{"id":"CVE-2023-46589","aliases":["ALSA-2024:0539","ALSA-2024:1134","BIT-tomcat-2023-46589","CLSA-2024-1705081413","CLSA-2024-1707420277","CLSA-2025-1742924802","CLSA-2025-1748282295","CLSA-2025-1756253007","CLSA-2026-1775608274","CLSA-2026-1784164036","CLSA-2026-1792667085","CLSA-2026-1793859817","CLSA-2026-1793861217","CLSA-2026-1793867092","DEBIAN-CVE-2023-46589","DLA-3707-1","DSA-5665-1","DSA-5667-1","EUVD-2023-2957","GHSA-fccv-jmmp-qg76","OESA-2024-2402","OESA-2024-2403","OESA-2024-2404","OESA-2024-2405","OESA-2024-2460","RHSA-2024:0532","RHSA-2024:0539","RHSA-2024:1092","RHSA-2024:1134","RHSA-2024:1318","RHSA-2024:1324","RHSA-2025:7497","RLSA-2024:0539","SUSE-SU-2024:0206-1","SUSE-SU-2024:0208-1","SUSE-SU-2024:0209-1","SUSE-SU-2024:0472-1","SUSE-SU-2026:1058-1","UBUNTU-CVE-2023-46589","USN-7032-1","openSUSE-SU-2024:13590-1","openSUSE-SU-2024:13596-1"],"status":"published","title":"Apache Tomcat: HTTP request smuggling via malformed trailer headers","description":"Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02651,"percentile":0.85828,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-444"],"published":"2023-11-28T15:31:52Z","modified":"2026-11-05T13:15:05Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["11.0.0-M11","10.1.16","9.0.83","8.5.96"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["11.0.0-M11","10.1.16","9.0.83","8.5.96"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","fixed_in":["11.0.0-M11"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:8","package":"tomcat","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"tomcat-admin-webapps","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"tomcat-docs-webapp","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"tomcat-el-3.0-api","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"tomcat-jsp-2.3-api","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"tomcat-lib","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"tomcat-servlet-4.0-api","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"tomcat-webapps","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"tomcat","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"tomcat-admin-webapps","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"tomcat-docs-webapp","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"tomcat-el-3.0-api","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"tomcat-jsp-2.3-api","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"tomcat-lib","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"tomcat-servlet-4.0-api","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"tomcat-webapps","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"tomcat","fixed_in":["8.5.96","9.0.83","10.1.16"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","fixed_in":["8.5.39-1ubuntu1~18.04.3+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","fixed_in":["8.5.39-1ubuntu1~18.04.3+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","fixed_in":["8.5.39-1ubuntu1~18.04.3+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","fixed_in":["8.5.39-1ubuntu1~18.04.3+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","fixed_in":["8.5.39-1ubuntu1~18.04.3+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","fixed_in":["8.5.39-1ubuntu1~18.04.3+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","fixed_in":["8.5.39-1ubuntu1~18.04.3+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","fixed_in":["8.5.39-1ubuntu1~18.04.3+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat9-embed-java","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat9-java","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-admin","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-common","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-docs","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-examples","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-user","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-admin-webapps","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-docs-webapp","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-el-3.0-api","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-jsp-2.3-api","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-lib","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-servlet-4.0-api","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-webapps","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["9.0.50-tuxcare.7","9.0.46-tuxcare.8"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["9.0.50-tuxcare.7","9.0.46-tuxcare.8"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","fixed_in":["9.0.50-tuxcare.7","9.0.46-tuxcare.8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat10","fixed_in":["10.1.6-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat10","fixed_in":["10.1.16-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat10","fixed_in":["10.1.16-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"tomcat9","fixed_in":["9.0.31-1~deb10u11"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat","fixed_in":["1:9.0.62-5.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-admin-webapps","fixed_in":["1:9.0.62-5.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-docs-webapp","fixed_in":["1:9.0.62-5.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-el-3.0-api","fixed_in":["1:9.0.62-5.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-jsp-2.3-api","fixed_in":["1:9.0.62-5.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-lib","fixed_in":["1:9.0.62-5.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-servlet-4.0-api","fixed_in":["1:9.0.62-5.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-webapps","fixed_in":["1:9.0.62-5.el8_8.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-admin-webapps","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-docs-webapp","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-el-3.0-api","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-jsp-2.3-api","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-lib","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-servlet-4.0-api","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-webapps","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat","fixed_in":["1:9.0.62-11.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-admin-webapps","fixed_in":["1:9.0.62-11.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-docs-webapp","fixed_in":["1:9.0.62-11.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-el-3.0-api","fixed_in":["1:9.0.62-11.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-jsp-2.3-api","fixed_in":["1:9.0.62-11.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-lib","fixed_in":["1:9.0.62-11.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-servlet-4.0-api","fixed_in":["1:9.0.62-11.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-webapps","fixed_in":["1:9.0.62-11.el9_2.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-admin-webapps","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-docs-webapp","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-el-3.0-api","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-jsp-2.3-api","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-lib","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-servlet-4.0-api","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-webapps","fixed_in":["1:9.0.62-37.el9_3.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"tomcat","fixed_in":["1:9.0.62-27.el8_9.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","fixed_in":["9.0.36-3.118.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","fixed_in":["9.0.36-3.118.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"tomcat10","fixed_in":["10.1.18-150200.5.8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"tomcat10","fixed_in":["10.1.18-150200.5.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"tomcat","fixed_in":["9.0.36-150100.4.105.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"tomcat","fixed_in":["9.0.36-150100.4.105.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"tomcat","fixed_in":["9.0.36-150100.4.105.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","fixed_in":["8.5.39-1ubuntu1~18.04.3+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","fixed_in":["9.0.16-3ubuntu0.18.04.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"tomcat9","fixed_in":["9.0.31-1ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","fixed_in":["9.0.58-1ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"tomcat9","fixed_in":["9.0.70-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"tomcat9","fixed_in":["9.0.70-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tomcat","fixed_in":["9.0.85-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","fixed_in":["10.1.18-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.0-M11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"fixed":"9.0.83"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.96"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.0-M11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"fixed":"9.0.83"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.96"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.0-M11"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"tomcat","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.0"},{"fixed":"8.5.96"},{"introduced":"9.0.0"},{"fixed":"9.0.83"},{"introduced":"10.1.0"},{"fixed":"10.1.16"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat9-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat9-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els1"}]}],"bundled":34},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.7"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.7"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.7"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.8"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.8"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.8"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.5"}]}],"versions":["9.0.13","9.0.13-tuxcare.1","9.0.13-tuxcare.2","9.0.13-tuxcare.3","9.0.13-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.5"}]}],"versions":["9.0.13","9.0.13-tuxcare.1","9.0.13-tuxcare.2","9.0.13-tuxcare.3","9.0.13-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.5"}]}],"versions":["9.0.13","9.0.13-tuxcare.1","9.0.13-tuxcare.2","9.0.13-tuxcare.3","9.0.13-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.5"}]}],"versions":["9.0.13","9.0.13-tuxcare.1","9.0.13-tuxcare.2","9.0.13-tuxcare.3","9.0.13-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.3"}]}],"versions":["9.0.39","9.0.39-tuxcare.1","9.0.39-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.3"}]}],"versions":["9.0.39","9.0.39-tuxcare.1","9.0.39-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.3"}]}],"versions":["9.0.39","9.0.39-tuxcare.1","9.0.39-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.3"}]}],"versions":["9.0.39","9.0.39-tuxcare.1","9.0.39-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.3"}]}],"versions":["9.0.39","9.0.39-tuxcare.1","9.0.39-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.3"}]}],"versions":["9.0.39","9.0.39-tuxcare.1","9.0.39-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.7"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4","7.0.109-tuxcare.5","7.0.109-tuxcare.6"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.7"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4","7.0.109-tuxcare.5","7.0.109-tuxcare.6"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.7"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4","7.0.109-tuxcare.5","7.0.109-tuxcare.6"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.7"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4","7.0.109-tuxcare.5","7.0.109-tuxcare.6"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.7"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2","7.0.109-tuxcare.3","7.0.109-tuxcare.4","7.0.109-tuxcare.5","7.0.109-tuxcare.6"],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.6-1+deb12u2"}]}],"versions":["10.1.6-1","10.1.6-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.16-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.16-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u11"}]}],"versions":["9.0.16-4","9.0.16-5","9.0.22-1","9.0.24-1","9.0.27-1","9.0.31-1~bpo10+1","9.0.31-1~deb10u1","9.0.31-1~deb10u10","9.0.31-1~deb10u2","9.0.31-1~deb10u3","9.0.31-1~deb10u4","9.0.31-1~deb10u5","9.0.31-1~deb10u6","9.0.31-1~deb10u7","9.0.31-1~deb10u8","9.0.31-1~deb10u9"]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.6-1+deb12u2"}]}],"versions":["10.1.6-1","10.1.6-1+deb12u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-2~deb11u10"}]}],"versions":["9.0.43-1","9.0.43-2~deb11u1","9.0.43-2~deb11u2","9.0.43-2~deb11u3","9.0.43-2~deb11u4","9.0.43-2~deb11u5","9.0.43-2~deb11u6","9.0.43-2~deb11u7","9.0.43-2~deb11u8","9.0.43-2~deb11u9"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.0-M11"}]}],"versions":["11.0.0-M1","11.0.0-M10","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.16"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.2","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"fixed":"9.0.83"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.96"}]}],"versions":["8.5.0","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.0-M11"}]}],"versions":["11.0.0-M1","11.0.0-M10","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.16"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.2","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"fixed":"9.0.83"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.96"}]}],"versions":["8.5.0","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.0-M11"}]}],"versions":["11.0.0-M1","11.0.0-M10","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.96-1.oe2203sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.96-1.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.96-1.oe2203sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.96-1.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.96-2.oe2403"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-5.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-5.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-5.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-5.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-5.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-5.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-5.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-5.el8_8.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-37.el9_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-17.redhat_17.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-17.redhat_17.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-17.redhat_17.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-17.redhat_17.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-17.redhat_17.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-17.redhat_17.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-27.el8_9.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.118.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.118.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.18-150200.5.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.18-150200.5.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-150100.4.105.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-150100.4.105.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-150100.4.105.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-150200.57.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.37-1","6.0.39-1","6.0.39-1ubuntu0.1","6.0.39-1ubuntu0.1+esm1","6.0.39-1ubuntu0.1+esm2","6.0.39-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3","7.0.52-1ubuntu0.6","7.0.52-1ubuntu0.7","7.0.52-1ubuntu0.8","7.0.52-1ubuntu0.9","7.0.52-1ubuntu0.10","7.0.52-1ubuntu0.11","7.0.52-1ubuntu0.13","7.0.52-1ubuntu0.14","7.0.52-1ubuntu0.15","7.0.52-1ubuntu0.16","7.0.52-1ubuntu0.16+esm1","7.0.52-1ubuntu0.16+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.64-1","7.0.68-1","7.0.68-1ubuntu0.1","7.0.68-1ubuntu0.3","7.0.68-1ubuntu0.4","7.0.68-1ubuntu0.4+esm1","7.0.68-1ubuntu0.4+esm2","7.0.68-1ubuntu0.4+esm3","7.0.68-1ubuntu0.4+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+esm3"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2","8.5.39-1ubuntu1~18.04.3","8.5.39-1ubuntu1~18.04.3+esm1","8.5.39-1ubuntu1~18.04.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+esm3"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1","9.0.16-3ubuntu0.18.04.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.7"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1","9.0.31-1ubuntu0.2","9.0.31-1ubuntu0.3","9.0.31-1ubuntu0.4","9.0.31-1ubuntu0.5","9.0.31-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.58-1ubuntu0.1+esm3"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1","9.0.58-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2ubuntu0.1"}]}],"versions":["9.0.70-1ubuntu1","9.0.70-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2ubuntu1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+esm3"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2","8.5.39-1ubuntu1~18.04.3","8.5.39-1ubuntu1~18.04.3+esm1","8.5.39-1ubuntu1~18.04.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+esm3"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1","9.0.16-3ubuntu0.18.04.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.7"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1","9.0.31-1ubuntu0.2","9.0.31-1ubuntu0.3","9.0.31-1ubuntu0.4","9.0.31-1ubuntu0.5","9.0.31-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.58-1ubuntu0.1+esm3"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1","9.0.58-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2ubuntu0.1"}]}],"versions":["9.0.70-1ubuntu1","9.0.70-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.85-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.18-1.1"}]}]}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"}],"references":[{"url":"https://lists.apache.org/thread/0rqq6ktozqc42ro8hhxdmmdjm1k1tpxr","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web","article","report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/11/28/2","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20231214-0009/","tags":["x_transferred","web","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00001.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46589","tags":["web","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/28/2","tags":["web","article","report"]},{"url":"https://github.com/apache/tomcat/commit/6f181e1062a472bc5f0234980f66cbde42c1041b","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/7a2d8818fcea0b51747a67af9510ce7977245ebd","tags":["web","report"]},{"url":"https://github.com/apache/tomcat/commit/aa92971e879a519384c517febc39fd04c48d4642","tags":["web","report"]},{"url":"https://github.com/apache/tomcat/commit/b5776d769bffeade865061bc8ecbeb2b56167b08","tags":["web","report"]},{"url":"https://tomcat.apache.org/security-10.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-11.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-8.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20231214-0009","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fccv-jmmp-qg76"},{"url":"https://access.redhat.com/errata/RHSA-2024:0539","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46589","tags":["report"]},{"url":"https://bugzilla.redhat.com/2252050","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-0539.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1134","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-1134.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18_04-els/CLSA-2024-1705081413","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1707420277.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1742924802.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46589.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-46589","tags":["advisory"]},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2402","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25762","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24549","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34750","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2403","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2404","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2405","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2460","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52318","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0532","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252050","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0532.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46589","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0539.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1092","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1092.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1134.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1318","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.7/html/red_hat_jboss_web_server_5.7_service_pack_8_release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2248616","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269607","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1318.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5678","tags":["advisory"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055","tags":["article"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c","tags":["article"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017","tags":["article"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6","tags":["article"]},{"url":"https://www.openssl.org/news/secadv/20231106.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24549","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24549","tags":["advisory"]},{"url":"https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1324","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/6.0/html/red_hat_jboss_web_server_6.0_service_pack_1_release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235370","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1324.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41080","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41080","tags":["advisory"]},{"url":"https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7497","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2332815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2351129","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7497.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-42795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243752","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-42795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42795","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/9","tags":["article"]},{"url":"https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44487","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242803","tags":["report"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["advisory"]},{"url":"https://github.com/dotnet/announcements/issues/277","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2102","tags":["advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","tags":["article"]},{"url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243749","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45648","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/10","tags":["article"]},{"url":"https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23672","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269608","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23672","tags":["advisory"]},{"url":"https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52316","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52316","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52316","tags":["advisory"]},{"url":"https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-54677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-54677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54677","tags":["advisory"]},{"url":"https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-56337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2333521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-56337","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56337","tags":["advisory"]},{"url":"https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-50379","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-24813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-24813","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24813","tags":["advisory"]},{"url":"https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2024:0539","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240206-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1217649","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46589","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240208-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240209-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240472-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216118","tags":["report"]},{"url":"https://bugzilla.suse.com/1216119","tags":["report"]},{"url":"https://bugzilla.suse.com/1216120","tags":["report"]},{"url":"https://bugzilla.suse.com/1217402","tags":["report"]},{"url":"https://bugzilla.suse.com/1217768","tags":["report"]},{"url":"https://bugzilla.suse.com/1219208","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22029","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261058-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216182","tags":["report"]},{"url":"https://bugzilla.suse.com/1243895","tags":["report"]},{"url":"https://bugzilla.suse.com/1246318","tags":["report"]},{"url":"https://bugzilla.suse.com/1246389","tags":["report"]},{"url":"https://bugzilla.suse.com/1258371","tags":["report"]},{"url":"https://bugzilla.suse.com/1258385","tags":["report"]},{"url":"https://bugzilla.suse.com/1259224","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24733","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-46589","tags":["report"]},{"url":"https://github.com/apache/tomcat/commit/abdf1d8e8a8f12d1956f2828bf22b9846a6dcdef","tags":["report"]},{"url":"https://github.com/apache/tomcat/commit/0a11905b67fdff58f4efa77fb099ca9967a709b3","tags":["report"]},{"url":"https://github.com/apache/tomcat/commit/bcacd783e2593ae9b2c07a561bd5f95a145a7761","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7032-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-46589","title":"Apache Tomcat: HTTP request smuggling via malformed trailer headers","description":"Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.","status":"published","published":"2023-11-28T15:31:52.366Z","modified":"2025-10-29T12:00:24.622Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-2957","description":"Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.","status":"published","published":"2023-11-28T15:31:52Z","modified":"2025-10-29T12:00:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:36.644055Z"}],"ghsa":[{"id":"GHSA-fccv-jmmp-qg76","title":"Apache Tomcat Improper Input Validation vulnerability","description":"Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82, and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.","status":"published","published":"2023-11-28T18:30:23Z","modified":"2026-10-02T20:14:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20","CWE-444"],"updated_at":"2026-11-02T14:41:24.739884Z"}],"nvd":[{"id":"CVE-2023-46589","description":"Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.","status":"published","published":"2023-11-28T16:15:06.943Z","modified":"2026-06-17T06:31:10.34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:08:49.393375Z"}],"osv":[{"id":"CVE-2023-46589","title":"Apache Tomcat: HTTP request smuggling via malformed trailer headers","description":"Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.","status":"published","published":"2023-11-28T15:31:52.366Z","modified":"2026-10-28T02:30:50.921976448Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DEBIAN-CVE-2023-46589","description":"Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single  request as multiple requests leading to the possibility of request  smuggling when behind a reverse proxy.   Older, EOL versions may also be affected.   Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.","status":"published","published":"2023-11-28T16:15:06.943Z","modified":"2026-10-26T18:01:28.178486625Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"GHSA-fccv-jmmp-qg76","title":"Apache Tomcat Improper Input Validation vulnerability","description":"Improper Input Validation vulnerability in Apache Tomcat. Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82, and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.","status":"published","published":"2023-11-28T18:30:23Z","modified":"2026-10-02T20:30:05.627846032Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20","CWE-444"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"OESA-2024-2402","title":"tomcat security update","description":"The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project\r\n\r\nSecurity Fix(es):\r\n\r\nThe simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.(CVE-2021-43980)\r\n\r\nIf a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.(CVE-2022-25762)\r\n\r\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.(CVE-2023-44487)\r\n\r\nImproper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\r\n\r\n(CVE-2023-46589)\r\n\r\nDenial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-23672)\r\n\r\nDenial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-24549)\r\n\r\nImproper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\r\n\r\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\r\n\r\n(CVE-2024-34750)","status":"published","published":"2024-11-15T11:07:52Z","modified":"2026-08-18T01:18:38.7788029Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2403","title":"tomcat security update","description":"The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project\r\n\r\nSecurity Fix(es):\r\n\r\nThe simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.(CVE-2021-43980)\r\n\r\nIf a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.(CVE-2022-25762)\r\n\r\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.(CVE-2023-44487)\r\n\r\nImproper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\r\n\r\n(CVE-2023-46589)\r\n\r\nDenial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-23672)\r\n\r\nDenial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-24549)\r\n\r\nImproper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\r\n\r\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\r\n\r\n(CVE-2024-34750)","status":"published","published":"2024-11-15T11:07:52Z","modified":"2026-08-18T01:18:38.954475963Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2404","title":"tomcat security update","description":"The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project\r\n\r\nSecurity Fix(es):\r\n\r\nThe simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.(CVE-2021-43980)\r\n\r\nIf a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.(CVE-2022-25762)\r\n\r\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.(CVE-2023-44487)\r\n\r\nImproper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\r\n\r\n(CVE-2023-46589)\r\n\r\nDenial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-23672)\r\n\r\nDenial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-24549)\r\n\r\nImproper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\r\n\r\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\r\n\r\n(CVE-2024-34750)","status":"published","published":"2024-11-15T11:07:52Z","modified":"2026-08-18T01:18:38.806059434Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2405","title":"tomcat security update","description":"The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project\r\n\r\nSecurity Fix(es):\r\n\r\nThe simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.(CVE-2021-43980)\r\n\r\nIf a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.(CVE-2022-25762)\r\n\r\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.(CVE-2023-44487)\r\n\r\nImproper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\r\n\r\n(CVE-2023-46589)\r\n\r\nDenial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-23672)\r\n\r\nDenial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-24549)\r\n\r\nImproper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\r\n\r\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\r\n\r\n(CVE-2024-34750)","status":"published","published":"2024-11-15T11:07:52Z","modified":"2026-08-18T01:18:39.093006087Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2460","title":"tomcat security update","description":"The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project\r\n\r\nSecurity Fix(es):\r\n\r\nThe simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.(CVE-2021-43980)\r\n\r\nIf a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.(CVE-2022-25762)\r\n\r\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.(CVE-2023-44487)\r\n\r\nImproper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\r\n\r\n(CVE-2023-46589)\r\n\r\nDenial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-23672)\r\n\r\nDenial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-24549)\r\n\r\nImproper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\r\n\r\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\r\n\r\n(CVE-2024-34750)\r\n\r\n(CVE-2024-52318)","status":"published","published":"2024-11-22T11:07:56Z","modified":"2026-08-18T01:18:41.61739436Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2024:0532","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2024-09-20T14:46:33Z","modified":"2026-09-28T10:02:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:0539","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2024-09-20T14:46:42Z","modified":"2026-09-28T10:02:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2024:1092","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2024-09-20T14:48:44Z","modified":"2026-09-28T10:02:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1134","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2024-09-20T14:48:52Z","modified":"2026-09-28T10:02:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1318","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.8 release and security update","status":"published","published":"2024-09-20T14:48:19Z","modified":"2026-10-15T10:07:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1324","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 6.0.1 release and security update","status":"published","published":"2024-09-20T14:48:02Z","modified":"2026-10-13T10:06:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2025:7497","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-05-14T10:06:39Z","modified":"2026-10-15T10:11:39Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"UBUNTU-CVE-2023-46589","description":"Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.","status":"published","published":"2023-11-28T16:15:00Z","modified":"2026-06-04T12:45:23.83706676Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:0539","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-01-29T00:00:00Z","modified":"2026-10-29T11:02:20.339286665Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2024:1134","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-03-05T00:00:00Z","modified":"2026-10-29T11:32:01.422432059Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"BIT-tomcat-2023-46589","title":"Apache Tomcat: HTTP request smuggling via malformed trailer headers","description":"Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0 through 11.0.0, from 10.1.0 through 10.1.15, from 9.0.0 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.","status":"published","published":"2024-03-06T11:07:35.204Z","modified":"2026-09-08T08:48:20.923927679Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2024-1705081413","title":"Fix CVE(s): CVE-2023-46589","description":"\n   * SECURITY UPDATE: Request smuggling\n     - debian/patches/CVE-2023-46589-pre1.patch: Correct a regression in the\n       error page handling that prevented error pages from issuing redirects\n       or taking other action that required the response status code to be\n       changed\n     - debian/patches/CVE-2023-46589-pre2.patch: Align processing of trailer\n       headers with standard processing\n     - debian/patches/CVE-2023-46589-pre3.patch: Differentiate request\n       cancellation from a bad request\n     - debian/patches/CVE-2023-46589-pre4.patch: Use application provided\n       status code for error page if present\n     - debian/patches/CVE-2023-46589.patch: Ensure IOException on request\n       read always triggers error handling\n     - CVE-2023-46589\n   * Internal tests:\n     - debian/patches/0100-stop-testing-if-a-failure-occurs.patch: Stop testing\n       if a failure occurs\n     - debian/patches/0101-skipping-tests-incompatible-with-firewall.patch:\n       Skipping tests incompatible with the firewall settings of the build\n       system\n     - debian/test_certs/user1.jks: Update the keystore file from the upstream\n       branch 8.5.x","status":"published","published":"2024-01-12T17:43:37Z","modified":"2026-06-04T10:03:16.099055Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2024-1707420277","title":"Fix CVE(s): CVE-2023-46589","description":"   * SECURITY UPDATE: Incorrect parsing of HTTP trailer headers\n     - debian/patches/CVE-2023-46589.patch: Ensure IOException on request\n       read always triggers error handling\n     - CVE-2023-46589\n   * Internal tests:\n     - debian/patches/0100-stop-testing-if-a-failure-occurs.patch: Stop testing\n       if a failure occurs\n     - debian/patches/0101-skipping-tests-incompatible-with-firewall.patch:\n       Skipping tests incompatible with the firewall settings of the build\n       system\n     - debian/test_certs/*, debian/source/include-binaries, debian/rules:\n       Update the keystore files and certificates from the upstream branch\n       9.0.x to fix internal tests","status":"published","published":"2024-02-08T19:24:40Z","modified":"2026-06-04T10:04:23.238282Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2025-1742924802","title":"tomcat: Fix of CVE-2023-46589","description":"- CVE-2023-46589: fix improper input validation vulnerability","status":"published","published":"2025-03-25T17:46:47Z","modified":"2026-06-01T00:30:34.620782758Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1748282295","title":"Fix of 34 CVEs","description":"   * SECURITY UPDATE: Misc vulnerability fixes\n     - CVE-2019-12418, CVE-2019-17563, CVE-2020-1935,\n       CVE-2020-11996, CVE-2020-13934, CVE-2020-13935,\n       CVE-2020-13943, CVE-2020-17527, CVE-2021-24122,\n       CVE-2021-30639, CVE-2021-30640, CVE-2021-33037,\n       CVE-2021-42340, CVE-2021-43980, CVE-2022-25762,\n       CVE-2022-34305, CVE-2022-45143, CVE-2023-24998,\n       CVE-2023-28709, CVE-2023-34981, CVE-2023-42794,\n       CVE-2024-21733\n   * Update to 8.5.100\n     - debian/rules,\n       debian/libtomcat8-java.poms,\n       debian/maven.rules,\n       debian/tomcat8-common.links,\n       debian/patches/0018-fix-manager-webapp.patch,\n       debian/patches/0019-add-distribution-to-error-page.patch,\n       debian/patches/0021-dont-test-unsupported-ciphers.patch,\n       debian/patches/0101-skipping-tests-incompatible-with-firewall.patch:\n       updated\n     - debian/patches/0002-do-not-load-AJP13-connector-by-default.patch,\n       debian/patches/0026-easymock4-compatibility.patch:\n       removed as they were applied in upstream\n     - CVE-2019-0221.patch, CVE-2019-10072-1.patch,\n       CVE-2019-10072-2.patch, CVE-2022-42252.patch,\n       CVE-2020-1938.patch, CVE-2021-25122.patch,\n       CVE-2021-41079.patch, CVE-2022-29885.patch,\n       CVE-2020-9484.patch, CVE-2021-25329-pre1.patch,\n       CVE-2021-25329.patch, CVE-2022-23181.patch,\n       CVE-2023-44487.patch, CVE-2023-46589-pre1.patch,\n       CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch,\n       CVE-2023-46589-pre4.patch, CVE-2023-46589.patch:\n       removed because these CVEs were fixed in upstream\n   * Internal tests\n     - debian/test_certs/*: updated from upstream branch 9.0.x, as the\n       8.0.x certs were expired","status":"published","published":"2025-05-27T13:45:18Z","modified":"2026-06-04T10:03:30.412984079Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1756253007","title":"TuxCare security update for 5 packages (18 CVEs)","description":"TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1.","status":"published","published":"2026-08-04T14:52:04Z","modified":"2026-11-02T19:45:08.567289918Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1775608274","title":"TuxCare security update for 3 packages (1 CVE)","description":"TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 9.0.50-tuxcare.7.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-11-02T19:45:21.52943931Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1784164036","title":"TuxCare security update for 3 packages (1 CVE)","description":"TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 9.0.46-tuxcare.8.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-11-02T19:45:43.074897128Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1792667085","title":"TuxCare security update for 7 packages (24 CVEs)","description":"TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.","status":"published","published":"2026-10-22T11:04:45Z","modified":"2026-11-02T19:46:30.557831164Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793859817","title":"TuxCare security update for 4 packages (3 CVEs)","description":"TuxCare rebuilt 4 packages to address 3 CVEs. Fixed in 9.0.13-tuxcare.5.","status":"published","published":"2026-11-05T07:23:38Z","modified":"2026-11-05T13:15:02.297126623Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793861217","title":"TuxCare security update for 6 packages (9 CVEs)","description":"TuxCare rebuilt 6 packages to address 9 CVEs. Fixed in 9.0.39-tuxcare.3.","status":"published","published":"2026-11-05T07:46:58Z","modified":"2026-11-05T13:15:05.086514908Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793867092","title":"TuxCare security update for 5 packages (8 CVEs)","description":"TuxCare rebuilt 5 packages to address 8 CVEs. Fixed in 7.0.109-tuxcare.7.","status":"published","published":"2026-11-05T09:24:53Z","modified":"2026-11-05T13:15:04.233713871Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"DLA-3707-1","title":"tomcat9 - security update","status":"published","published":"2024-01-05T00:00:00Z","modified":"2026-03-09T01:18:43.038159Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5665-1","title":"tomcat10 - security update","status":"published","published":"2024-04-17T00:00:00Z","modified":"2026-03-09T02:11:33.04307Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"DSA-5667-1","title":"tomcat9 - security update","status":"published","published":"2024-04-19T00:00:00Z","modified":"2026-03-09T02:11:40.582652Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:13590-1","title":"tomcat-9.0.85-1.1 on GA media","description":"These are all security issues fixed in the tomcat-9.0.85-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:44.707311Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13596-1","title":"tomcat10-10.1.18-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.18-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:04:02.890921Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RLSA-2024:0539","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-02-12T20:16:50.551634Z","modified":"2026-02-05T08:45:18.952824Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2024:0206-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nSecurity fixes:\n\n - CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing. (bsc#1217649)\n\nOther fixes:\n\n- Streamline how patches are handled in the spec file of the package\n","status":"published","published":"2024-01-24T12:54:18Z","modified":"2026-02-04T03:44:31.786086Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0208-1","title":"Security update for tomcat10","description":"This update for tomcat10 fixes the following issues:\n\nUpdated to Tomcat 10.1.18\n\n- CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing (bsc#1217649)\n\nFind the full release notes at:\n\nhttps://tomcat.apache.org/tomcat-9.0-doc/changelog.html\n","status":"published","published":"2024-01-24T12:54:37Z","modified":"2026-02-04T04:31:21.974592Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0209-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nSecurity fixes:\n\n - CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing. (bsc#1217649)\n\nOther fixes:\n\n- Streamline how patches are handled in the spec file of the package\n","status":"published","published":"2024-01-24T12:55:05Z","modified":"2026-02-04T03:29:10.2067Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0472-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nUpdated to Tomcat 9.0.85:\n\n- CVE-2023-45648: Improve trailer header parsing (bsc#1216118).\n- CVE-2023-42794: FileUpload: remove tmp files to avoid DoS on Windows (bsc#1216120).\n- CVE-2023-42795: Improve handling of failures during recycle() methods (bsc#1216119).\n- CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing (bsc#1217649)\n- CVE-2024-22029: Fixed escalation to root from tomcat user via %post script. (bsc#1219208)\n    \nThe following non-security issues were fixed:\n\n- Fixed the file permissions for server.xml (bsc#1217768, bsc#1217402).\n\nFind the full release notes at:\n\nhttps://tomcat.apache.org/tomcat-9.0-doc/changelog.html\n","status":"published","published":"2024-02-14T14:02:00Z","modified":"2026-02-04T03:56:15.926664Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2026:1058-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nUpdate to Tomcat 9.0.115:\n\n- CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).\n- CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash\n  (bsc#1246389).\n- CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).\n- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).\n- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).\n- CVE-2023-44487: Rapid reset attack (bsc#1216182).\n","status":"published","published":"2026-03-26T09:46:45Z","modified":"2026-03-27T08:48:24.814862Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"USN-7032-1","title":"tomcat8, tomcat9 vulnerability","description":"It was discovered that Tomcat incorrectly handled HTTP trailer headers. A\nremote attacker could possibly use this issue to perform HTTP request\nsmuggling.\n","status":"published","published":"2024-09-24T20:19:41Z","modified":"2026-04-27T17:29:46.479775Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}