org.apache.tomcat:tomcat-util 10.1.55

Direct Vulnerabilities

Known vulnerabilities in the org.apache.tomcat:tomcat-util package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Always-Incorrect Control Flow Implementation org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to the incomplete logging of the effective `web.xml` when special roles and empty authorization constraints are present. An attacker can bypass intended access restrictions by exploiting the absence of these constraints in the logged configuration. How to fix Always-Incorrect Control Flow Implementation? Upgrade `org.apache.tomcat:tomcat-util` to version 9.0.119, 10.1.56, 11.0.23 or higher.	[9.0.0.M1,9.0.119)[10.1.0-M1,10.1.56)[11.0.0-M1,11.0.23)
H Detection of Error Condition Without Action org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components. Affected versions of this package are vulnerable to Detection of Error Condition Without Action due to improper handling of invalid certificate revocation list (CRL) configurations in the FFM connector. An attacker can bypass intended certificate validation by supplying an invalid CRL configuration. How to fix Detection of Error Condition Without Action? Upgrade `org.apache.tomcat:tomcat-util` to version 9.0.119, 10.1.56, 11.0.23 or higher.	[9.0.83,9.0.119)[10.1.0-M7,10.1.56)[11.0.0-M1,11.0.23)

Vulnerability

Vulnerable Version

Always-Incorrect Control Flow Implementation

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to the incomplete logging of the effective web.xml when special roles and empty authorization constraints are present. An attacker can bypass intended access restrictions by exploiting the absence of these constraints in the logged configuration.

How to fix Always-Incorrect Control Flow Implementation?

Upgrade org.apache.tomcat:tomcat-util to version 9.0.119, 10.1.56, 11.0.23 or higher.

[9.0.0.M1,9.0.119)[10.1.0-M1,10.1.56)[11.0.0-M1,11.0.23)

Detection of Error Condition Without Action

org.apache.tomcat:tomcat-util is a Common code shared by multiple Tomcat components.

Affected versions of this package are vulnerable to Detection of Error Condition Without Action due to improper handling of invalid certificate revocation list (CRL) configurations in the FFM connector. An attacker can bypass intended certificate validation by supplying an invalid CRL configuration.

How to fix Detection of Error Condition Without Action?

Upgrade org.apache.tomcat:tomcat-util to version 9.0.119, 10.1.56, 11.0.23 or higher.

[9.0.83,9.0.119)[10.1.0-M7,10.1.56)[11.0.0-M1,11.0.23)

org.apache.tomcat:tomcat-util@10.1.55

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically