tomcat9 vulnerabilities (Debian)
120 vulnerabilities.
-
tomcat9Debian Apache Tomcat: HTTP/2 request/response mix-up after error during async processing 9.1 Critical -
tomcat9Debian Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms 9.1 Critical -
tomcat9Debian Apache Tomcat: Possible TLS 1.3 connection failures 7.5 High -
tomcat9Debian Apache Tomcat: HTTP/2 trailer header cross-contamination 7.5 High -
tomcat9Debian Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector 8.1 High -
tomcat9Debian Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) 6.1 Medium -
tomcat9Debian Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up 6.5 Medium -
tomcat9Debian Apache Tomcat: WebSocket message smuggling with per-message-deflate 7.5 High -
tomcat9Debian Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up 9.1 Critical -
tomcat9Debian Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled 9.8 Critical -
tomcat9Debian Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout 7.5 High -
tomcat9Debian Apache Tomcat: HTTP/2 DoS via malformed request 7.3 High -
tomcat9Debian Apache Tomcat: AJP DoS via missing request body 7.5 High -
tomcat9Debian Apache Tomcat: DoS via busy wait during WebSocket close 7.5 High -
tomcat9Debian Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request 8.1 High -
tomcat9Debian Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests 3.7 Low -
tomcat9Debian Apache Tomcat: Bypass of security constraints for WebSocket endpoints 9.8 Critical -
tomcat9Debian Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured 7.3 High -
tomcat9Debian Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore 6.5 Medium -
tomcat9Debian Apache Tomcat: Principal lookup can fail open in some cases 8.1 High -
tomcat9Debian Apache Tomcat: Authenticated WebSocket session survives end of HTTP session 6.8 Medium -
tomcat9Debian Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset 7.5 High -
tomcat9Debian Apache Tomcat: Redirect after FORM auth may bypass method specific constraints 9.1 Critical -
tomcat9Debian Apache Tomcat: Servlet role references can bypass declarative role constraints 8.1 High -
tomcat9Debian Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control 7.5 High -
tomcat9Debian Apache Tomcat: Limited replay attack possible with DIGEST authentication 9.8 Critical -
tomcat9Debian Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete 9.8 Critical -
tomcat9Debian Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets 8.1 High -
tomcat9Debian Apache Tomcat: Bypass longest prefix security constraint 9.1 Critical -
tomcat9Debian Apache Tomcat: DoS via WebSocket chat example 5.3 Medium -
tomcat9Debian Apache Tomcat: EncryptInterceptor requirements not clearly documented 9.1 Critical -
tomcat9Debian Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass 9.1 Critical -
tomcat9Debian Apache Tomcat: Security constraints for default servlet ignored method 6.5 Medium -
tomcat9Debian Apache Tomcat: EncryptInterceptor not protected against replay attacks 6.5 Medium -
tomcat9Debian Apache Tomcat: Logged effective web.xml is incomplete 9.1 Critical -
tomcat9Debian Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector 9.1 Critical -
tomcat9Debian Apache Tomcat: Bad ornext processing in RewriteValve 7.3 High -
tomcat9Debian Apache Tomcat: XSS in number guess example 6.1 Medium -
tomcat9Debian Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind 7.3 High -
tomcat9Debian Apache Tomcat: Security constraints not correctly applied 9.1 Critical -
tomcat9Debian Apache Tomcat: AJP secret compared in non-constant time 3.7 Low -
tomcat9Debian Apache Tomcat: LockOutRealm treats user names as case-sensitive 7.5 High -
tomcat9Debian Apache Tomcat: Digest authenticator will authenticate any unknown user 9.8 Critical -
tomcat9Debian Apache Tomcat: HTTP/2 request headers not validated 9.8 Critical -
tomcat9Debian Apache Tomcat: WebSocket authentication header exposure 7.3 High -
tomcat9Debian Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling 7.5 High -
tomcat9Debian Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled 6.5 Medium -
tomcat9Debian Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token 7.5 High -
tomcat9Debian Apache Tomcat: Incomplete escaping of JSON access logs 7.5 High -
tomcat9Debian Apache Tomcat: Fix for CVE-2025-66614 is incomplete 5.3 Medium - Show olderLoading…