Patchfirst
Patchfirst
ChainApache TomcatMaven:org.apache.tomcat:tomcat-coyote

Apache Tomcat: related fixes (2017–2025)

7 CVEs over 4 generations, 11 Aug 2017 to 28 Apr 2025.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2017-767511 Aug 2017 First in the chain
  2. CVE-2020-1199626 Jun 2020 No direct link to an earlier CVE
  3. CVE-2020-1394312 Oct 2020 related to CVE-2020-11996
  4. CVE-2024-2454913 Mar 2024 related to CVE-2020-13943
  5. CVE-2024-347503 Jul 2024 related to CVE-2020-11996related to CVE-2020-13943and 1 more
  6. CVE-2024-5231718 Nov 2024 related to CVE-2024-34750
  7. CVE-2025-3165028 Apr 2025 next fix after CVE-2024-52317related to CVE-2017-7675and 1 more
20172019202020212022202320242025 CVE-2024-52317 → CVE-2025-31650: Next fix in the same package (high confidence)CVE-2017-7675 → CVE-2025-31650: related (medium confidence)CVE-2020-11996 → CVE-2020-13943: related (medium confidence)CVE-2020-11996 → CVE-2024-34750: related (medium confidence)CVE-2020-13943 → CVE-2024-24549: related (medium confidence)CVE-2020-13943 → CVE-2024-34750: related (medium confidence)CVE-2024-24549 → CVE-2025-31650: related (medium confidence)CVE-2024-34750 → CVE-2024-52317: related (medium confidence)CVE-2024-24549 → CVE-2024-34750: Next fix in the same package (low confidence) CVE-2017-7675 11 Aug 2017 CVE-2020-11996 26 Jun 2020 CVE-2020-13943 12 Oct 2020 CVE-2024-24549 13 Mar 2024 CVE-2024-34750 3 Jul 2024 CVE-2024-52317 18 Nov 2024 CVE-2025-31650 28 Apr 2025 201720182019202020212022202320242025 CVE-2024-52317 → CVE-2025-31650: Next fix in the same package (high confidence)CVE-2017-7675 → CVE-2025-31650: related (medium confidence)CVE-2020-11996 → CVE-2020-13943: related (medium confidence)CVE-2020-11996 → CVE-2024-34750: related (medium confidence)CVE-2020-13943 → CVE-2024-24549: related (medium confidence)CVE-2020-13943 → CVE-2024-34750: related (medium confidence)CVE-2024-24549 → CVE-2025-31650: related (medium confidence)CVE-2024-34750 → CVE-2024-52317: related (medium confidence)CVE-2024-24549 → CVE-2024-34750: Next fix in the same package (low confidence) CVE-2017-7675 11 Aug 2017 CVE-2020-11996 26 Jun 2020 CVE-2020-13943 12 Oct 2020 CVE-2024-24549 13 Mar 2024 CVE-2024-34750 3 Jul 2024 CVE-2024-52317 18 Nov 2024 CVE-2025-31650 28 Apr 2025
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2017-7675 11 Aug 2017 The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security… · fixed in 9.0.0.M22 First in chain 19.1
CVE-2020-11996 26 Jun 2020 A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and… · fixed in 10.0.0-M5 First in chain 24.6
CVE-2020-13943 12 Oct 2020 If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded… · fixed in 10.0.0-M8 CVE-2020-11996 · related · Medium 19.8
CVE-2024-24549 13 Mar 2024 Apache Tomcat: HTTP/2 header handling DoS · fixed in 11.0.0-M17 CVE-2020-13943 · related · Medium 29.8
CVE-2024-34750 3 Jul 2024 Apache Tomcat: HTTP/2 excess header handling DoS · fixed in 11.0.0-M21 CVE-2020-11996 · related · Medium 23.6
CVE-2024-52317 18 Nov 2024 Apache Tomcat: Request/response mix-up with HTTP/2 · fixed in 11.0.0 CVE-2024-34750 · related · Medium 25.9
CVE-2025-31650 28 Apr 2025 Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame · fixed in 11.0.6 CVE-2024-52317 · Next fix in the same package · High 30.8
↑ ↓ chooseEnter openEsc close