{"id":"CVE-2023-24998","aliases":["ALSA-2023:6570","ALSA-2023:7065","CLSA-2025-1748282295","CLSA-2026-1779410887","CLSA-2026-1780929699","CLSA-2026-1783472552","CLSA-2026-1786382292","CLSA-2026-1786449156","CLSA-2026-1789677164","CLSA-2026-1792575257","CLSA-2026-1793011037","CLSA-2026-1793011786","DEBIAN-CVE-2023-24998","DLA-3617-1","DLA-4245-1","DSA-5522-1","EUVD-2023-0720","GHSA-hfrx-6qgj-fp6c","MGASA-2023-0070","MGASA-2023-0138","OESA-2023-1155","OESA-2024-1100","RHLW-2026-44a75016eab78e73","RHSA-2023:3299","RHSA-2023:4909","RHSA-2023:6570","RHSA-2023:7065","RHSA-2024:3814","ROOT-APP-MAVEN-CVE-2023-24998","SUSE-SU-2023:0695-1","SUSE-SU-2023:0696-1","SUSE-SU-2023:0697-1","SUSE-SU-2023:0730-1","SUSE-SU-2023:0758-1","SUSE-SU-2023:1769-1","SUSE-SU-2023:2390-1","SUSE-SU-2023:2505-1","SUSE-SU-2026:1058-1","UBUNTU-CVE-2023-24998","openSUSE-SU-2024:12750-1","openSUSE-SU-2024:12950-1","openSUSE-SU-2024:13441-1"],"status":"published","title":"Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts","description":"Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\n\n\n\n\nNote that, like all of the file upload limits, the\n          new configuration option (FileUploadBase#setFileCountMax) is not\n          enabled by default and must be explicitly configured.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.48788,"percentile":0.98894,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-770"],"published":"2023-02-20T15:57:07Z","modified":"2026-11-02T19:46:31Z","exploits":[{"source":"pocgithub","id":"nice1st/CVE-2023-24998","title":"nice1st/CVE-2023-24998","date":"2023-03-29","url":"https://github.com/nice1st/CVE-2023-24998"}],"fixes":[{"ecosystem":"Maven","package":"commons-fileupload:commons-fileupload","fixed_in":["1.5"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","fixed_in":["10.1.5","11.0.0-M5","8.5.88","9.0.71"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["10.1.5","11.0.0-M5","8.5.88","9.0.71"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["10.1.5","11.0.0-M5","8.5.88","9.0.71"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"commons-fileupload:commons-fileupload","fixed_in":["1.2.2-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat","fixed_in":["7.0.76-16.el7_9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-admin-webapps","fixed_in":["7.0.76-16.el7_9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-docs-webapp","fixed_in":["7.0.76-16.el7_9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-el-2.2-api","fixed_in":["7.0.76-16.el7_9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-javadoc","fixed_in":["7.0.76-16.el7_9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-jsp-2.2-api","fixed_in":["7.0.76-16.el7_9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-jsvc","fixed_in":["7.0.76-16.el7_9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-lib","fixed_in":["7.0.76-16.el7_9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-servlet-3.0-api","fixed_in":["7.0.76-16.el7_9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-webapps","fixed_in":["7.0.76-16.el7_9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libcommons-fileupload-java","fixed_in":["1.4-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcommons-fileupload-java","fixed_in":["1.4-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcommons-fileupload-java","fixed_in":["1.4-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat10","fixed_in":["10.1.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat10","fixed_in":["10.1.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat10","fixed_in":["10.1.5-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"apache-commons-fileupload","fixed_in":["1.4-3.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"apache-commons-fileupload","fixed_in":["1.4-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"apache-commons-fileupload","fixed_in":["1.4-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"apache-commons-fileupload","fixed_in":["1.4-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"apache-commons-fileupload","fixed_in":["1.4-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["9.0.39-root.io.2","9.0.39-root.io.3","9.0.63-root.io.1","9.0.39-root.io.4","9.0.39-root.io.5","9.0.63-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["9.0.39-aikido.4","9.0.39-aikido.5","9.0.63-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.commons-fileupload:commons-fileupload","fixed_in":["1.5-root.io.1","1.5-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"commons-fileupload:commons-fileupload","fixed_in":["1.5-aikido.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"tomcat","fixed_in":["8.0.53-29.63.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"tomcat","fixed_in":["9.0.36-3.99.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"tomcat","fixed_in":["9.0.36-3.99.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tomcat","fixed_in":["9.0.36-3.99.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"tomcat","fixed_in":["9.0.36-3.99.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"tomcat","fixed_in":["9.0.36-3.99.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","fixed_in":["9.0.36-3.99.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","fixed_in":["9.0.36-3.99.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"tomcat","fixed_in":["9.0.36-150100.4.87.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"tomcat","fixed_in":["9.0.36-150100.4.87.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"tomcat","fixed_in":["9.0.36-150100.4.87.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"apache-commons-fileupload","fixed_in":["1.5-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tomcat","fixed_in":["9.0.43-14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-fileupload","fixed_in":["1.5-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M2"},{"fixed":"11.0.0-M5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.85"},{"fixed":"8.5.88"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"fixed":"9.0.71"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M2"},{"fixed":"11.0.0-M5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.85"},{"fixed":"8.5.88"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"fixed":"9.0.71"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M2"},{"fixed":"11.0.0-M5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.85"},{"fixed":"8.5.88"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"fixed":"9.0.71"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.2"},{"fixed":"1.2.2-tuxcare.4"}]}],"versions":["1.2.2","1.2.2-tuxcare.1","1.2.2-tuxcare.2","1.2.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.11"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.11"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.11"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.11"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.10"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7","9.0.46-tuxcare.8","9.0.46-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.10"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7","9.0.46-tuxcare.8","9.0.46-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.10"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7","9.0.46-tuxcare.8","9.0.46-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.1"},{"fixed":"1.3.1-tuxcare.2"}]}],"versions":["1.3.1","1.3.1-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-logging-juli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-logging-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.extras:tomcat-extras-juli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.extras:tomcat-extras-juli-adapters","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-annotations-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-ant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-ha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-jmx-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-el-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-i18n-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-i18n-fr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-i18n-ja","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jasper-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-jsp-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-juli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-servlet-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat7-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.4"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3"],"bundled":16},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"Debian:12","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u9"}]}],"versions":["9.0.16-4","9.0.16-5","9.0.22-1","9.0.24-1","9.0.27-1","9.0.31-1~bpo10+1","9.0.31-1~deb10u1","9.0.31-1~deb10u2","9.0.31-1~deb10u3","9.0.31-1~deb10u4","9.0.31-1~deb10u5","9.0.31-1~deb10u6","9.0.31-1~deb10u7","9.0.31-1~deb10u8"],"bundled":5},{"source":"osv","ecosystem":"Debian:11","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-1+deb11u1"}]}],"versions":["1.4-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-2~deb11u7"}]}],"versions":["9.0.43-1","9.0.43-2~deb11u1","9.0.43-2~deb11u2","9.0.43-2~deb11u3","9.0.43-2~deb11u4","9.0.43-2~deb11u5","9.0.43-2~deb11u6"],"bundled":5},{"source":"osv","ecosystem":"Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5"}]}],"versions":["1.0","1.0-beta-1","1.0-rc1","1.1","1.1.1","1.2","1.2.1","1.2.2","1.3","1.3.1","1.3.1-jenkins-1","1.3.1-jenkins-2","1.3.2","1.3.3","1.4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.5"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.2","10.1.4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M2"},{"fixed":"11.0.0-M5"}]}],"versions":["11.0.0-M3","11.0.0-M4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.85"},{"fixed":"8.5.88"}]}],"versions":["8.5.85","8.5.86","8.5.87"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"fixed":"9.0.71"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.5"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.2","10.1.4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M2"},{"fixed":"11.0.0-M5"}]}],"versions":["11.0.0-M3","11.0.0-M4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.85"},{"fixed":"8.5.88"}]}],"versions":["8.5.85","8.5.86","8.5.87"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"fixed":"9.0.71"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.8"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.5"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.2","10.1.4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M2"},{"fixed":"11.0.0-M5"}]}],"versions":["11.0.0-M3","11.0.0-M4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.85"},{"fixed":"8.5.88"}]}],"versions":["8.5.85","8.5.86","8.5.87"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"fixed":"9.0.71"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.8"]},{"source":"osv","ecosystem":"Mageia:8","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-3.1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.73-1.1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-31.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-31.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-33.oe2203sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-33.oe2203sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-33.oe2203sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-33.oe2203sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0.rhlw-00001"}]}],"versions":["1.0","1.0-beta-1","1.0-rc1","1.1","1.1.1","1.2","1.2.1","1.2.2","1.3","1.3.1","1.3.1-jenkins-1","1.3.1-jenkins-2","1.3.2","1.3.3","1.4","1.4.0"],"bundled":2},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.1684911916-1.el8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.387.3.1684911776-3.el8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.39-root.io.2"},{"fixed":"9.0.39-root.io.3"},{"fixed":"9.0.63-root.io.1"},{"fixed":"9.0.39-root.io.4"},{"fixed":"9.0.39-root.io.5"},{"fixed":"9.0.63-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.39-aikido.4"},{"fixed":"9.0.39-aikido.5"},{"fixed":"9.0.63-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-root.io.1"},{"fixed":"1.5-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"commons-fileupload:commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-aikido.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.63.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.99.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.99.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.99.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.99.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.99.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.99.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.99.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-150100.4.87.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-150100.4.87.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-150100.4.87.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-122.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-122.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-122.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-122.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-122.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-122.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-122.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"jakarta-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-122.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-150200.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.1-1","1.3.1-2","1.3.1-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3-1","1.4-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2","1.5-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-1","1.5-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libcommons-fileupload-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5-1.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache-commons-fileupload","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.14-1.1"}]}],"bundled":49}],"products":[{"vendor":"apache","product":"commons_fileupload"},{"vendor":"apache software foundation","product":"apache commons fileupload"},{"vendor":"apache software foundation","product":"apache tomcat"},{"vendor":"debian","product":"debian_linux"}],"references":[{"url":"https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2023/05/22/1","tags":["x_transferred","Mailing List","web"]},{"url":"https://security.gentoo.org/glsa/202305-37","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2023/dsa-5522","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230302-0013/","tags":["advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24998","tags":["advisory"]},{"url":"https://github.com/apache/commons-fileupload/commit/e20c04990f7420ca917e96a84cec58b13a1b3d17","tags":["web"]},{"url":"https://commons.apache.org/proper/commons-fileupload/security-reports.html","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/8a2285f13affa961cc65595aad999db5efae45ce","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/9ca96c8c1eba86c0aaa2e6be581ba2a7d4d4ae6e","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/cf77cc545de0488fb89e24294151504a7432df74","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/d53d8e7f77042cc32a3b98f589496a1ef5088e38","tags":["web"]},{"url":"https://tomcat.apache.org/security-10.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-11.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-8.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html","tags":["web"]},{"url":"https://github.com/search?q=repo%3Aapache%2Ftomcat+util.http+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F\u0026type=code","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20230302-0013","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hfrx-6qgj-fp6c","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6570","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24998","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28708","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28709","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172298","tags":["report"]},{"url":"https://bugzilla.redhat.com/2180856","tags":["report"]},{"url":"https://bugzilla.redhat.com/2210321","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6570.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7065","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7065.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1780929699.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24998.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-24998","tags":["advisory"]},{"url":"https://github.com/apache/commons-fileupload","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0070.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31580","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/02/20/2","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2023-0138.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30113","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-March/010339.html","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-April/010734.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.65","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.62","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-3160","tags":["web"]},{"url":"https://www.debian.org/security/2022/dsa-5265","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.68","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.69","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.71","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-March/014018.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.72","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1155","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28709","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42795","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48976.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48976","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vv7r-c36w-3prj","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3299","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2087606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134292","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2185707","tags":["report"]},{"url":"https://issues.redhat.com/browse/PITEAM-10","tags":["article"]},{"url":"https://issues.redhat.com/browse/PITEAM-9","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3299.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4178","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-46877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46877","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22978","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22978","tags":["advisory"]},{"url":"https://tanzu.vmware.com/security/cve-2022-22978","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080850","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25647","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25647","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40151","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40152","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3f7h-mf4q-vrm4","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42889","tags":["advisory"]},{"url":"https://blogs.apache.org/security/entry/cve-2022-42889","tags":["article"]},{"url":"https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om","tags":["article"]},{"url":"https://seclists.org/oss-sec/2022/q4/22","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24422","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24422","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24422","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-3016","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24998","tags":["advisory","report"]},{"url":"https://commons.apache.org/proper/commons-fileupload/security-reports.html#Fixed_in_Apache_Commons_FileUpload_1.5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25761","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25761","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3032","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25762","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25762","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3019","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27900","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3030","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27901","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27901","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27902","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27902","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-1807","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27904","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27904","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-2120","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4909","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2210321","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4909.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24963","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24963","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24963","tags":["advisory"]},{"url":"https://lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57xqzfksq9","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28708","tags":["advisory"]},{"url":"https://bz.apache.org/bugzilla/show_bug.cgi?id=66471","tags":["article"]},{"url":"https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28709","tags":["advisory"]},{"url":"https://lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3j","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2189675","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6570.json","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173874","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2189676","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7065.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3814","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269607","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269608","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3814.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158695","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45143","tags":["advisory"]},{"url":"https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235370","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41080","tags":["advisory"]},{"url":"https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-42795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243752","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-42795","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/9","tags":["article"]},{"url":"https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243749","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45648","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/10","tags":["article"]},{"url":"https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23672","tags":["advisory"]},{"url":"https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24549","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24549","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24549","tags":["advisory"]},{"url":"https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230695-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208513","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230696-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230697-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230730-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/986359","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3092","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230758-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231769-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1209622","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232390-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232505-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1211608","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261058-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216182","tags":["report"]},{"url":"https://bugzilla.suse.com/1243895","tags":["report"]},{"url":"https://bugzilla.suse.com/1246318","tags":["report"]},{"url":"https://bugzilla.suse.com/1246389","tags":["report"]},{"url":"https://bugzilla.suse.com/1258371","tags":["report"]},{"url":"https://bugzilla.suse.com/1258385","tags":["report"]},{"url":"https://bugzilla.suse.com/1259224","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24733","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-24998","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45143","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-24998","title":"Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts","description":"Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\n\n\n\n\nNote that, like all of the file upload limits, the\n          new configuration option (FileUploadBase#setFileCountMax) is not\n          enabled by default and must be explicitly configured.","status":"published","published":"2023-02-20T15:57:07.372Z","modified":"2026-10-07T16:20:25.38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:35:26.63732Z"}],"euvd":[{"id":"EUVD-2023-0720","description":"Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\n\n\n\n\nNote that, like all of the file upload limits, the\n          new configuration option (FileUploadBase#setFileCountMax) is not\n          enabled by default and must be explicitly configured.","status":"published","published":"2023-02-20T15:57:07Z","modified":"2026-10-07T16:20:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:35.164729Z"}],"ghsa":[{"id":"GHSA-hfrx-6qgj-fp6c","title":"Apache Commons FileUpload denial of service vulnerability","description":"Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.","status":"published","published":"2023-02-20T18:30:17Z","modified":"2026-06-18T20:19:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:29.43528Z"}],"nvd":[{"id":"CVE-2023-24998","description":"Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\n\n\n\n\nNote that, like all of the file upload limits, the\n          new configuration option (FileUploadBase#setFileCountMax) is not\n          enabled by default and must be explicitly configured.","status":"published","published":"2023-02-20T16:15:10.423Z","modified":"2026-10-07T17:16:43.86Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:07:47.623983Z"}],"osv":[{"id":"CVE-2023-24998","title":"Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts","description":"Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\n\n\n\n\nNote that, like all of the file upload limits, the\n          new configuration option (FileUploadBase#setFileCountMax) is not\n          enabled by default and must be explicitly configured.","status":"published","published":"2023-02-20T15:57:07.372Z","modified":"2026-10-28T02:30:53.680206887Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"DEBIAN-CVE-2023-24998","description":"Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.     Note that, like all of the file upload limits, the           new configuration option (FileUploadBase#setFileCountMax) is not           enabled by default and must be explicitly configured.","status":"published","published":"2023-02-20T16:15:10.423Z","modified":"2026-10-26T18:01:10.982226406Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"GHSA-hfrx-6qgj-fp6c","title":"Apache Commons FileUpload denial of service vulnerability","description":"Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.","status":"published","published":"2023-02-20T18:30:17Z","modified":"2026-08-07T08:12:19.538686059Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"OESA-2023-1155","title":"apache-commons-fileupload security update","description":"The javax.servlet package lacks support for RFC-1867, HTML file upload.  This package provides a simple to use API for working with such data.  The scope of this package is to create a package of Java utility classes to read multipart/form-data within a javax.servlet.http.HttpServletRequest.\r\n\r\nSecurity Fix(es):\r\n\r\nApache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.(CVE-2023-24998)","status":"published","published":"2023-03-10T11:05:38Z","modified":"2026-08-18T01:16:57.153967877Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2024-1100","title":"tomcat security update","description":"The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project\r\n\r\nSecurity Fix(es):\r\n\r\nApache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\r\n\r\n\r\n\r\n\nNote that, like all of the file upload limits, the\n          new configuration option (FileUploadBase#setFileCountMax) is not\n          enabled by default and must be explicitly configured.\r\n\r\n\n(CVE-2023-24998)\r\n\r\nThe fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.\r\n\r\n\r\n\r\n\n(CVE-2023-28709)\r\n\r\nIncomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could \ncause Tomcat to skip some parts of the recycling process leading to \ninformation leaking from the current request/response to the next.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.\r\n\r\n(CVE-2023-42795)","status":"published","published":"2024-01-26T11:06:33Z","modified":"2026-08-18T01:18:13.44880743Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHLW-2026-44a75016eab78e73","title":"Lightwell Security Advisory: commons-fileupload 1.4.0.rhlw-00001","description":"Red Hat Lightwell has released commons-fileupload:commons-fileupload 1.4.0.rhlw-00001 with backported fixes for CVE-2023-24998 and CVE-2025-48976.\n\nCVE-2023-24998: Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts\n\nCVE-2025-48976: Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers\n\nThis patched artifact is a drop-in replacement for commons-fileupload:commons-fileupload 1.4.0 from Maven Central.","status":"published","published":"2026-10-12T16:54:17Z","modified":"2026-10-27T04:00:09.743298808Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2023:3299","title":"Red Hat Security Advisory: jenkins and jenkins-2-plugins security update","status":"published","published":"2024-09-30T16:34:57Z","modified":"2026-10-13T10:04:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:4909","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.4 release and security update","status":"published","published":"2024-09-20T14:30:56Z","modified":"2026-10-08T10:03:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:6570","title":"Red Hat Security Advisory: tomcat security and bug fix update","status":"published","published":"2024-09-20T14:38:47Z","modified":"2026-10-08T10:04:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:7065","title":"Red Hat Security Advisory: tomcat security and bug fix update","status":"published","published":"2024-09-20T14:40:06Z","modified":"2026-10-08T10:04:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2024:3814","title":"Red Hat Security Advisory: tomcat security and bug fix update","status":"published","published":"2024-09-16T18:43:36Z","modified":"2026-10-13T10:07:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2023-24998","description":"Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the           new configuration option (FileUploadBase#setFileCountMax) is not           enabled by default and must be explicitly configured.","status":"published","published":"2023-02-20T16:15:00Z","modified":"2026-10-17T12:56:04.874775765Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"ALSA-2023:6570","title":"Moderate: tomcat security and bug fix update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)\n* tomcat: not including the secure attribute causes information disclosure (CVE-2023-28708)\n* tomcat: Fix for CVE-2023-24998 was incomplete (CVE-2023-28709)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:58.211162749Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:7065","title":"Moderate: tomcat security and bug fix update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)\n* tomcat: not including the secure attribute causes information disclosure (CVE-2023-28708)\n* tomcat: Fix for CVE-2023-24998 was incomplete (CVE-2023-28709)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:19.334768596Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CLSA-2025-1748282295","title":"Fix of 34 CVEs","description":"   * SECURITY UPDATE: Misc vulnerability fixes\n     - CVE-2019-12418, CVE-2019-17563, CVE-2020-1935,\n       CVE-2020-11996, CVE-2020-13934, CVE-2020-13935,\n       CVE-2020-13943, CVE-2020-17527, CVE-2021-24122,\n       CVE-2021-30639, CVE-2021-30640, CVE-2021-33037,\n       CVE-2021-42340, CVE-2021-43980, CVE-2022-25762,\n       CVE-2022-34305, CVE-2022-45143, CVE-2023-24998,\n       CVE-2023-28709, CVE-2023-34981, CVE-2023-42794,\n       CVE-2024-21733\n   * Update to 8.5.100\n     - debian/rules,\n       debian/libtomcat8-java.poms,\n       debian/maven.rules,\n       debian/tomcat8-common.links,\n       debian/patches/0018-fix-manager-webapp.patch,\n       debian/patches/0019-add-distribution-to-error-page.patch,\n       debian/patches/0021-dont-test-unsupported-ciphers.patch,\n       debian/patches/0101-skipping-tests-incompatible-with-firewall.patch:\n       updated\n     - debian/patches/0002-do-not-load-AJP13-connector-by-default.patch,\n       debian/patches/0026-easymock4-compatibility.patch:\n       removed as they were applied in upstream\n     - CVE-2019-0221.patch, CVE-2019-10072-1.patch,\n       CVE-2019-10072-2.patch, CVE-2022-42252.patch,\n       CVE-2020-1938.patch, CVE-2021-25122.patch,\n       CVE-2021-41079.patch, CVE-2022-29885.patch,\n       CVE-2020-9484.patch, CVE-2021-25329-pre1.patch,\n       CVE-2021-25329.patch, CVE-2022-23181.patch,\n       CVE-2023-44487.patch, CVE-2023-46589-pre1.patch,\n       CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch,\n       CVE-2023-46589-pre4.patch, CVE-2023-46589.patch:\n       removed because these CVEs were fixed in upstream\n   * Internal tests\n     - debian/test_certs/*: updated from upstream branch 9.0.x, as the\n       8.0.x certs were expired","status":"published","published":"2025-05-27T13:45:18Z","modified":"2026-06-04T10:03:30.412984079Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2026-1779410887","title":"TuxCare security update for commons-fileupload:commons-fileupload (1 CVE)","description":"TuxCare rebuilt commons-fileupload:commons-fileupload to address 1 CVE. Fixed in 1.2.2-tuxcare.4.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-15T09:45:17.483307213Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780929699","title":"tomcat: Fix of CVE-2023-24998","description":"- CVE-2023-24998: limit number of multipart request parts to prevent DoS","status":"published","published":"2026-06-13T10:44:24Z","modified":"2026-10-26T09:31:41.857832431Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1783472552","title":"TuxCare security update for 4 packages (4 CVEs)","description":"TuxCare rebuilt 4 packages to address 4 CVEs. Fixed in 9.0.50-tuxcare.11.","status":"published","published":"2026-08-04T14:52:42Z","modified":"2026-11-02T19:45:39.744264566Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1786382292","title":"TuxCare security update for 3 packages (2 CVEs)","description":"TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.0.46-tuxcare.10.","status":"published","published":"2026-08-10T17:18:12Z","modified":"2026-11-02T19:45:50.525073488Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1786449156","title":"TuxCare security update for commons-fileupload:commons-fileupload (2 CVEs)","description":"TuxCare rebuilt commons-fileupload:commons-fileupload to address 2 CVEs. Fixed in 1.3.1-tuxcare.2.","status":"published","published":"2026-08-11T11:52:36Z","modified":"2026-10-15T09:46:47.619581123Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1789677164","title":"TuxCare security update for 32 packages (16 CVEs)","description":"TuxCare rebuilt 32 packages to address 16 CVEs. Fixed in 7.0.70-tuxcare.4.","status":"published","published":"2026-09-17T20:32:44Z","modified":"2026-10-15T09:47:44.399297734Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1792575257","title":"TuxCare security update for 8 packages (32 CVEs)","description":"TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.","status":"published","published":"2026-10-21T09:34:17Z","modified":"2026-11-02T19:46:30.353719339Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793011037","title":"TuxCare security update for 5 packages (26 CVEs)","description":"TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.","status":"published","published":"2026-10-26T10:37:17Z","modified":"2026-11-02T19:46:31.628369017Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793011786","title":"TuxCare security update for 7 packages (22 CVEs)","description":"TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.","status":"published","published":"2026-10-26T10:49:46Z","modified":"2026-11-02T19:46:31.559502384Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"DLA-3617-1","title":"tomcat9 - security update","status":"published","published":"2023-10-13T00:00:00Z","modified":"2026-03-09T01:18:10.6075Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-4245-1","title":"libcommons-fileupload-java - security update","status":"published","published":"2025-07-21T00:00:00Z","modified":"2026-03-09T02:10:08.822332Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5522-1","title":"tomcat9 - security update","status":"published","published":"2023-10-10T00:00:00Z","modified":"2026-03-09T02:09:35.566913Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0070","title":"Updated apache-commons-fileupload packages fix security vulnerability","description":"Denial of service with a malicious upload or series of uploads.\n(CVE-2023-24998)\n","status":"published","published":"2023-02-27T20:27:16Z","modified":"2026-04-16T04:43:45.053810785Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"MGASA-2023-0138","title":"Updated tomcat packages fix security vulnerability","description":"Information disclosure due to concurrency bug (CVE-2021-43980)\nFix for CVE-2020-9484 introduced a time of check, time of use\nvulnerability (CVE-2022-23181)\nCorrect documentation to warn of use over untrusted networks.\n(CVE-2022-29885)\nCorrect documentation showing use of XSS vulnerability. (CVE-2022-34305)\nFix to reject invalid Content-Length header (CVE-2022-42252)\nFix escaping of the type, message or description values. (CVE-2022-45143)\nFix FileUpload limiting of the number of request parts to be processed\nto prevent the possibility of an attacker triggering a DoS (CVE-2023-24998)\nFix setting of session cookie secure attribute when using RemoteIpFilter\nwith X-Forwarded-Proto header set to https (CVE-2023-28708)\nObsolete tomcat-jsvc\n","status":"published","published":"2023-04-15T19:03:44Z","modified":"2026-04-16T04:42:36.513882529Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12750-1","title":"tomcat-9.0.43-14.1 on GA media","description":"These are all security issues fixed in the tomcat-9.0.43-14.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:08:08.514557Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12950-1","title":"apache-commons-fileupload-1.5-1.1 on GA media","description":"These are all security issues fixed in the apache-commons-fileupload-1.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:26.464504Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13441-1","title":"tomcat10-10.1.14-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:52.718146Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"ROOT-APP-MAVEN-CVE-2023-24998","title":"CVE-2023-24998 in io.root.org.apache.tomcat.embed:tomcat-embed-core - Patched by Root","description":"Root has patched CVE-2023-24998 in the io.root.org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-07-09T10:48:48Z","modified":"2026-07-09T14:00:31.958351919Z","updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"SUSE-SU-2023:0695-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2023-24998: Fixed FileUpload DoS with excessive parts (bsc#1208513).\n","status":"published","published":"2023-03-10T08:39:56Z","modified":"2025-05-02T04:34:41.340033Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:0696-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2023-24998: Fixed FileUpload DoS with excessive parts (bsc#1208513).\n","status":"published","published":"2023-03-10T08:40:20Z","modified":"2026-02-04T03:34:48.974588Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:0697-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2023-24998: Fixed FileUpload DoS with excessive parts (bsc#1208513).\n","status":"published","published":"2023-03-10T08:41:01Z","modified":"2026-02-04T03:50:38.8104Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:0730-1","title":"Security update for jakarta-commons-fileupload","description":"This update for jakarta-commons-fileupload fixes the following issues:\n\n- CVE-2016-3092: Fixed a usage of vulnerable FileUpload package can result in denial of service (bsc#986359). \n- CVE-2023-24998: Fixed a FileUpload deny of service with excessive parts (bsc#1208513).\n","status":"published","published":"2023-03-14T15:59:49Z","modified":"2026-02-04T02:33:02.974707Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:0758-1","title":"Security update for jakarta-commons-fileupload","description":"This update for jakarta-commons-fileupload fixes the following issues:\n\n- CVE-2016-3092: Fixed a usage of vulnerable FileUpload package can result in denial of service (bsc#986359). \n- CVE-2023-24998: Fixed a FileUpload deny of service with excessive parts (bsc#1208513).\n","status":"published","published":"2023-03-16T10:34:45Z","modified":"2026-02-04T03:20:19.879247Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:1769-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2023-28708: Fixed information disclosure by not including the secure attribute (bsc#1209622).\n- CVE-2023-24998: Fixed FileUpload deny-of-service with excessive parts (bsc#1208513). \n","status":"published","published":"2023-04-05T09:07:57Z","modified":"2026-02-04T04:12:54.932739Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2390-1","title":"Security update for apache-commons-fileupload","description":"This update for apache-commons-fileupload fixes the following issues:\n\nUpdated to version 1.5:\n- CVE-2023-24998: Added a configurable maximum number of files to\n  upload per request (bsc#1208513).\n","status":"published","published":"2023-06-06T06:27:47Z","modified":"2026-02-04T04:24:12.16159Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2505-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nUpdated to version 9.0.75:\n- CVE-2023-28709: Mended an incomplete fix for CVE-2023-24998 (bsc#1208513, bsc#1211608).\n","status":"published","published":"2023-06-13T15:42:43Z","modified":"2025-05-02T04:34:41.64856Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2026:1058-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nUpdate to Tomcat 9.0.115:\n\n- CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).\n- CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash\n  (bsc#1246389).\n- CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).\n- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).\n- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).\n- CVE-2023-44487: Rapid reset attack (bsc#1216182).\n","status":"published","published":"2026-03-26T09:46:45Z","modified":"2026-03-27T08:48:24.814862Z","updated_at":"2026-11-02T15:54:01.262144Z"}]}}