Skip to content

spring-boot-starter-web-2.1.4.RELEASE.jar: 98 vulnerabilities (highest severity is: 9.8) #17

@mend-for-github-com

Description

@mend-for-github-com
Vulnerable Library - spring-boot-starter-web-2.1.4.RELEASE.jar

Starter for building web, including RESTful, applications using Spring MVC. Uses Tomcat as the default embedded container

Library home page: https://projects.spring.io/spring-boot/#/spring-boot-parent/spring-boot-starters/spring-boot-starter-web

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/boot/spring-boot-starter-web/2.1.4.RELEASE/spring-boot-starter-web-2.1.4.RELEASE.jar

Found in HEAD commit: 3c697156679612e93e2a8f1c4982c052a930d7d1

Vulnerabilities

Vulnerability Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (spring-boot-starter-web version) Remediation Possible** Reachability
CVE-2026-43512 Critical 9.8 Not Defined 0.139% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2026-41293 Critical 9.8 Not Defined 0.253% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2025-31651 Critical 9.8 Not Defined 0.199% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2025-24813 Critical 9.8 Functional 94.13% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2024-56337 Critical 9.8 Not Defined 13.16% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2024-52316 Critical 9.8 Not Defined 2.487% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2024-50379 Critical 9.8 Not Defined 84.776% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2022-22965 Critical 9.8 High 94.428% detected in multiple dependencies Direct org.springframework:spring-beans:5.2.20.RELEASE,5.3.18

Unreachable

CVE-2020-1938 Critical 9.8 High 94.469% tomcat-embed-core-9.0.17.jar Transitive N/A*

Unreachable

CVE-2025-55754 Critical 9.6 Not Defined 0.135% tomcat-embed-core-9.0.17.jar Transitive N/A*

Unreachable

CVE-2026-43515 Critical 9.1 Not Defined 0.095% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2020-5421 High 8.7 Not Defined 63.828% spring-web-5.1.6.RELEASE.jar Transitive 2.1.17.RELEASE

Unreachable

CVE-2024-38286 High 8.6 Not Defined 0.413% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2022-1471 High 8.3 Functional 93.849% snakeyaml-1.23.jar Transitive 3.2.0

Unreachable

CVE-2024-22262 High 8.1 Not Defined 12.634% spring-web-5.1.6.RELEASE.jar Transitive 3.0.0

Unreachable

CVE-2024-22259 High 8.1 Not Defined 56.395% spring-web-5.1.6.RELEASE.jar Transitive 3.0.0

Unreachable

CVE-2024-22243 High 8.1 Not Defined 60.124% spring-web-5.1.6.RELEASE.jar Transitive 3.0.0

Unreachable

CVE-2019-0232 High 8.1 Functional 94.221% tomcat-embed-core-9.0.17.jar Transitive N/A*

Unreachable

CVE-2020-5398 High 8.0 Not Defined 90.184% detected in multiple dependencies Transitive N/A*

Unreachable

CVE-2025-66614 High 7.6 Not Defined 0.051% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2026-43513 High 7.5 Not Defined 0.082% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2026-41284 High 7.5 Not Defined 0.051% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2026-34487 High 7.5 Not Defined 0.091% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2026-29146 High 7.5 Not Defined 12.919% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2026-24880 High 7.5 Not Defined 0.24% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2025-55752 High 7.5 Not Defined 0.215% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2025-53506 High 7.5 Not Defined 1.247% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2025-52520 High 7.5 Not Defined 0.683% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2025-52434 High 7.5 Not Defined 1.205% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2025-48989 High 7.5 Not Defined 1.022% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2025-48988 High 7.5 Not Defined 0.759% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2025-48976 High 7.5 Not Defined 1.278% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2025-31650 High 7.5 Not Defined 10.908% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2024-38819 High 7.5 Not Defined 93.306% spring-webmvc-5.1.6.RELEASE.jar Transitive 3.2.11

Unreachable

CVE-2024-38816 High 7.5 Not Defined 93.89% spring-webmvc-5.1.6.RELEASE.jar Transitive 3.2.10

Unreachable

CVE-2024-34750 High 7.5 Not Defined 21.98% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2024-24549 High 7.5 Not Defined 64.877% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2023-46589 High 7.5 Not Defined 53.735% tomcat-embed-core-9.0.17.jar Transitive 2.7.18

Unreachable

CVE-2023-44487 High 7.5 High 94.4% tomcat-embed-core-9.0.17.jar Transitive 2.7.17

Unreachable

CVE-2023-24998 High 7.5 Not Defined 33.9% tomcat-embed-core-9.0.17.jar Transitive 2.5.15

Unreachable

CVE-2022-42252 High 7.5 Not Defined 0.29% tomcat-embed-core-9.0.17.jar Transitive N/A*

Unreachable

CVE-2022-25857 High 7.5 Not Defined 2.92% snakeyaml-1.23.jar Transitive 3.0.0

Unreachable

CVE-2021-41079 High 7.5 Not Defined 0.103% tomcat-embed-core-9.0.17.jar Transitive 2.3.10.RELEASE

Unreachable

CVE-2021-25122 High 7.5 Not Defined 2.775% tomcat-embed-core-9.0.17.jar Transitive 2.3.9.RELEASE

Unreachable

CVE-2020-17527 High 7.5 Not Defined 10.506% tomcat-embed-core-9.0.17.jar Transitive 2.2.12.RELEASE

Unreachable

CVE-2020-13935 High 7.5 Not Defined 92.155% tomcat-embed-websocket-9.0.17.jar Transitive 2.1.16.RELEASE

Unreachable

CVE-2020-13934 High 7.5 Not Defined 23.38% tomcat-embed-core-9.0.17.jar Transitive 2.1.16.RELEASE

Unreachable

CVE-2020-11996 High 7.5 Not Defined 45.121% tomcat-embed-core-9.0.17.jar Transitive 2.1.15.RELEASE

Unreachable

CVE-2019-17563 High 7.5 Not Defined 4.359% tomcat-embed-core-9.0.17.jar Transitive N/A*

Unreachable

CVE-2017-18640 High 7.5 Not Defined 2.766% snakeyaml-1.23.jar Transitive 2.3.0.RELEASE

Unreachable

CVE-2026-42498 High 7.3 Not Defined 0.05% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2024-12798 High 7.3 Not Defined 0.169% detected in multiple dependencies Transitive 4.0.0

Unreachable

CVE-2023-6481 High 7.1 Not Defined 0.224% logback-core-1.2.3.jar Transitive N/A*

Unreachable

CVE-2023-6378 High 7.1 Not Defined 0.63% detected in multiple dependencies Transitive 3.2.1

Unreachable

CVE-2021-25329 High 7.0 Not Defined 0.802% tomcat-embed-core-9.0.17.jar Transitive 2.3.9.RELEASE

Unreachable

CVE-2020-9484 High 7.0 Not Defined 93.464% tomcat-embed-core-9.0.17.jar Transitive 2.1.15.RELEASE

Unreachable

CVE-2019-12418 High 7.0 Not Defined 0.481% tomcat-embed-core-9.0.17.jar Transitive N/A*

Unreachable

CVE-2025-11226 Medium 6.9 Not Defined 0.062% logback-core-1.2.3.jar Transitive 4.0.0

Unreachable

CVE-2021-42550 Medium 6.6 Not Defined 2.729% detected in multiple dependencies Transitive 2.5.8

Unreachable

CVE-2026-24733 Medium 6.5 Not Defined 0.163% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2025-55668 Medium 6.5 Not Defined 0.019% tomcat-embed-core-9.0.17.jar Transitive N/A*

Unreachable

CVE-2025-49125 Medium 6.5 Not Defined 0.189% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2025-46701 Medium 6.5 Not Defined 0.132% tomcat-embed-core-9.0.17.jar Transitive N/A*

Unreachable

CVE-2024-52317 Medium 6.5 Not Defined 21.5% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2022-38752 Medium 6.5 Not Defined 0.205% snakeyaml-1.23.jar Transitive 3.0.0

Unreachable

CVE-2022-38751 Medium 6.5 Not Defined 0.3% snakeyaml-1.23.jar Transitive 3.0.0

Unreachable

CVE-2022-38750 Medium 6.5 Not Defined 0.693% snakeyaml-1.23.jar Transitive 3.0.0

Unreachable

CVE-2022-38749 Medium 6.5 Not Defined 0.533% snakeyaml-1.23.jar Transitive 3.0.0

Unreachable

CVE-2021-30640 Medium 6.5 Not Defined 0.123% tomcat-embed-core-9.0.17.jar Transitive 2.3.11.RELEASE

Unreachable

CVE-2024-23672 Medium 6.3 Not Defined 1.435% tomcat-embed-websocket-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2026-25854 Medium 6.1 Not Defined 0.033% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2023-41080 Medium 6.1 Not Defined 11.586% tomcat-embed-core-9.0.17.jar Transitive 2.7.16

Unreachable

CVE-2019-0221 Medium 6.1 Not Defined 14.481% tomcat-embed-core-9.0.17.jar Transitive N/A*

Unreachable

CVE-2021-24122 Medium 5.9 Not Defined 61.383% tomcat-embed-core-9.0.17.jar Transitive 2.2.12.RELEASE

Unreachable

CVE-2022-41854 Medium 5.8 Not Defined 0.123% snakeyaml-1.23.jar Transitive 3.0.0

Unreachable

CVE-2026-22745 Medium 5.3 Not Defined 0.067% spring-webmvc-5.1.6.RELEASE.jar Transitive 3.5.14

Unreachable

CVE-2025-61795 Medium 5.3 Not Defined 0.129% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2024-38828 Medium 5.3 Not Defined 0.076% spring-webmvc-5.1.6.RELEASE.jar Transitive N/A*

Unreachable

CVE-2024-38809 Medium 5.3 Not Defined 0.14% spring-web-5.1.6.RELEASE.jar Transitive 3.0.0

Unreachable

CVE-2024-21733 Medium 5.3 Not Defined 70.951% tomcat-embed-core-9.0.17.jar Transitive 2.3.10.RELEASE

Unreachable

CVE-2023-45648 Medium 5.3 Not Defined 62.748% tomcat-embed-core-9.0.17.jar Transitive 2.7.17

Unreachable

CVE-2023-42795 Medium 5.3 Not Defined 0.712% tomcat-embed-core-9.0.17.jar Transitive 2.7.17

Unreachable

CVE-2021-33037 Medium 5.3 Not Defined 1.865% tomcat-embed-core-9.0.17.jar Transitive 2.4.8

Unreachable

CVE-2020-10693 Medium 5.3 Not Defined 0.094% hibernate-validator-6.0.16.Final.jar Transitive 2.1.15.RELEASE

Unreachable

CVE-2026-1225 Medium 5.0 Not Defined 0.014% logback-core-1.2.3.jar Transitive N/A*

Unreachable

CVE-2020-1935 Medium 4.8 Not Defined 1.382% tomcat-embed-core-9.0.17.jar Transitive 2.1.13.RELEASE

Unreachable

CVE-2024-12801 Medium 4.6 Not Defined 0.064% logback-core-1.2.3.jar Transitive 4.0.0

Unreachable

CVE-2023-28708 Medium 4.3 Not Defined 0.11% tomcat-embed-core-9.0.17.jar Transitive 2.5.15

Unreachable

CVE-2021-22096 Medium 4.3 Not Defined 0.227% detected in multiple dependencies Transitive 2.4.0

Unreachable

CVE-2020-13943 Medium 4.3 Not Defined 12.123% tomcat-embed-core-9.0.17.jar Transitive 2.1.17.RELEASE

Unreachable

CVE-2026-43514 Low 3.7 Not Defined 0.1% tomcat-embed-core-9.0.17.jar Transitive 3.0.0

Unreachable

CVE-2021-43980 Low 3.7 Not Defined 0.203% tomcat-embed-core-9.0.17.jar Transitive 2.5.13

Unreachable

CVE-2026-22741 Low 3.1 Not Defined 0.083% spring-webmvc-5.1.6.RELEASE.jar Transitive N/A*

Unreachable

CVE-2024-38820 Low 3.1 Not Defined 1.514% spring-web-5.1.6.RELEASE.jar Transitive N/A*

Unreachable

CVE-2026-22735 Low 2.6 Not Defined 0.092% detected in multiple dependencies Transitive N/A*

Unreachable

CVE-2025-35036 High 7.3 Not Defined 1.693% hibernate-validator-6.0.16.Final.jar Transitive N/A*
CVE-2026-9828 Medium 5.4 Not Defined 0.086% logback-core-1.2.3.jar Transitive N/A*
CVE-2026-10532 Medium 5.4 Not Defined logback-core-1.2.3.jar Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (7 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2026-43512

Vulnerable Library - tomcat-embed-core-9.0.17.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.17/tomcat-embed-core-9.0.17.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.1.4.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.1.4.RELEASE.jar
      • tomcat-embed-core-9.0.17.jar (Vulnerable Library)

Found in HEAD commit: 3c697156679612e93e2a8f1c4982c052a930d7d1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.
Older unsupported versions any also be affect
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

Publish Date: 2026-05-12

URL: CVE-2026-43512

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.139%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-12

