org.apache.tomcat:tomcat-coyote@10.1.54
latest version
11.0.24
latest non vulnerable version
first published
16 years ago
latest version published
1 months ago
licenses detected
- [0,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the org.apache.tomcat:tomcat-coyote package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the processing of HTTP/2 request headers. An attacker can cause unexpected behavior or potentially compromise the application by sending specially crafted HTTP/2 request headers. How to fix Improper Validation of Syntactic Correctness of Input? Upgrade | [,9.0.118)[10.0.0-M1,10.1.55)[11.0.0-M1,11.0.22) |
org.apache.tomcat:tomcat-coyote is a Tomcat Connectors and HTTP parser. Affected versions of this package are vulnerable to Timing Attack via AJP secret comparison. An attacker can perform a timing side-channel attack to determine whether a guessed secret is correct by sending many authentication attempts directly to the connector and measuring the time taken to compare secrets. How to fix Timing Attack? Upgrade | [,9.0.118)[10.1.0-M1,10.1.55)[11.0.0-M1,11.0.22) |