GCVE - cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:tomcat:8.5.15:*:*:*:*:*:*:*

part: a version: 8.5.15 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Tomcat (`caaa56d3-0cc4-5735-aab9-a3a1a7f4dc56`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/tomcat`	purl2cpe	2026-06-01 10:14:27.668948
`pkg:github/apache/tomcat`	purl2cpe	2026-06-01 10:14:27.668949
`pkg:maven/org.apache.tomcat/tomcat`	purl2cpe	2026-06-01 10:14:27.668951
`pkg:rpm/fedora/tomcat`	purl2cpe	2026-06-01 10:14:27.668952
`pkg:rpm/opensuse/tomcat`	purl2cpe	2026-06-01 10:14:27.668953

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-13943`	vulnerable	2026-06-08 05:18:01.503083	Details available If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources. Published: 2020-10-12T13:46:47.000Z Updated: 2024-08-04T12:32:14.470Z Open on db.gcve.eu Reference links https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html https://www.debian.org/security/2021/dsa-4835	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-7675`	vulnerable	2026-06-08 05:10:05.854786	Details available The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL. Published: 2017-08-11T02:00:00.000Z Updated: 2024-09-17T03:48:21.726Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/100256 https://security.netapp.com/advisory/ntap-20180614-0003/ http://www.debian.org/security/2017/dsa-3974 https://lists.apache.org/thread.html/d3a5818e8af731bde6a05ef031ed3acc093c6dd7c4bfcc4936eafd6c%40%3Cannounce.tomcat.apache.org%3E https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-7674`	vulnerable	2026-06-08 05:10:05.842527	Details available The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances. Published: 2017-08-11T02:00:00.000Z Updated: 2024-09-17T03:47:49.467Z Open on db.gcve.eu Reference links https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us https://access.redhat.com/errata/RHSA-2017:1801 https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f%40%3Cannounce.tomcat.apache.org%3E https://security.netapp.com/advisory/ntap-20180614-0003/ http://www.securityfocus.com/bid/100280	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.