org.apache.tomcat:tomcat-coyote 10.1.48

Direct Vulnerabilities

Known vulnerabilities in the org.apache.tomcat:tomcat-coyote package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Improper Validation of Syntactic Correctness of Input org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the processing of HTTP/2 request headers. An attacker can cause unexpected behavior or potentially compromise the application by sending specially crafted HTTP/2 request headers. How to fix Improper Validation of Syntactic Correctness of Input? Upgrade `org.apache.tomcat:tomcat-coyote` to version 9.0.118, 10.1.55, 11.0.22 or higher.	[,9.0.118)[10.0.0-M1,10.1.55)[11.0.0-M1,11.0.22)
M Timing Attack org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Timing Attack via AJP secret comparison. An attacker can perform a timing side-channel attack to determine whether a guessed secret is correct by sending many authentication attempts directly to the connector and measuring the time taken to compare secrets. How to fix Timing Attack? Upgrade `org.apache.tomcat:tomcat-coyote` to version 9.0.118, 10.1.55, 11.0.22 or higher.	[,9.0.118)[10.1.0-M1,10.1.55)[11.0.0-M1,11.0.22)
H HTTP Request Smuggling org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to HTTP Request Smuggling in `ChunkedInputFilter`, when handling HTTP/1.1 requests with invalid chunk extensions. An attacker can interfere with the interpretation of HTTP requests and responses by injecting CRLF sequences and sending the payload to an application using a reverse proxy that allows those sequences. How to fix HTTP Request Smuggling? Upgrade `org.apache.tomcat:tomcat-coyote` to version 9.0.116, 10.1.53, 11.0.20 or higher.	[7.0.0,9.0.116)[10.1.0-M1,10.1.53)[11.0.0-M1,11.0.20)
L Improper Authorization org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Improper Authorization in `prepareRequestProtocol()`, which accepts HTTP/0.9 requests other than `GET`. A security constraint configured to allow `HEAD` requests to a URI but deny `GET` requests allows a user to bypass the constraint by sending an invalid `HEAD` request. How to fix Improper Authorization? Upgrade `org.apache.tomcat:tomcat-coyote` to version 9.0.113, 10.1.50, 11.0.15 or higher.	[,9.0.113)[10.1.0-M1,10.1.50)[11.0.0-M1,11.0.15)
C Improper Certificate Validation org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Improper Certificate Validation in the SNI extension, when client certificate authentication relies exclusively on the Connector (and is not enforced in the web application). The hostname provided via the SNI extension may be different from the hostname in the HTTP host header field. How to fix Improper Certificate Validation? Upgrade `org.apache.tomcat:tomcat-coyote` to version 9.0.113, 10.1.50, 11.0.15 or higher.	[8.5.0,9.0.113)[10.0.0-M1,10.1.50)[11.0.0-M1,11.0.15)

Vulnerability

Vulnerable Version

Improper Validation of Syntactic Correctness of Input

org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser.

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the processing of HTTP/2 request headers. An attacker can cause unexpected behavior or potentially compromise the application by sending specially crafted HTTP/2 request headers.

How to fix Improper Validation of Syntactic Correctness of Input?

Upgrade org.apache.tomcat:tomcat-coyote to version 9.0.118, 10.1.55, 11.0.22 or higher.

[,9.0.118)[10.0.0-M1,10.1.55)[11.0.0-M1,11.0.22)

Timing Attack

org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser.

Affected versions of this package are vulnerable to Timing Attack via AJP secret comparison. An attacker can perform a timing side-channel attack to determine whether a guessed secret is correct by sending many authentication attempts directly to the connector and measuring the time taken to compare secrets.

How to fix Timing Attack?

Upgrade org.apache.tomcat:tomcat-coyote to version 9.0.118, 10.1.55, 11.0.22 or higher.

[,9.0.118)[10.1.0-M1,10.1.55)[11.0.0-M1,11.0.22)

HTTP Request Smuggling

org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser.

Affected versions of this package are vulnerable to HTTP Request Smuggling in ChunkedInputFilter, when handling HTTP/1.1 requests with invalid chunk extensions. An attacker can interfere with the interpretation of HTTP requests and responses by injecting CRLF sequences and sending the payload to an application using a reverse proxy that allows those sequences.

How to fix HTTP Request Smuggling?

Upgrade org.apache.tomcat:tomcat-coyote to version 9.0.116, 10.1.53, 11.0.20 or higher.

[7.0.0,9.0.116)[10.1.0-M1,10.1.53)[11.0.0-M1,11.0.20)

Improper Authorization

org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser.

Affected versions of this package are vulnerable to Improper Authorization in prepareRequestProtocol(), which accepts HTTP/0.9 requests other than GET. A security constraint configured to allow HEAD requests to a URI but deny GET requests allows a user to bypass the constraint by sending an invalid HEAD request.

How to fix Improper Authorization?

Upgrade org.apache.tomcat:tomcat-coyote to version 9.0.113, 10.1.50, 11.0.15 or higher.

[,9.0.113)[10.1.0-M1,10.1.50)[11.0.0-M1,11.0.15)

Improper Certificate Validation

org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser.

Affected versions of this package are vulnerable to Improper Certificate Validation in the SNI extension, when client certificate authentication relies exclusively on the Connector (and is not enforced in the web application). The hostname provided via the SNI extension may be different from the hostname in the HTTP host header field.

How to fix Improper Certificate Validation?

Upgrade org.apache.tomcat:tomcat-coyote to version 9.0.113, 10.1.50, 11.0.15 or higher.

[8.5.0,9.0.113)[10.0.0-M1,10.1.50)[11.0.0-M1,11.0.15)

org.apache.tomcat:tomcat-coyote@10.1.48

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically