CVE-2011-2526
Improper Input Validation in Apache Tomcat
4.4 MediumFix available
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
Exploit likelihood
0.70%Down 2.4 points since Feb 4, 2022
What each source reports
NVD Score used
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
- Record
CVE-2011-2526- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
- Record
CVE-2011-2526- Updated
- 2026-11-02
EUVDEUVD-2022-3373 No score
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
- Record
EUVD-2022-3373- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9ggm-7897-x4mg No score
Improper Input Validation in Apache Tomcat
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
- Record
GHSA-9ggm-7897-x4mg- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-9ggm-7897-x4mg No score
Improper Input Validation in Apache Tomcat
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
- Record
GHSA-9ggm-7897-x4mg- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
before 5.5.34 | 5.5.34 |
org.apache.tomcat:tomcatMaven |
6.0.0 up to 6.0.33 | 6.0.33 |
org.apache.tomcat:tomcatMaven |
7.0.0 up to 7.0.19 | 7.0.19 |
tomcat6Debian:6.0 From an advisory covering 10 CVEs |
before 6.0.35-1+squeeze2, plus listed versions 6.0.28-106.0.28-96.0.28-9+squeeze16.0.32-16.0.32-2 Show 7 moreShow less6.0.32-36.0.32-46.0.32-56.0.32-66.0.32-76.0.33-16.0.35-1 |
6.0.35-1+squeeze2 |
tomcat6Red Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-libRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
Show 74 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat6-docs-webappRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-javadocRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
tomcat6-webappsRed Hat:enterprise_linux:6::server From an advisory covering 7 CVEs |
before 0:6.0.24-35.el6_1 | 0:6.0.24-35.el6_1 |
jbosswebRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el4 | 0:2.1.12-3_patch_03.2.ep5.el4 |
jbossweb-el-1.0-apiRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el4 | 0:2.1.12-3_patch_03.2.ep5.el4 |
jbossweb-jsp-2.1-apiRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el4 | 0:2.1.12-3_patch_03.2.ep5.el4 |
jbossweb-libRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el4 | 0:2.1.12-3_patch_03.2.ep5.el4 |
jbossweb-servlet-2.5-apiRed Hat:jboss_enterprise_application_platform:5::el4 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el4 | 0:2.1.12-3_patch_03.2.ep5.el4 |
jbosswebRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-el-1.0-apiRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-jsp-2.1-apiRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-libRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-servlet-2.5-apiRed Hat:jboss_enterprise_application_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbosswebRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-el-1.0-apiRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-jsp-2.1-apiRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-libRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-servlet-2.5-apiRed Hat:jboss_enterprise_application_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbosswebRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-el-1.0-apiRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-jsp-2.1-apiRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-libRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbossweb-servlet-2.5-apiRed Hat:jboss_enterprise_web_platform:5::el5 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el5 | 0:2.1.12-3_patch_03.2.ep5.el5 |
jbosswebRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-el-1.0-apiRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-jsp-2.1-apiRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-libRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
jbossweb-servlet-2.5-apiRed Hat:jboss_enterprise_web_platform:5::el6 From an advisory covering 8 CVEs |
before 0:2.1.12-3_patch_03.2.ep5.el6 | 0:2.1.12-3_patch_03.2.ep5.el6 |
tomcat5Red Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-admin-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-common-libRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jasperRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jasper-eclipseRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jasper-javadocRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jsp-2.0-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-jsp-2.0-api-javadocRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-parentRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-server-libRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-servlet-2.4-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 9 CVEs |
before 0:5.5.33-27_patch_07.ep5.el5 | 0:5.5.33-27_patch_07.ep5.el5 |
tomcat5Red Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-admin-webappsRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-common-libRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jasperRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jasper-eclipseRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jasper-javadocRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jsp-2.0-apiRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-jsp-2.0-api-javadocRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-parentRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-server-libRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-servlet-2.4-apiRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-servlet-2.4-api-javadocRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat5-webappsRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 9 CVEs |
before 0:5.5.33-28_patch_07.ep5.el6 | 0:5.5.33-28_patch_07.ep5.el6 |
tomcat6Red Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-el-1.0-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-libRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el5 | 0:6.0.32-24_patch_07.ep5.el5 |
tomcat6Red Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-el-1.0-apiRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-libRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:1::el6 From an advisory covering 10 CVEs |
before 0:6.0.32-24_patch_07.ep5.el6 | 0:6.0.32-24_patch_07.ep5.el6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2526 is a medium vulnerability (CVSS 4.4) in Apache Tomcat, published July 14, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in org.apache.tomcat:tomcat 5.5.34.
References
secunia.com/advisories/45232
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19514
svn.apache.org/viewvc?view=revision&revision=1145383
mandriva.com/security/advisories?name=MDVSA-2011:156
debian.org/security/2012/dsa-2401
rhn.redhat.com/errata/RHSA-2012-0325.html
Show 104 moreShow less
marc.info?l=bugtraq&m=136485229118404&w=2
tomcat.apache.org/security-7.html
bugzilla.redhat.com/show_bug.cgi?id=720948
securityfocus.com/archive/1/518889/100/0/threaded
osvdb.org/73797
exchange.xforce.ibmcloud.com/vulnerabilities/68541
securitytracker.com/id?1025788
lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2011-2526
github.com/apache/tomcat/commit/1d372c881eafd9ffe729996f8560fd5fe50cd39d
access.redhat.com/errata/RHSA-2012:0074
web.archive.org/web/20110717104325/http://www.securityfocus.com/bid/48667
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1780.json
cve.org/CVERecord?id=CVE-2011-1184
issues.jboss.org/browse/JBPAPP-4873