https://vulnerability.circl.lu Vulnerabilities published under the CPE names of the products of Apache Software Foundation. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 17:35:18 +0000 https://vulnerability.circl.lu/vuln/cve-2022-25762 Response mix-up with WebSocket concurrent send and close Response mix-up with WebSocket concurrent send and close https://vulnerability.circl.lu/vuln/cve-2022-25762 Fri, 13 May 2022 07:50:09 +0000 https://vulnerability.circl.lu/vuln/cve-2020-8022 User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges https://vulnerability.circl.lu/vuln/cve-2020-8022 Mon, 29 Jun 2020 08:20:12 +0000 https://vulnerability.circl.lu/vuln/cve-2020-13934 An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service. An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service. https://vulnerability.circl.lu/vuln/cve-2020-13934 Tue, 14 Jul 2020 14:59:11 +0000 https://vulnerability.circl.lu/vuln/cve-2020-11996 A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive. A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive. https://vulnerability.circl.lu/vuln/cve-2020-11996 Fri, 26 Jun 2020 16:27:20 +0000 https://vulnerability.circl.lu/vuln/cve-2020-13943 If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. https://vulnerability.circl.lu/vuln/cve-2020-13943 Mon, 12 Oct 2020 13:46:47 +0000 https://vulnerability.circl.lu/vuln/cve-2021-41079 Apache Tomcat DoS with unexpected TLS packet Apache Tomcat DoS with unexpected TLS packet https://vulnerability.circl.lu/vuln/cve-2021-41079 Thu, 16 Sep 2021 14:40:25 +0000 https://vulnerability.circl.lu/vuln/cve-2020-17527 Apache Tomcat: Request header mix-up between HTTP/2 streams Apache Tomcat: Request header mix-up between HTTP/2 streams https://vulnerability.circl.lu/vuln/cve-2020-17527 Thu, 03 Dec 2020 18:30:14 +0000 https://vulnerability.circl.lu/vuln/cve-2021-33037 Incorrect Transfer-Encoding handling with HTTP/1.0 Incorrect Transfer-Encoding handling with HTTP/1.0 https://vulnerability.circl.lu/vuln/cve-2021-33037 Mon, 12 Jul 2021 14:55:15 +0000 https://vulnerability.circl.lu/vuln/cve-2016-0762 The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. https://vulnerability.circl.lu/vuln/cve-2016-0762 Thu, 10 Aug 2017 16:00:00 +0000 https://vulnerability.circl.lu/vuln/cve-2023-42794 Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows https://vulnerability.circl.lu/vuln/cve-2023-42794 Tue, 10 Oct 2023 17:17:01 +0000