org.apache.tomcat.experimental:tomcat-embed-programmatic 11.0.23

Direct Vulnerabilities

Known vulnerabilities in the org.apache.tomcat.experimental:tomcat-embed-programmatic package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Incomplete Cleanup Affected versions of this package are vulnerable to Incomplete Cleanup via handshake-wrap state handling in the `SecureNioChannel` component. A TLS client can trigger intermittent TLS 1.3 connection failures by sending traffic that leaves a handshake wrap pending; after the channel wraps application data, its handshake-progress flag remains stale, so subsequent handshake processing throws an I/O error and the connection fails. How to fix Incomplete Cleanup? Upgrade `org.apache.tomcat.experimental:tomcat-embed-programmatic` to version 9.0.123, 10.1.61, 11.0.27 or higher.	[9.0.90,9.0.123)[10.1.25,10.1.61)[11.0.0-M21,11.0.27)
M Incomplete Cleanup Affected versions of this package are vulnerable to Incomplete Cleanup via the `StreamProcessor` request-recycling path in the HTTP/2 connector. An attacker can cause one request from another user to fail by sending a malformed HTTP/2 request that sets the per-request `NOTE_BAD_REQUEST` marker; because the marker is not cleared when the request is recycled and is only cleared during bad-request validation, it can persist into a reused request, depending on timing. Notes The malformed-request entry point is an incorrectly formatted HTTP/2 `:authority` or `host` header; other malformed requests are not identified as setting this bad-request marker. How to fix Incomplete Cleanup? Upgrade `org.apache.tomcat.experimental:tomcat-embed-programmatic` to version 9.0.122, 10.1.60, 11.0.26 or higher.	[9.0.116,9.0.122)[10.1.53,10.1.60)[11.0.19,11.0.26)
M Authentication Bypass by Primary Weakness Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the `getServerAuthConfig` method in `SimpleAuthConfigProvider`. When Jakarta Authentication uses this provider as the default for multiple web applications, its cached configuration retains the realm of the first application to authenticate a request. An attacker can send requests to another application and have them authenticated against that first realm, potentially gaining access to resources protected by the other application’s intended authentication. How to fix Authentication Bypass by Primary Weakness? Upgrade `org.apache.tomcat.experimental:tomcat-embed-programmatic` to version 9.0.122, 10.1.60, 11.0.26 or higher.	[9.0.0.M4,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)
M Incorrect Synchronization Affected versions of this package are vulnerable to Incorrect Synchronization via the shared header emitter in the HTTP/2 `HpackDecoder`. An attacker can inject trailer fields into another HTTP/2 request by sending requests that cause a stream to be reset and replaced while headers are being decoded, making the server process the other request with attacker-supplied trailer data. Notes At the decoder-to-request handoff, the affected and attacker-controlled streams must be on the same HTTP/2 connection, whose `HpackDecoder` shares the header emitter. How to fix Incorrect Synchronization? Upgrade `org.apache.tomcat.experimental:tomcat-embed-programmatic` to version 9.0.122, 10.1.60, 11.0.26 or higher.	[9.0.39,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)
C HTTP Request Smuggling Affected versions of this package are vulnerable to HTTP Request Smuggling via inconsistent HTTP/2 header decoding in `HpackDecoder` and header processing in `Stream`. An attacker can trigger a request-header mix-up by sending crafted HTTP/2 headers, causing Tomcat to interpret requests inconsistently; this regression was introduced by the fix for CVE-2026-41293. How to fix HTTP Request Smuggling? Upgrade `org.apache.tomcat.experimental:tomcat-embed-programmatic` to version 9.0.122, 10.1.60, 11.0.26 or higher.	[9.0.118,9.0.122)[10.1.55,10.1.60)[11.0.22,11.0.26)
M HTTP Request Smuggling Affected versions of this package are vulnerable to HTTP Request Smuggling via the `Http11Processor` in the HTTP/1.x request-processing component. An attacker can cause one request from another user to fail by sending an HTTP/1.0 request with a `Transfer-Encoding` header when Tomcat is behind a reverse proxy that interprets the request differently. How to fix HTTP Request Smuggling? Upgrade `org.apache.tomcat.experimental:tomcat-embed-programmatic` to version 9.0.122, 10.1.60, 11.0.26 or higher.	[8.5.67,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)

Vulnerability

Vulnerable Version

Incomplete Cleanup

Affected versions of this package are vulnerable to Incomplete Cleanup via handshake-wrap state handling in the SecureNioChannel component. A TLS client can trigger intermittent TLS 1.3 connection failures by sending traffic that leaves a handshake wrap pending; after the channel wraps application data, its handshake-progress flag remains stale, so subsequent handshake processing throws an I/O error and the connection fails.

How to fix Incomplete Cleanup?

Upgrade org.apache.tomcat.experimental:tomcat-embed-programmatic to version 9.0.123, 10.1.61, 11.0.27 or higher.

[9.0.90,9.0.123)[10.1.25,10.1.61)[11.0.0-M21,11.0.27)

Incomplete Cleanup

Affected versions of this package are vulnerable to Incomplete Cleanup via the StreamProcessor request-recycling path in the HTTP/2 connector. An attacker can cause one request from another user to fail by sending a malformed HTTP/2 request that sets the per-request NOTE_BAD_REQUEST marker; because the marker is not cleared when the request is recycled and is only cleared during bad-request validation, it can persist into a reused request, depending on timing.

Notes

The malformed-request entry point is an incorrectly formatted HTTP/2 :authority or host header; other malformed requests are not identified as setting this bad-request marker.

How to fix Incomplete Cleanup?

Upgrade org.apache.tomcat.experimental:tomcat-embed-programmatic to version 9.0.122, 10.1.60, 11.0.26 or higher.

[9.0.116,9.0.122)[10.1.53,10.1.60)[11.0.19,11.0.26)

Authentication Bypass by Primary Weakness

Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the getServerAuthConfig method in SimpleAuthConfigProvider. When Jakarta Authentication uses this provider as the default for multiple web applications, its cached configuration retains the realm of the first application to authenticate a request. An attacker can send requests to another application and have them authenticated against that first realm, potentially gaining access to resources protected by the other application’s intended authentication.

How to fix Authentication Bypass by Primary Weakness?

Upgrade org.apache.tomcat.experimental:tomcat-embed-programmatic to version 9.0.122, 10.1.60, 11.0.26 or higher.

[9.0.0.M4,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)

Incorrect Synchronization

Affected versions of this package are vulnerable to Incorrect Synchronization via the shared header emitter in the HTTP/2 HpackDecoder. An attacker can inject trailer fields into another HTTP/2 request by sending requests that cause a stream to be reset and replaced while headers are being decoded, making the server process the other request with attacker-supplied trailer data.

Notes

At the decoder-to-request handoff, the affected and attacker-controlled streams must be on the same HTTP/2 connection, whose HpackDecoder shares the header emitter.

How to fix Incorrect Synchronization?

Upgrade org.apache.tomcat.experimental:tomcat-embed-programmatic to version 9.0.122, 10.1.60, 11.0.26 or higher.

[9.0.39,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)

HTTP Request Smuggling

Affected versions of this package are vulnerable to HTTP Request Smuggling via inconsistent HTTP/2 header decoding in HpackDecoder and header processing in Stream. An attacker can trigger a request-header mix-up by sending crafted HTTP/2 headers, causing Tomcat to interpret requests inconsistently; this regression was introduced by the fix for CVE-2026-41293.

How to fix HTTP Request Smuggling?

Upgrade org.apache.tomcat.experimental:tomcat-embed-programmatic to version 9.0.122, 10.1.60, 11.0.26 or higher.

[9.0.118,9.0.122)[10.1.55,10.1.60)[11.0.22,11.0.26)

HTTP Request Smuggling

Affected versions of this package are vulnerable to HTTP Request Smuggling via the Http11Processor in the HTTP/1.x request-processing component. An attacker can cause one request from another user to fail by sending an HTTP/1.0 request with a Transfer-Encoding header when Tomcat is behind a reverse proxy that interprets the request differently.

How to fix HTTP Request Smuggling?

Upgrade org.apache.tomcat.experimental:tomcat-embed-programmatic to version 9.0.122, 10.1.60, 11.0.26 or higher.

[8.5.67,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)

org.apache.tomcat.experimental:tomcat-embed-programmatic@11.0.23

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically