org.apache.tomcat.experimental:tomcat-embed-programmatic 10.1.0-M2

Direct Vulnerabilities

Known vulnerabilities in the org.apache.tomcat.experimental:tomcat-embed-programmatic package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Authentication Bypass by Primary Weakness Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the `getServerAuthConfig` method in `SimpleAuthConfigProvider`. When Jakarta Authentication uses this provider as the default for multiple web applications, its cached configuration retains the realm of the first application to authenticate a request. An attacker can send requests to another application and have them authenticated against that first realm, potentially gaining access to resources protected by the other application’s intended authentication. How to fix Authentication Bypass by Primary Weakness? Upgrade `org.apache.tomcat.experimental:tomcat-embed-programmatic` to version 9.0.122, 10.1.60, 11.0.26 or higher.	[9.0.0.M4,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)
M Incorrect Synchronization Affected versions of this package are vulnerable to Incorrect Synchronization via the shared header emitter in the HTTP/2 `HpackDecoder`. An attacker can inject trailer fields into another HTTP/2 request by sending requests that cause a stream to be reset and replaced while headers are being decoded, making the server process the other request with attacker-supplied trailer data. Notes At the decoder-to-request handoff, the affected and attacker-controlled streams must be on the same HTTP/2 connection, whose `HpackDecoder` shares the header emitter. How to fix Incorrect Synchronization? Upgrade `org.apache.tomcat.experimental:tomcat-embed-programmatic` to version 9.0.122, 10.1.60, 11.0.26 or higher.	[9.0.39,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)
M HTTP Request Smuggling Affected versions of this package are vulnerable to HTTP Request Smuggling via the `Http11Processor` in the HTTP/1.x request-processing component. An attacker can cause one request from another user to fail by sending an HTTP/1.0 request with a `Transfer-Encoding` header when Tomcat is behind a reverse proxy that interprets the request differently. How to fix HTTP Request Smuggling? Upgrade `org.apache.tomcat.experimental:tomcat-embed-programmatic` to version 9.0.122, 10.1.60, 11.0.26 or higher.	[8.5.67,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)

Vulnerability

Vulnerable Version

Authentication Bypass by Primary Weakness

Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the getServerAuthConfig method in SimpleAuthConfigProvider. When Jakarta Authentication uses this provider as the default for multiple web applications, its cached configuration retains the realm of the first application to authenticate a request. An attacker can send requests to another application and have them authenticated against that first realm, potentially gaining access to resources protected by the other application’s intended authentication.

How to fix Authentication Bypass by Primary Weakness?

Upgrade org.apache.tomcat.experimental:tomcat-embed-programmatic to version 9.0.122, 10.1.60, 11.0.26 or higher.

[9.0.0.M4,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)

Incorrect Synchronization

Affected versions of this package are vulnerable to Incorrect Synchronization via the shared header emitter in the HTTP/2 HpackDecoder. An attacker can inject trailer fields into another HTTP/2 request by sending requests that cause a stream to be reset and replaced while headers are being decoded, making the server process the other request with attacker-supplied trailer data.

Notes

At the decoder-to-request handoff, the affected and attacker-controlled streams must be on the same HTTP/2 connection, whose HpackDecoder shares the header emitter.

How to fix Incorrect Synchronization?

Upgrade org.apache.tomcat.experimental:tomcat-embed-programmatic to version 9.0.122, 10.1.60, 11.0.26 or higher.

[9.0.39,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)

HTTP Request Smuggling

Affected versions of this package are vulnerable to HTTP Request Smuggling via the Http11Processor in the HTTP/1.x request-processing component. An attacker can cause one request from another user to fail by sending an HTTP/1.0 request with a Transfer-Encoding header when Tomcat is behind a reverse proxy that interprets the request differently.

How to fix HTTP Request Smuggling?

Upgrade org.apache.tomcat.experimental:tomcat-embed-programmatic to version 9.0.122, 10.1.60, 11.0.26 or higher.

[8.5.67,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)

org.apache.tomcat.experimental:tomcat-embed-programmatic@10.1.0-M2

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically