{"id":"CVE-2023-28709","aliases":["ALSA-2023:6570","ALSA-2023:7065","BIT-tomcat-2023-28709","CLSA-2025-1748282295","CLSA-2026-1783472552","CLSA-2026-1786382292","CLSA-2026-1787675020","CLSA-2026-1793859628","CLSA-2026-1793867092","DEBIAN-CVE-2023-28709","DSA-5521-1","EUVD-2023-2040","GHSA-cx6h-86xw-9x34","MGASA-2023-0191","OESA-2024-1100","RHSA-2023:4909","RHSA-2023:6570","RHSA-2023:7065","ROOT-APP-MAVEN-CVE-2023-28709","SUSE-SU-2023:2318-1","SUSE-SU-2023:2319-1","SUSE-SU-2023:2504-1","SUSE-SU-2023:2505-1","SUSE-SU-2026:1058-1","UBUNTU-CVE-2023-28709","openSUSE-SU-2024:12953-1","openSUSE-SU-2024:13441-1"],"status":"published","title":"Apache Tomcat: Fix for CVE-2023-24998 is incomplete","description":"The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.48031,"percentile":0.98866,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-193"],"published":"2023-05-22T10:08:49Z","modified":"2026-11-05T13:15:04Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["11.0.0-M5","10.1.8","9.0.74"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","fixed_in":["8.5.88"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["8.5.78-tuxcare.4"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","fixed_in":["8.5.78-tuxcare.4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat10","fixed_in":["10.1.6-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat10","fixed_in":["10.1.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat10","fixed_in":["10.1.10-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"tomcat","fixed_in":["9.0.74-1.mga8"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["9.0.74-aikido.2","9.0.74-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["9.0.74-root.io.2","9.0.74-root.io.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"tomcat","fixed_in":["9.0.36-3.105.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"tomcat","fixed_in":["9.0.36-3.105.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tomcat","fixed_in":["9.0.36-3.105.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"tomcat","fixed_in":["9.0.36-3.105.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"tomcat","fixed_in":["9.0.36-3.105.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","fixed_in":["9.0.36-3.105.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","fixed_in":["9.0.36-3.105.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"tomcat","fixed_in":["8.0.53-29.66.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"tomcat","fixed_in":["9.0.36-150100.4.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"tomcat","fixed_in":["9.0.36-150100.4.93.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"tomcat","fixed_in":["9.0.36-150100.4.93.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tomcat","fixed_in":["9.0.75-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M2"},{"fixed":"11.0.0-M5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.5"},{"fixed":"10.1.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.71"},{"fixed":"9.0.74"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.85"},{"fixed":"8.5.88"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Bitnami","package":"tomcat","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.85"},{"last_affected":"8.5.87"},{"introduced":"9.0.71"},{"last_affected":"9.0.73"},{"introduced":"10.1.5"},{"last_affected":"10.1.7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.11"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.11"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.11"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.11"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.10"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7","9.0.46-tuxcare.8","9.0.46-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.10"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7","9.0.46-tuxcare.8","9.0.46-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.10"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7","9.0.46-tuxcare.8","9.0.46-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.1"}]}],"versions":["7.0.70"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.1"}]}],"versions":["7.0.70"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.1"}]}],"versions":["7.0.70"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.78"},{"fixed":"8.5.78-tuxcare.4"}]}],"versions":["8.5.78","8.5.78-tuxcare.1","8.5.78-tuxcare.2","8.5.78-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.78"},{"fixed":"8.5.78-tuxcare.4"}]}],"versions":["8.5.78","8.5.78-tuxcare.1","8.5.78-tuxcare.2","8.5.78-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.7"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4","7.0.109-tuxcare.5","7.0.109-tuxcare.6"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.7"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4","7.0.109-tuxcare.5","7.0.109-tuxcare.6"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.7"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4","7.0.109-tuxcare.5","7.0.109-tuxcare.6"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.7"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4","7.0.109-tuxcare.5","7.0.109-tuxcare.6"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.7"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4","7.0.109-tuxcare.5","7.0.109-tuxcare.6"],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.6-1+deb12u1"}]}],"versions":["10.1.6-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.10-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.6-1+deb12u1"}]}],"versions":["10.1.6-1"],"bundled":5},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M2"},{"fixed":"11.0.0-M5"}]}],"versions":["11.0.0-M3","11.0.0-M4"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.5"},{"fixed":"10.1.8"}]}],"versions":["10.1.5","10.1.6","10.1.7"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.71"},{"fixed":"9.0.74"}]}],"versions":["9.0.71","9.0.72","9.0.73"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.85"},{"fixed":"8.5.88"}]}],"versions":["8.5.85","8.5.86","8.5.87"]},{"source":"osv","ecosystem":"Mageia:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.74-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-31.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-31.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-33.oe2203sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-33.oe2203sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-33.oe2203sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.10-33.oe2203sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-15.redhat_15.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el7jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-15.redhat_00013.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.74-aikido.2"},{"fixed":"9.0.74-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.74-root.io.2"},{"fixed":"9.0.74-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.105.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.105.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.105.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.105.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.105.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.105.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.105.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.53-29.66.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-150100.4.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-150100.4.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-150100.4.93.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-150200.41.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.75-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.14-1.1"}]}],"bundled":49}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"},{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"7-mode_transition_tool"}],"references":[{"url":"https://lists.apache.org/thread/7wvxonzwb7k9hx9jt3q33cmy7j97jo3j","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2023/05/22/1","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202305-37","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230616-0004/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2023/dsa-5521","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28709","tags":["web","advisory"]},{"url":"https://tomcat.apache.org/security-10.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-11.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-8.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/5badf94e79e5de206fc0ef3054fd536b1bb787cd","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/ba848da71c523d94950d3c53c19ea155189df9dc","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/d53d8e7f77042cc32a3b98f589496a1ef5088e38","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/fbd81421629afe8b8a3922d59020cde81caea861","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20230616-0004","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cx6h-86xw-9x34"},{"url":"https://access.redhat.com/errata/RHSA-2023:6570","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24998","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28708","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28709","tags":["report"]},{"url":"https://bugzilla.redhat.com/2172298","tags":["report"]},{"url":"https://bugzilla.redhat.com/2180856","tags":["report"]},{"url":"https://bugzilla.redhat.com/2210321","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6570.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7065","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7065.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28709.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-28709","tags":["advisory"]},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0191.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31951","tags":["report"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.74","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1100","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42795","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:4909","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2210321","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4909.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24963","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24963","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24963","tags":["advisory"]},{"url":"https://lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57xqzfksq9","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24998","tags":["advisory"]},{"url":"https://commons.apache.org/proper/commons-fileupload/security-reports.html#Fixed_in_Apache_Commons_FileUpload_1.5","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28708","tags":["advisory"]},{"url":"https://bz.apache.org/bugzilla/show_bug.cgi?id=66471","tags":["article"]},{"url":"https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28709","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2189675","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6570.json","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173874","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2189676","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7065.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232318-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1211608","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232319-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232504-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232505-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208513","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261058-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216182","tags":["report"]},{"url":"https://bugzilla.suse.com/1243895","tags":["report"]},{"url":"https://bugzilla.suse.com/1246318","tags":["report"]},{"url":"https://bugzilla.suse.com/1246389","tags":["report"]},{"url":"https://bugzilla.suse.com/1258371","tags":["report"]},{"url":"https://bugzilla.suse.com/1258385","tags":["report"]},{"url":"https://bugzilla.suse.com/1259224","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24733","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-28709","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-0221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45143","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-28709","title":"Apache Tomcat: Fix for CVE-2023-24998 is incomplete","description":"The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.","status":"published","published":"2023-05-22T10:08:49.541Z","modified":"2025-02-13T16:48:49.704Z","cwes":["CWE-193"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-2040","description":"The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.","status":"published","published":"2023-05-22T10:08:49Z","modified":"2025-02-13T16:48:49Z","updated_at":"2026-11-03T00:03:50.947767Z"}],"ghsa":[{"id":"GHSA-cx6h-86xw-9x34","title":"Apache Tomcat - Fix for CVE-2023-24998 was incomplete","description":"The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.","status":"published","published":"2023-07-06T21:14:59Z","modified":"2024-04-24T19:16:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:37:46.019452Z"}],"nvd":[{"id":"CVE-2023-28709","description":"The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.","status":"published","published":"2023-05-22T11:15:09.423Z","modified":"2026-06-17T05:48:36.553Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:08:03.200773Z"}],"osv":[{"id":"DEBIAN-CVE-2023-28709","description":"The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.","status":"published","published":"2023-05-22T11:15:09.423Z","modified":"2026-10-26T18:01:39.820615708Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"GHSA-cx6h-86xw-9x34","title":"Apache Tomcat - Fix for CVE-2023-24998 was incomplete","description":"The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.","status":"published","published":"2023-07-06T21:14:59Z","modified":"2026-03-24T11:11:51.396429Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"OESA-2024-1100","title":"tomcat security update","description":"The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project\r\n\r\nSecurity Fix(es):\r\n\r\nApache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\r\n\r\n\r\n\r\n\nNote that, like all of the file upload limits, the\n          new configuration option (FileUploadBase#setFileCountMax) is not\n          enabled by default and must be explicitly configured.\r\n\r\n\n(CVE-2023-24998)\r\n\r\nThe fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.\r\n\r\n\r\n\r\n\n(CVE-2023-28709)\r\n\r\nIncomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could \ncause Tomcat to skip some parts of the recycling process leading to \ninformation leaking from the current request/response to the next.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.\r\n\r\n(CVE-2023-42795)","status":"published","published":"2024-01-26T11:06:33Z","modified":"2026-08-18T01:18:13.44880743Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2023:4909","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.4 release and security update","status":"published","published":"2024-09-20T14:30:56Z","modified":"2026-10-08T10:03:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:6570","title":"Red Hat Security Advisory: tomcat security and bug fix update","status":"published","published":"2024-09-20T14:38:47Z","modified":"2026-10-08T10:04:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2023:7065","title":"Red Hat Security Advisory: tomcat security and bug fix update","status":"published","published":"2024-09-20T14:40:06Z","modified":"2026-10-08T10:04:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"UBUNTU-CVE-2023-28709","description":"The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.","status":"withdrawn","published":"2023-05-22T11:15:00Z","modified":"2026-06-01T17:15:08.649046819Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"ALSA-2023:6570","title":"Moderate: tomcat security and bug fix update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)\n* tomcat: not including the secure attribute causes information disclosure (CVE-2023-28708)\n* tomcat: Fix for CVE-2023-24998 was incomplete (CVE-2023-28709)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:58.211162749Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:7065","title":"Moderate: tomcat security and bug fix update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998)\n* tomcat: not including the secure attribute causes information disclosure (CVE-2023-28708)\n* tomcat: Fix for CVE-2023-24998 was incomplete (CVE-2023-28709)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:19.334768596Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"BIT-tomcat-2023-28709","title":"Apache Tomcat: Fix for CVE-2023-24998 is incomplete","description":"The fix for CVE-2023-24998 was incomplete for Apache Tomcat 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.","status":"published","published":"2026-03-24T10:21:40.054Z","modified":"2026-09-08T08:48:20.911285946Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2025-1748282295","title":"Fix of 34 CVEs","description":"   * SECURITY UPDATE: Misc vulnerability fixes\n     - CVE-2019-12418, CVE-2019-17563, CVE-2020-1935,\n       CVE-2020-11996, CVE-2020-13934, CVE-2020-13935,\n       CVE-2020-13943, CVE-2020-17527, CVE-2021-24122,\n       CVE-2021-30639, CVE-2021-30640, CVE-2021-33037,\n       CVE-2021-42340, CVE-2021-43980, CVE-2022-25762,\n       CVE-2022-34305, CVE-2022-45143, CVE-2023-24998,\n       CVE-2023-28709, CVE-2023-34981, CVE-2023-42794,\n       CVE-2024-21733\n   * Update to 8.5.100\n     - debian/rules,\n       debian/libtomcat8-java.poms,\n       debian/maven.rules,\n       debian/tomcat8-common.links,\n       debian/patches/0018-fix-manager-webapp.patch,\n       debian/patches/0019-add-distribution-to-error-page.patch,\n       debian/patches/0021-dont-test-unsupported-ciphers.patch,\n       debian/patches/0101-skipping-tests-incompatible-with-firewall.patch:\n       updated\n     - debian/patches/0002-do-not-load-AJP13-connector-by-default.patch,\n       debian/patches/0026-easymock4-compatibility.patch:\n       removed as they were applied in upstream\n     - CVE-2019-0221.patch, CVE-2019-10072-1.patch,\n       CVE-2019-10072-2.patch, CVE-2022-42252.patch,\n       CVE-2020-1938.patch, CVE-2021-25122.patch,\n       CVE-2021-41079.patch, CVE-2022-29885.patch,\n       CVE-2020-9484.patch, CVE-2021-25329-pre1.patch,\n       CVE-2021-25329.patch, CVE-2022-23181.patch,\n       CVE-2023-44487.patch, CVE-2023-46589-pre1.patch,\n       CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch,\n       CVE-2023-46589-pre4.patch, CVE-2023-46589.patch:\n       removed because these CVEs were fixed in upstream\n   * Internal tests\n     - debian/test_certs/*: updated from upstream branch 9.0.x, as the\n       8.0.x certs were expired","status":"published","published":"2025-05-27T13:45:18Z","modified":"2026-06-04T10:03:30.412984079Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2026-1783472552","title":"TuxCare security update for 4 packages (4 CVEs)","description":"TuxCare rebuilt 4 packages to address 4 CVEs. Fixed in 9.0.50-tuxcare.11.","status":"published","published":"2026-08-04T14:52:42Z","modified":"2026-11-02T19:45:39.744264566Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1786382292","title":"TuxCare security update for 3 packages (2 CVEs)","description":"TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.0.46-tuxcare.10.","status":"published","published":"2026-08-10T17:18:12Z","modified":"2026-11-02T19:45:50.525073488Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1787675020","title":"TuxCare security update for 3 packages (3 CVEs)","description":"TuxCare rebuilt 3 packages to address 3 CVEs. Fixed in 7.0.70-tuxcare.1.","status":"published","published":"2026-08-25T16:23:40Z","modified":"2026-11-02T19:45:57.945575152Z","updated_at":"2026-11-02T20:29:49.757752Z"},{"id":"CLSA-2026-1793859628","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 8.5.78-tuxcare.4.","status":"published","published":"2026-11-05T07:20:29Z","modified":"2026-11-05T13:15:04.99670345Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793867092","title":"TuxCare security update for 5 packages (8 CVEs)","description":"TuxCare rebuilt 5 packages to address 8 CVEs. Fixed in 7.0.109-tuxcare.7.","status":"published","published":"2026-11-05T09:24:53Z","modified":"2026-11-05T13:15:04.233713871Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CVE-2023-28709","title":"Apache Tomcat: Fix for CVE-2023-24998 is incomplete","description":"The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP       connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was       submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.","status":"published","published":"2023-05-22T10:08:49.541Z","modified":"2026-10-28T02:30:35.535247108Z","cwes":["CWE-193"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DSA-5521-1","title":"tomcat10 - security update","status":"published","published":"2023-10-10T00:00:00Z","modified":"2026-03-09T02:11:43.662141Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0191","title":"Updated tomcat packages fix security vulnerability","description":"The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to\n11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If\nnon-default HTTP connector settings were used such that the\nmaxParameterCount could be reached using query string parameters and a\nrequest was submitted that supplied exactly maxParameterCount parameters\nin the query string, the limit for uploaded request parts could be\nbypassed with the potential for a denial of service to occur.\n(CVE-2023-28709)\n","status":"published","published":"2023-05-31T06:41:32Z","modified":"2026-04-16T04:40:46.267825298Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12953-1","title":"tomcat-9.0.75-1.1 on GA media","description":"These are all security issues fixed in the tomcat-9.0.75-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:20:12.286156Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13441-1","title":"tomcat10-10.1.14-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:52:52.718146Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"ROOT-APP-MAVEN-CVE-2023-28709","title":"CVE-2023-28709 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root","description":"Root has patched CVE-2023-28709 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-10T07:26:21Z","modified":"2026-09-10T08:15:05.898875507Z","updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"SUSE-SU-2023:2318-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2023-28709: Mended an incomplete fix for CVE-2023-24998 (bsc#1211608).\n","status":"published","published":"2023-05-30T12:14:21Z","modified":"2026-02-04T03:15:07.574864Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2319-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2023-28709: Mended an incomplete fix for CVE-2023-24998 (bsc#1211608).\n","status":"published","published":"2023-05-30T12:17:29Z","modified":"2025-05-02T04:34:51.205981Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2504-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2023-28709: Mended an incomplete fix for CVE-2023-24998 (bsc#1211608).\n","status":"published","published":"2023-06-13T15:40:36Z","modified":"2026-02-04T04:37:42.178879Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2505-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nUpdated to version 9.0.75:\n- CVE-2023-28709: Mended an incomplete fix for CVE-2023-24998 (bsc#1208513, bsc#1211608).\n","status":"published","published":"2023-06-13T15:42:43Z","modified":"2025-05-02T04:34:41.64856Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2026:1058-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nUpdate to Tomcat 9.0.115:\n\n- CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).\n- CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash\n  (bsc#1246389).\n- CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).\n- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).\n- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).\n- CVE-2023-44487: Rapid reset attack (bsc#1216182).\n","status":"published","published":"2026-03-26T09:46:45Z","modified":"2026-03-27T08:48:24.814862Z","updated_at":"2026-11-02T15:54:01.262144Z"}]}}