org.apache.tomcat.embed:tomcat-embed-core

Maven78 known CVEs affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting org.apache.tomcat.embed:tomcat-embed-corepage 1 of 2

CVE-2008-1947MEDIUMCVSS v2 4.3EG 4.3fixed in 5.5.27 or 6.0.18, by version range
2008-06-04
Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html…
CVE-2014-0095MEDIUMCVSS v2 5.0EG 5.0fixed in 8.0.4
2014-05-31
vulnerable: 8.0.0-RC1 ... 8.0.3 (6 versions)
java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request proces…
CVE-2017-12615CRITICALCVSS 8.1EG 9.0⚠ KEVfixed in 7.0.79
2017-09-19
vulnerable: 7.0.0 ... 7.0.8 (54 versions)
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted reques…
CVE-2017-12617CRITICALCVSS 8.1EG 9.0⚠ KEVfixed in 9.0.1, 8.5.23, 8.0.47 or 7.0.82, by version range
2017-10-04
vulnerable: 7.0.0 ... 7.0.81 (56 versions)
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible…
CVE-2017-5648CRITICALCVSS 9.1EG 9.1fixed in 9.0.0.M18, 8.5.13, 8.0.42 or 7.0.76, by version range
2017-04-17
vulnerable: 7.0.0 ... 7.0.8 (51 versions)
While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When runnin…
CVE-2017-5651CRITICALCVSS 9.8EG 9.8fixed in 9.0.0.M19 or 8.5.13, by version range
2017-04-17
vulnerable: 8.5.0 ... 8.5.9 (10 versions)
In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be …
CVE-2018-11784CRITICALCVSS 4.3EG 9.0fixed in 8.5.34, 7.0.91 or 9.0.12, by version range
2018-10-04
vulnerable: 9.0.1 ... 9.0.8 (9 versions)
When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be us…
CVE-2018-1304MEDIUMCVSS 5.9EG 5.9fixed in 9.0.5, 8.5.28, 8.0.51 or 7.0.86, by version range
2018-02-28
vulnerable: 7.0.0 ... 7.0.85 (59 versions)
The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constrai…
CVE-2018-1305MEDIUMCVSS 6.5EG 6.5fixed in 9.0.5, 8.5.28 or 7.0.85, by version range
2018-02-23
vulnerable: 7.0.0 ... 7.0.84 (58 versions)
Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in …
CVE-2018-1336HIGHCVSS 7.5EG 7.5fixed in 9.0.8, 8.5.31, 8.0.51 or 7.0.87, by version range
2018-08-02
vulnerable: 7.0.28 ... 7.0.86 (42 versions)
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8…
CVE-2018-8014CRITICALCVSS 9.8EG 9.8fixed in 9.0.9, 8.5.32, 8.0.53 or 7.0.88, by version range
2018-05-16
vulnerable: 7.0.41 ... 7.0.86 (32 versions)
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the C…
CVE-2018-8034HIGHCVSS 7.5EG 7.5fixed in 9.0.10, 8.5.32, 8.0.53 or 7.0.90, by version range
2018-08-01
vulnerable: 7.0.35 ... 7.0.88 (37 versions)
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
CVE-2018-8037MEDIUMCVSS 5.9EG 5.9fixed in 9.0.10 or 8.5.32, by version range
2018-08-02
vulnerable: 8.5.11 ... 8.5.9 (20 versions)
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue w…
CVE-2019-0199HIGHCVSS 7.5EG 8.7fixed in 9.0.16 or 8.5.38, by version range
2019-04-10
vulnerable: 8.0.1 ... 8.5.9 (70 versions)
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By …
CVE-2019-0221HIGHCVSS 6.1EG 7.6fixed in 9.0.17, 8.5.40 or 7.0.94, by version range
2019-05-28
vulnerable: 7.0.0 ... 7.0.93 (65 versions)
The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intend…
CVE-2019-0232CRITICALCVSS 8.1EG 9.0fixed in 9.0.17, 8.5.40 or 7.0.94, by version range
2019-04-15
vulnerable: 7.0.0 ... 7.0.93 (65 versions)
When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command lin…
CVE-2019-10072HIGHCVSS 7.5EG 8.7fixed in 9.0.20 or 8.5.41, by version range
2019-06-21
vulnerable: 8.5.0 ... 8.5.9 (32 versions)
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (s…
CVE-2019-12418HIGHCVSS 7.0EG 7.0fixed in 7.0.99, 8.5.49 or 9.0.29, by version range
2019-12-23
vulnerable: 9.0.1 ... 9.0.8 (21 versions)
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI regis…
CVE-2019-17563HIGHCVSS 7.5EG 7.5fixed in 7.0.99, 8.5.50 or 9.0.30, by version range
2019-12-23
vulnerable: 9.0.1 ... 9.0.8 (22 versions)
When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an expl…
CVE-2019-17569MEDIUMCVSS 4.8EG 4.8fixed in 7.0.100, 8.5.51 or 9.0.31, by version range
2020-02-24
vulnerable: 9.0.29, 9.0.30
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possi…
CVE-2020-11996HIGHCVSS 7.5EG 7.5fixed in 10.0.0-M5, 9.0.35 or 8.5.55, by version range
2020-06-26
vulnerable: 8.5.0 ... 8.5.9 (43 versions)
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on con…
CVE-2020-1935MEDIUMCVSS 4.8EG 4.8fixed in 7.0.100, 8.5.51 or 9.0.31, by version range
2020-02-24
vulnerable: 9.0.1 ... 9.0.8 (23 versions)
In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP R…
CVE-2020-1938CRITICALCVSS 9.8EG 9.8⚠ KEVfixed in 9.0.31, 8.5.51 or 7.0.100, by version range
2020-02-24
vulnerable: 7.0.0 ... 7.0.99 (68 versions)
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are …
CVE-2020-9484HIGHCVSS 7.0EG 7.9fixed in 10.0.0-M5, 9.0.35, 8.5.55 or 7.0.104, by version range
2020-05-20
vulnerable: 7.0.0 ... 7.0.99 (70 versions)
When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use t…
CVE-2021-24122MEDIUMCVSS 5.9EG 5.9fixed in 10.0.0-M10, 9.0.40, 8.5.60 or 7.0.107, by version range
2021-01-14
vulnerable: 7.0.0 ... 7.0.99 (73 versions)
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some confi…
CVE-2021-25122HIGHCVSS 7.5EG 7.5fixed in 10.0.2, 9.0.43 or 8.5.63, by version range
2021-03-01
vulnerable: 8.5.0 ... 8.5.9 (50 versions)
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning use…
CVE-2021-25329HIGHCVSS 7.0EG 7.0fixed in 10.0.2, 9.0.41, 8.5.61 or 7.0.108, by version range
2021-03-01
vulnerable: 7.0.0 ... 7.0.99 (74 versions)
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was st…
CVE-2022-42252HIGHCVSS 7.5EG 7.5fixed in 8.5.83, 9.0.68, 10.0.27 or 10.1.1, by version range
2022-11-01
vulnerable: 10.1.0 ... 10.1.0-M8 (15 versions)
If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a …
CVE-2022-45143HIGHCVSS 7.5EG 7.5fixed in 8.5.84, 9.0.69 or 10.1.2, by version range
2023-01-03
vulnerable: 10.1.0, 10.1.1
The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore pos…
CVE-2023-24998HIGHCVSS 7.5EG 8.0fixed in 10.1.5, 11.0.0-M5, 8.5.88 or 9.0.71, by version range
2023-02-20
vulnerable: 9.0.0.M1 ... 9.0.8 (74 versions)
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file …
CVE-2023-28709HIGHCVSS 7.5EG 8.0fixed in 11.0.0-M5, 10.1.8 or 9.0.74, by version range
2023-05-22
vulnerable: 9.0.71, 9.0.72, 9.0.73
The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be r…
CVE-2023-34981HIGHCVSS 7.5EG 7.5fixed in 11.0.0-M6, 10.1.9 or 9.0.75, by version range
2023-06-21
vulnerable: 9.0.74
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at l…
CVE-2023-41080MEDIUMCVSS 6.1EG 6.1fixed in 8.5.93, 9.0.80, 10.1.13 or 11.0.0-M11, by version range
2023-08-25
vulnerable: 11.0.0-M1 ... 11.0.0-M9 (8 versions)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.7…
CVE-2023-42795MEDIUMCVSS 5.3EG 5.3fixed in 10.1.14, 9.0.81, 8.5.94 or 11.0.0-M12, by version range
2023-10-10
vulnerable: 11.0.0-M1 ... 11.0.0-M9 (9 versions)
Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an er…
CVE-2023-44487CRITICALCVSS 7.5EG 9.0⚠ KEVfixed in 11.0.0-M12, 10.1.14, 9.0.81 or 8.5.94, by version range
2023-10-10
vulnerable: 8.5.0 ... 8.5.93 (78 versions)
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2023-45648MEDIUMCVSS 5.3EG 5.3fixed in 11.0.0-M12, 10.1.14, 9.0.81 or 8.5.94, by version range
2023-10-10
vulnerable: 8.5.0 ... 8.5.93 (78 versions)
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A …
CVE-2023-46589HIGHCVSS 7.5EG 7.5fixed in 11.0.0-M11, 10.1.16, 9.0.83 or 8.5.96, by version range
2023-11-28
vulnerable: 8.5.0 ... 8.5.95 (80 versions)
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A t…
CVE-2024-21733MEDIUMCVSS 5.3EG 5.3fixed in 8.5.64 or 9.0.44, by version range
2024-01-19
vulnerable: 9.0.0.M1 ... 9.0.8 (53 versions)
Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are r…
CVE-2024-24549HIGHCVSS 7.5EG 7.5fixed in 8.5.99, 9.0.86, 10.1.19 or 11.0.0-M17, by version range
2024-03-13
vulnerable: 11.0.0-M1 ... 11.0.0-M9 (14 versions)
Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was no…
CVE-2024-34750HIGHCVSS 7.5EG 7.5fixed in 11.0.0-M21, 10.1.25 or 9.0.90, by version range
2024-07-03
vulnerable: 8.5.0 ... 8.5.99 (85 versions)
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscountin…
CVE-2024-38286HIGHCVSS 8.6EG 8.6fixed in 11.0.0-M21, 10.1.25 or 9.0.90, by version range
2024-11-07
vulnerable: 7.0.100 ... 7.0.99 (13 versions)
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions…
CVE-2024-50379CRITICALCVSS 9.8EG 9.8fixed in 11.0.2, 10.1.34 or 9.0.98, by version range
2024-12-17
vulnerable: 8.5.0 ... 8.5.99 (85 versions)
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue …
CVE-2024-52317MEDIUMCVSS 6.5EG 6.5fixed in 9.0.96, 10.1.31 or 11.0.0, by version range
2024-11-18
vulnerable: 11.0.0-M24, 11.0.0-M25, 11.0.0-M26
Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat:…
CVE-2024-56337CRITICALCVSS 9.8EG 9.8fixed in 11.0.2, 10.1.34 or 9.0.98, by version range
2024-12-20
vulnerable: 9.0.0.M1 ... 9.0.97 (99 versions)
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were E…
CVE-2025-24813CRITICALCVSS 9.8EG 9.8⚠ KEVfixed in 11.0.3, 10.1.35 or 9.0.99, by version range
2025-03-10
vulnerable: 8.5.0 ... 8.5.99 (85 versions)
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache…
CVE-2025-31650HIGHCVSS 7.5EG 8.5fixed in 9.0.104, 10.1.40 or 11.0.6, by version range
2025-04-28
vulnerable: 8.5.0 ... 8.5.99 (85 versions)
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests co…
CVE-2025-31651CRITICALCVSS 9.8EG 9.8fixed in 9.0.104, 10.1.40 or 11.0.6, by version range
2025-04-28
vulnerable: 8.5.0 ... 8.5.99 (85 versions)
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those r…
CVE-2025-46701HIGHCVSS 7.3EG 7.3fixed in 9.0.105, 10.1.41 or 11.0.7, by version range
2025-05-29
vulnerable: 8.5.0 ... 8.5.99 (85 versions)
Improper Handling of Case Sensitivity vulnerability in Apache Tomcat's GCI servlet allows security constraint bypass of security constraints that apply to the pathInfo component of a URI mapped to the CGI servlet. This issue affects Apach…
CVE-2025-48988HIGHCVSS 7.5EG 8.1fixed in 11.0.8, 10.1.42 or 9.0.106, by version range
2025-06-16
vulnerable: 8.5.0 ... 8.5.99 (85 versions)
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions we…
CVE-2025-48989HIGHCVSS 7.5EG 7.5fixed in 11.0.10, 10.1.44 or 9.0.108, by version range
2025-08-13
vulnerable: 9.0.0.M1 ... 9.0.99 (107 versions)
Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 th…

Check whether org.apache.tomcat.embed:tomcat-embed-core is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.apache.tomcat.embed:tomcat-embed-core CVEs against the assets you own.

Book a Demo →