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.118

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-41293

Vulnerable Library - tomcat-embed-core-9.0.17.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.17/tomcat-embed-core-9.0.17.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.1.4.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.1.4.RELEASE.jar
      • tomcat-embed-core-9.0.17.jar (Vulnerable Library)

Found in HEAD commit: 3c697156679612e93e2a8f1c4982c052a930d7d1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Improper Input Validation vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.
Older, end of support versions may also be affected.
Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Publish Date: 2026-05-12

URL: CVE-2026-41293

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.253%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-12

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.118

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2025-31651

Vulnerable Library - tomcat-embed-core-9.0.17.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.17/tomcat-embed-core-9.0.17.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.1.4.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.1.4.RELEASE.jar
      • tomcat-embed-core-9.0.17.jar (Vulnerable Library)

Found in HEAD commit: 3c697156679612e93e2a8f1c4982c052a930d7d1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible
for a specially crafted request to bypass some rewrite rules. If those
rewrite rules effectively enforced security constraints, those
constraints could be bypassed.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.5, from 10.1.0-M1 through 10.1.39, from 9.0.0.M1 through 9.0.102.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.
Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-04-28

URL: CVE-2025-31651

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.199%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.openwall.com/lists/oss-security/2025/04/28/3

Release Date: 2025-04-28

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.104

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2025-24813

Vulnerable Library - tomcat-embed-core-9.0.17.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.17/tomcat-embed-core-9.0.17.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.1.4.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.1.4.RELEASE.jar
      • tomcat-embed-core-9.0.17.jar (Vulnerable Library)

Found in HEAD commit: 3c697156679612e93e2a8f1c4982c052a930d7d1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.
If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)

  • support for partial PUT (enabled by default)
  • a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads
    - attacker knowledge of the names of security sensitive files being uploaded
    - the security sensitive files also being uploaded via partial PUT
    If all of the following were true, a malicious user was able to perform remote code execution:
  • writes enabled for the default servlet (disabled by default)
    - support for partial PUT (enabled by default)
    - application was using Tomcat's file based session persistence with the default storage location
    - application included a library that may be leveraged in a deserialization attack
    Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.
    Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-03-10

URL: CVE-2025-24813

Threat Assessment

Exploit Maturity: Functional

EPSS: 94.13%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2025-24813

Release Date: 2025-03-10

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.99

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-56337

Vulnerable Library - tomcat-embed-core-9.0.17.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.17/tomcat-embed-core-9.0.17.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.1.4.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.1.4.RELEASE.jar
      • tomcat-embed-core-9.0.17.jar (Vulnerable Library)

Found in HEAD commit: 3c697156679612e93e2a8f1c4982c052a930d7d1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.
The mitigation for CVE-2024-50379 was incomplete.
Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation
parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:

  • running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true)
  • running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false)
  • running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed)
    Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.
    Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2024-12-20

URL: CVE-2024-56337

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 13.16%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tomcat.apache.org/security-11.html

Release Date: 2024-12-20

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.98

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-52316

Vulnerable Library - tomcat-embed-core-9.0.17.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.17/tomcat-embed-core-9.0.17.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.1.4.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.1.4.RELEASE.jar
      • tomcat-embed-core-9.0.17.jar (Vulnerable Library)

Found in HEAD commit: 3c697156679612e93e2a8f1c4982c052a930d7d1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2024-11-18

URL: CVE-2024-52316

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 2.487%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tomcat.apache.org/security-11.html

Release Date: 2024-11-18

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.96

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-50379

Vulnerable Library - tomcat-embed-core-9.0.17.jar

Core Tomcat implementation

Library home page: https://tomcat.apache.org/

Path to dependency file: /nexmo-spring-boot-test-application/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/apache/tomcat/embed/tomcat-embed-core/9.0.17/tomcat-embed-core-9.0.17.jar

Dependency Hierarchy:

  • spring-boot-starter-web-2.1.4.RELEASE.jar (Root Library)
    • spring-boot-starter-tomcat-2.1.4.RELEASE.jar
      • tomcat-embed-core-9.0.17.jar (Vulnerable Library)

Found in HEAD commit: 3c697156679612e93e2a8f1c4982c052a930d7d1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2024-12-17

URL: CVE-2024-50379

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 84.776%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://tomcat.apache.org/security-11.html

Release Date: 2024-12-17

Fix Resolution (org.apache.tomcat.embed:tomcat-embed-core): 9.0.98

Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-web): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions