7.5
High
CVE-2018-8034 The host name verification when using TLS with the WebSocket client was missing
Description
The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Tomcat | Versions not published |
References
- USN-3723-1 usn.ubuntu.com
- [www-announce] 20180722 [SECURITY] CVE-2018-8034 Apache Tomcat - Security Constraint Bypass mail-archives.us.apache.org
- RHSA-2019:0451 access.redhat.com
- [debian-lts-announce] 20180730 [SECURITY] [DLA 1453-1] tomcat7 security update lists.debian.org
- DSA-4281 www.debian.org
- 1041374 www.securitytracker.com
- security.netapp.com security.netapp.com
- RHSA-2019:0131 access.redhat.com
- www.oracle.com www.oracle.com
- RHSA-2019:0130 access.redhat.com
- RHSA-2019:0450 access.redhat.com
- [debian-lts-announce] 20180902 [SECURITY] [DLA 1491-1] tomcat8 security update lists.debian.org
- 104895 www.securityfocus.com
- [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
- [tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org
- www.oracle.com www.oracle.com
- RHSA-2019:1160 access.redhat.com
- RHSA-2019:1162 access.redhat.com
- RHSA-2019:1159 access.redhat.com
- RHSA-2019:1161 access.redhat.com
- RHSA-2019:1529 access.redhat.com
- www.oracle.com www.oracle.com
- [activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars. lists.apache.org
- RHSA-2019:2205 access.redhat.com
- www.oracle.com www.oracle.com
- RHSA-2019:3892 access.redhat.com
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/ lists.apache.org
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/ lists.apache.org
- www.oracle.com www.oracle.com
Timeline
- Published
- Last modified
Other CVEs of Apache Tomcat
The 141 CVEs of Apache Tomcat →
CVE-2026-103119
Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body…
Not rated
CVE-2026-101356
Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous…
Not rated
CVE-2026-101296
A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with…
Not rated
CVE-2026-93446
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently
Not rated