1.55)[11.0.0-M1,11.0.22)
M Improper Authorization org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Improper Authorization in the processing of security constraints when multiple method constraints define an HTTP method for the same extension. An attacker can gain unauthorized access to protected resources by crafting requests that exploit the improper application of these constraints. How to fix Improper Authorization? Upgrade `org.apache.tomcat:tomcat-catalina` to version 9.0.118, 10.1.55, 11.0.22 or higher.	[,9.0.118)[10.0.0-M1,10.1.55)[11.0.0-M1,11.0.22)
M Timing Attack org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Timing Attack via AJP secret comparison. An attacker can perform a timing side-channel attack to determine whether a guessed secret is correct by sending many authentication attempts directly to the connector and measuring the time taken to compare secrets. How to fix Timing Attack? Upgrade `org.apache.tomcat:tomcat-catalina` to version 9.0.118, 10.1.55, 11.0.22 or higher.	[,9.0.118)[10.1.0-M1,10.1.55)[11.0.0-M1,11.0.22)
H Allocation of Resources Without Limits or Throttling org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the WebDAV `LOCK` and `PROPFIND` XML request bodies. An attacker can cause excessive resource consumption by sending specially crafted requests that trigger unbounded reads. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.apache.tomcat:tomcat-catalina` to version 9.0.118, 10.1.55, 11.0.22 or higher.	[9.0.0.M1,9.0.118)[10.1.0-M1,10.1.55)[11.0.0-M1,11.0.22)
M Open Redirect org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Open Redirect via the `LoadBalancerDrainingValve.invoke()` function. When the `LoadBalancerDrainingValve` is in the disabled (draining) state, an attacker can redirect users to a malicious attacker-controlled URL. How to fix Open Redirect? Upgrade `org.apache.tomcat:tomcat-catalina` to version 9.0.116, 10.1.53, 11.0.20 or higher.	[8.5.30,9.0.116)[10.1.0-M1,10.1.53)[11.0.0-M1,11.0.20)
M Improper Encoding or Escaping of Output org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in `JsonAccessLogValve()`, which relies on an unescaped `append()` in generating JSON logs. If non-default values are used for the Connector attributes `relaxedPathChars` or `relaxedQueryChars`, an attacker can inject malicious JSON into logs. How to fix Improper Encoding or Escaping of Output? Upgrade `org.apache.tomcat:tomcat-catalina` to version 9.0.117, 10.1.54, 11.0.21 or higher.	[,9.0.117)[10.1.0-M1,10.1.54)[11.0.0-M1,11.0.21)

Vulnerability

Vulnerable Version

Always-Incorrect Control Flow Implementation

org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations.

Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to incorrect control flow in the RewriteValve process. An attacker can bypass intended rewrite rules by crafting requests that exploit the improper evaluation of OR chains in conditions.

How to fix Always-Incorrect Control Flow Implementation?

Upgrade org.apache.tomcat:tomcat-catalina to version 9.0.119, 10.1.56, 11.0.23 or higher.

[9.0.0.M1,9.0.119)[10.1.0-M1,10.1.56)[11.0.0-M1,11.0.23)

Improper Authorization

org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations.

Affected versions of this package are vulnerable to Improper Authorization due to the improper enforcement of security constraints in the default servlet when certain HTTP methods or method omissions are configured. An attacker can gain unauthorized access to protected resources by sending requests using HTTP methods that are not properly restricted.

How to fix Improper Authorization?

Upgrade org.apache.tomcat:tomcat-catalina to version 9.0.119, 10.1.56, 11.0.23 or higher.

[9.0.0.M1,9.0.119)[10.1.0-M1,10.1.56)[11.0.0-M1,11.0.23)

Improper Authentication

org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations.

Affected versions of this package are vulnerable to Improper Authentication in the EncryptionInterceptor process of the cluster component. An attacker can gain unauthorized access or perform unauthorized actions by replaying previously captured authentication data.

How to fix Improper Authentication?

Upgrade org.apache.tomcat:tomcat-catalina to version 9.0.119, 10.1.56, 11.0.23 or higher.

[9.0.13,9.0.119)[10.1.0-M1,10.1.56)[11.0.0-M1,11.0.23)

Improper Authentication

org.apache.tomcat:tomcat-catalina is a Tomcat Servlet Engine Core Classes and Standard implementations.

Affected versions of this package are vulnerable to Improper Authentication when DIGEST authentication is configured. An attacker can gain unauthorized access by providing any unknown username, as the system will incorrectly authenticate the user.

How to fix Improper Authentication?