org.apache.tomcat.experimental:tomcat-embed-programmatic 9.0.38

Direct Vulnerabilities

Known vulnerabilities in the org.apache.tomcat.experimental:tomcat-embed-programmatic package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Authentication Bypass by Primary Weakness Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the `getServerAuthConfig` method in `SimpleAuthConfigProvider`. When Jakarta Authentication uses this provider as the default for multiple web applications, its cached configuration retains the realm of the first application to authenticate a request. An attacker can send requests to another application and have them authenticated against that first realm, potentially gaining access to resources protected by the other application’s intended authentication. How to fix Authentication Bypass by Primary Weakness? Upgrade `org.apache.tomcat.experimental:tomcat-embed-programmatic` to version 9.0.122, 10.1.60, 11.0.26 or higher.	[9.0.0.M4,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)
M HTTP Request Smuggling Affected versions of this package are vulnerable to HTTP Request Smuggling via the `Http11Processor` in the HTTP/1.x request-processing component. An attacker can cause one request from another user to fail by sending an HTTP/1.0 request with a `Transfer-Encoding` header when Tomcat is behind a reverse proxy that interprets the request differently. How to fix HTTP Request Smuggling? Upgrade `org.apache.tomcat.experimental:tomcat-embed-programmatic` to version 9.0.122, 10.1.60, 11.0.26 or higher.	[8.5.67,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)

Vulnerability

Vulnerable Version

Authentication Bypass by Primary Weakness

Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the getServerAuthConfig method in SimpleAuthConfigProvider. When Jakarta Authentication uses this provider as the default for multiple web applications, its cached configuration retains the realm of the first application to authenticate a request. An attacker can send requests to another application and have them authenticated against that first realm, potentially gaining access to resources protected by the other application’s intended authentication.

How to fix Authentication Bypass by Primary Weakness?

Upgrade org.apache.tomcat.experimental:tomcat-embed-programmatic to version 9.0.122, 10.1.60, 11.0.26 or higher.

[9.0.0.M4,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)

HTTP Request Smuggling

Affected versions of this package are vulnerable to HTTP Request Smuggling via the Http11Processor in the HTTP/1.x request-processing component. An attacker can cause one request from another user to fail by sending an HTTP/1.0 request with a Transfer-Encoding header when Tomcat is behind a reverse proxy that interprets the request differently.

How to fix HTTP Request Smuggling?

Upgrade org.apache.tomcat.experimental:tomcat-embed-programmatic to version 9.0.122, 10.1.60, 11.0.26 or higher.

[8.5.67,9.0.122)[10.1.0-M1,10.1.60)[11.0.0-M1,11.0.26)

org.apache.tomcat.experimental:tomcat-embed-programmatic@9.0.38

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically