GCVE - cpe:2.3:a:apache:tomcat:10.0.0:-:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:tomcat:10.0.0:-:*:*:*:*:*:*

part: a version: 10.0.0 update: -

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Tomcat (`caaa56d3-0cc4-5735-aab9-a3a1a7f4dc56`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/tomcat`	purl2cpe	2026-06-01 10:14:26.931797
`pkg:github/apache/tomcat`	purl2cpe	2026-06-01 10:14:26.931799
`pkg:maven/org.apache.tomcat/tomcat`	purl2cpe	2026-06-01 10:14:26.931801
`pkg:rpm/fedora/tomcat`	purl2cpe	2026-06-01 10:14:26.931802
`pkg:rpm/opensuse/tomcat`	purl2cpe	2026-06-01 10:14:26.931803

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-25329`	vulnerable	2026-06-08 05:30:40.681730	Incomplete fix for CVE-2020-9484 The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue. Published: 2021-03-01T12:00:20.000Z Updated: 2025-02-13T16:27:48.719Z Open on db.gcve.eu Reference links https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.apache.org%3E https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cusers.tomcat.apache.org%3E https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-25122`	vulnerable	2026-06-08 05:30:40.022872	Apache Tomcat h2c request mix-up When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request. Published: 2021-03-01T12:00:20.000Z Updated: 2025-02-13T16:27:48.175Z Open on db.gcve.eu Reference links https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cusers.tomcat.apache.org%3E https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.