org.apache.tomcat.embed:tomcat-embed-core@10.1.39 vulnerabilities
latest version
11.0.15
latest non vulnerable version
first published
15 years ago
latest version published
1 months ago
licenses detected
- [0,)
package registry
Direct Vulnerabilities
Known vulnerabilities in the org.apache.tomcat.embed:tomcat-embed-core package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Untrusted Search Path via the How to fix Untrusted Search Path? Upgrade | [9.0.23,9.0.106)[10.1.0,10.1.42)[11.0.0-M1,11.0.8) |
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Relative Path Traversal via the URL normalization. An attacker can bypass security constraints and access restricted directories such as Note:
How to fix Relative Path Traversal? Upgrade | [,9.0.109)[10.1.0-M1,10.1.45)[11.0.0-M1,11.0.11) |
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Improper Resource Shutdown or Release due to the delayed cleaning of multipart upload temporary files. An attacker can cause a denial-of-service by sending crafted requests that create temporary copies of uploaded parts faster than the garbage collector clears them, leading to resource exhaustion. Note: Successful exploitation depends on the JVM settings, the application memory usage, and application load. How to fix Improper Resource Shutdown or Release? Upgrade | [,9.0.110)[10.0.0-M1,10.1.47)[11.0.0-M1,11.0.12) |
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Session Fixation via the How to fix Session Fixation? Upgrade | [9.0.0.M1,9.0.106)[10.1.0-M1,10.1.42)[11.0.0-M1,11.0.8) |
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Improper Resource Shutdown or Release via the HTTP/2 Handler. An attacker can cause a denial of service by sending specially crafted requests that exploit improper handling of resource shutdown. How to fix Improper Resource Shutdown or Release? Upgrade | [9.0.0.M1,9.0.108)[10.1.0-M1,10.1.44)[11.0.0-M1,11.0.10) |
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via HTTP/2 multiplexing feature. an attacker can trigger resource exhaustion by creating excessive HTTP/2 streams within a single TCP connection. How to fix Allocation of Resources Without Limits or Throttling? Upgrade | [9.0.0.M1,9.0.107)[10.1.0-M1,10.1.43)[11.0.0-M1,11.0.9) |
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Integer Overflow or Wraparound via file uploads through servlet containers. An attacker can craft malicious multipart/form-data requests with specially crafted Content-Length headers that trigger integer overflow vulnerabilities, potentially bypassing file size restrictions and causing memory exhaustion. How to fix Integer Overflow or Wraparound? Upgrade | [9.0.0.M1,9.0.107)[10.0.0-M1,10.1.43)[11.0.0-M1,11.0.9) |
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the uniform handling of request parameters and parts in multipart requests. An attacker can craft a malicious request with a large number of parts, which can lead to a Denial of Service. How to fix Allocation of Resources Without Limits or Throttling? Upgrade | [,9.0.106)[10.1.0-M1,10.1.42)[11.0.0-M1,11.0.8) |
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel due to how How to fix Authentication Bypass Using an Alternate Path or Channel? Upgrade | [,9.0.106)[10.1.0-M1,10.1.42)[11.0.0-M1,11.0.8) |
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the How to fix Improper Handling of Case Sensitivity? Upgrade | [9.0.0.M1,9.0.105)[10.1.0-M1,10.1.41)[11.0.0-M1,11.0.7) |
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Improper Cleanup on Thrown Exception when handling failed HTTP/2 requests with certain invalid HTTP priority headers. An attacker can trigger an Note: The project maintainers note that version 9.0.103 also fixes the vulnerability but was never officially released. How to fix Improper Cleanup on Thrown Exception? Upgrade | [9.0.76,9.0.104)[10.1.10,10.1.40)[11.0.0-M2,11.0.6) |
org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Improper Neutralization in the Note: The project maintainers note that version 9.0.103 also fixes the vulnerability but was never officially released. How to fix Improper Neutralization? Upgrade | [9.0.76,9.0.104)[10.1.10,10.1.40)[11.0.0-M2,11.0.6) |