org.apache.tomcat:tomcat-coyote 10.1.50

Direct Vulnerabilities

Known vulnerabilities in the org.apache.tomcat:tomcat-coyote package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Improper Validation of Syntactic Correctness of Input org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the processing of HTTP/2 request headers. An attacker can cause unexpected behavior or potentially compromise the application by sending specially crafted HTTP/2 request headers. How to fix Improper Validation of Syntactic Correctness of Input? Upgrade `org.apache.tomcat:tomcat-coyote` to version 9.0.118, 10.1.55, 11.0.22 or higher.	[,9.0.118)[10.0.0-M1,10.1.55)[11.0.0-M1,11.0.22)
M Timing Attack org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Timing Attack via AJP secret comparison. An attacker can perform a timing side-channel attack to determine whether a guessed secret is correct by sending many authentication attempts directly to the connector and measuring the time taken to compare secrets. How to fix Timing Attack? Upgrade `org.apache.tomcat:tomcat-coyote` to version 9.0.118, 10.1.55, 11.0.22 or higher.	[,9.0.118)[10.1.0-M1,10.1.55)[11.0.0-M1,11.0.22)
M Improper Certificate Validation org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Improper Certificate Validation in `getSSLHostConfig()`, which does not sufficiently account for all protocol host name inputs. An attacker can access sensitive information in some cases. Note: This is a partial bypass for the vulnerability described in CVE-2025-66614. How to fix Improper Certificate Validation? Upgrade `org.apache.tomcat:tomcat-coyote` to version 9.0.116, 10.1.53, 11.0.20 or higher.	[9.0.113,9.0.116)[10.1.50,10.1.53)[11.0.15,11.0.20)
H HTTP Request Smuggling org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to HTTP Request Smuggling in `ChunkedInputFilter`, when handling HTTP/1.1 requests with invalid chunk extensions. An attacker can interfere with the interpretation of HTTP requests and responses by injecting CRLF sequences and sending the payload to an application using a reverse proxy that allows those sequences. How to fix HTTP Request Smuggling? Upgrade `org.apache.tomcat:tomcat-coyote` to version 9.0.116, 10.1.53, 11.0.20 or higher.	[7.0.0,9.0.116)[10.1.0-M1,10.1.53)[11.0.0-M1,11.0.20)

Vulnerability

Vulnerable Version

Improper Validation of Syntactic Correctness of Input

org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser.

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the processing of HTTP/2 request headers. An attacker can cause unexpected behavior or potentially compromise the application by sending specially crafted HTTP/2 request headers.

How to fix Improper Validation of Syntactic Correctness of Input?

Upgrade org.apache.tomcat:tomcat-coyote to version 9.0.118, 10.1.55, 11.0.22 or higher.

[,9.0.118)[10.0.0-M1,10.1.55)[11.0.0-M1,11.0.22)

Timing Attack

org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser.

Affected versions of this package are vulnerable to Timing Attack via AJP secret comparison. An attacker can perform a timing side-channel attack to determine whether a guessed secret is correct by sending many authentication attempts directly to the connector and measuring the time taken to compare secrets.

How to fix Timing Attack?

Upgrade org.apache.tomcat:tomcat-coyote to version 9.0.118, 10.1.55, 11.0.22 or higher.

[,9.0.118)[10.1.0-M1,10.1.55)[11.0.0-M1,11.0.22)

Improper Certificate Validation

org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser.

Affected versions of this package are vulnerable to Improper Certificate Validation in getSSLHostConfig(), which does not sufficiently account for all protocol host name inputs. An attacker can access sensitive information in some cases.

Note: This is a partial bypass for the vulnerability described in CVE-2025-66614.

How to fix Improper Certificate Validation?

Upgrade org.apache.tomcat:tomcat-coyote to version 9.0.116, 10.1.53, 11.0.20 or higher.

[9.0.113,9.0.116)[10.1.50,10.1.53)[11.0.15,11.0.20)

HTTP Request Smuggling

org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser.

Affected versions of this package are vulnerable to HTTP Request Smuggling in ChunkedInputFilter, when handling HTTP/1.1 requests with invalid chunk extensions. An attacker can interfere with the interpretation of HTTP requests and responses by injecting CRLF sequences and sending the payload to an application using a reverse proxy that allows those sequences.

How to fix HTTP Request Smuggling?

Upgrade org.apache.tomcat:tomcat-coyote to version 9.0.116, 10.1.53, 11.0.20 or higher.

[7.0.0,9.0.116)[10.1.0-M1,10.1.53)[11.0.0-M1,11.0.20)

org.apache.tomcat:tomcat-coyote@10.1.50

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically