CVE-2017-7674Published

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side…

Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

cve-program · CVE-2017-7674

Published

Apache Tomcat

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "product": "Apache Tomcat",
                    "vendor": "Apache Software Foundation",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "9.0.0.M1 to 9.0.0.M21"
                        },
                        {
                            "status": "affected",
                            "version": "8.5.0 to 8.5.15"
                        },
                        {
                            "status": "affected",
                            "version": "8.0.0.RC1 to 8.0.44"
                        },
                        {
                            "status": "affected",
                            "version": "7.0.41 to 7.0.78"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON