{"id":"CVE-2024-24549","aliases":["ALSA-2024:3307","ALSA-2024:3666","BIT-tomcat-2024-24549","CLSA-2025-1740051873","CLSA-2025-1756253007","CLSA-2025-1759795579","CLSA-2026-1768262917","CLSA-2026-1786359337","CLSA-2026-1790631899","CLSA-2026-1792575257","CLSA-2026-1793011037","CLSA-2026-1793011786","CLSA-2026-1793125014","DEBIAN-CVE-2024-24549","DLA-3779-1","DSA-5665-1","DSA-5667-1","EUVD-2024-0863","GHSA-7w75-32cg-r6g2","MGASA-2024-0090","OESA-2024-2402","OESA-2024-2403","OESA-2024-2404","OESA-2024-2405","OESA-2024-2460","RHSA-2024:1318","RHSA-2024:1324","RHSA-2024:3307","RHSA-2024:3308","RHSA-2024:3666","RHSA-2024:3814","RHSA-2025:7497","RLSA-2024:3307","RLSA-2024:3666","ROOT-APP-MAVEN-CVE-2024-24549","SUSE-SU-2024:1204-1","SUSE-SU-2024:1205-1","SUSE-SU-2024:1345-1","SUSE-SU-2026:1058-1","UBUNTU-CVE-2024-24549","USN-7562-1","openSUSE-SU-2024:13832-1","openSUSE-SU-2024:13833-1"],"status":"published","title":"Apache Tomcat: HTTP/2 header handling DoS","description":"Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.23072,"percentile":0.97772,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2024-03-13T15:46:53Z","modified":"2026-11-02T19:46:32Z","exploits":[{"source":"pocgithub","id":"Abdurahmon3236/CVE-2024-24549","title":"Abdurahmon3236/CVE-2024-24549","date":"2024-08-02","url":"https://github.com/Abdurahmon3236/CVE-2024-24549"},{"source":"pocgithub","id":"JFOZ1010/CVE-2024-24549","title":"JFOZ1010/CVE-2024-24549","date":"2024-12-09","url":"https://github.com/JFOZ1010/CVE-2024-24549"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["8.5.99","9.0.86","10.1.19","11.0.0-M17"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","fixed_in":["11.0.0-M17","10.1.19","9.0.86","8.5.99"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"tomcat","fixed_in":["8.5.99","9.0.86","10.1.19"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-admin-webapps","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-docs-webapp","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-el-3.0-api","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-jsp-2.3-api","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-lib","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-servlet-4.0-api","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-webapps","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat10","fixed_in":["10.1.6-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat10","fixed_in":["10.1.20-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat10","fixed_in":["10.1.20-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["10.1.16-root.io.5","10.1.16-root.io.6","10.1.16-root.io.7","9.0.63-root.io.1","10.1.16-root.io.8","10.1.16-root.io.9","10.1.16-root.io.10","10.1.16-root.io.11","9.0.63-root.io.2","10.1.16-root.io.12"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["10.1.16-aikido.9","10.1.16-aikido.10","10.1.16-aikido.11","9.0.63-aikido.2","10.1.16-aikido.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","fixed_in":["8.5.39-1ubuntu1~18.04.3+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","fixed_in":["9.0.16-3ubuntu0.18.04.2+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tomcat9","fixed_in":["9.0.31-1ubuntu0.9+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","fixed_in":["9.0.58-1ubuntu0.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat10","fixed_in":["10.1.16-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat9","fixed_in":["9.0.70-2ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"tomcat9","fixed_in":["9.0.70-2ubuntu3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.98"},{"fixed":"8.5.99"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"last_affected":"9.0.85"},{"fixed":"9.0.86"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"last_affected":"10.1.18"},{"fixed":"10.1.19"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"last_affected":"11.0.0-M16"},{"fixed":"11.0.0-M17"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"last_affected":"11.0.0-M16"},{"fixed":"11.0.0-M17"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"last_affected":"10.1.18"},{"fixed":"10.1.19"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"last_affected":"9.0.85"},{"fixed":"9.0.86"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.98"},{"fixed":"8.5.99"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1.alma.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Bitnami","package":"tomcat","ranges":[{"type":"SEMVER","events":[{"introduced":"8.5.0"},{"fixed":"8.5.99"},{"introduced":"9.0.0"},{"fixed":"9.0.86"},{"introduced":"10.0.0"},{"fixed":"10.1.19"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat9-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat9-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els18"}]}],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.11"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.10","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7","9.0.46-tuxcare.8","9.0.46-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.11"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.10","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7","9.0.46-tuxcare.8","9.0.46-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.16"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.11","9.0.50-tuxcare.12","9.0.50-tuxcare.13","9.0.50-tuxcare.14","9.0.50-tuxcare.15","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.16"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.11","9.0.50-tuxcare.12","9.0.50-tuxcare.13","9.0.50-tuxcare.14","9.0.50-tuxcare.15","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.16"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.11","9.0.50-tuxcare.12","9.0.50-tuxcare.13","9.0.50-tuxcare.14","9.0.50-tuxcare.15","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.16"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.11","9.0.50-tuxcare.12","9.0.50-tuxcare.13","9.0.50-tuxcare.14","9.0.50-tuxcare.15","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.16"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.11","9.0.50-tuxcare.12","9.0.50-tuxcare.13","9.0.50-tuxcare.14","9.0.50-tuxcare.15","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.16"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.11","9.0.50-tuxcare.12","9.0.50-tuxcare.13","9.0.50-tuxcare.14","9.0.50-tuxcare.15","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.6-1+deb12u2"}]}],"versions":["10.1.6-1","10.1.6-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.20-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.20-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12"}]}],"versions":["9.0.16-4","9.0.16-5","9.0.22-1","9.0.24-1","9.0.27-1","9.0.31-1~bpo10+1","9.0.31-1~deb10u1","9.0.31-1~deb10u10","9.0.31-1~deb10u11","9.0.31-1~deb10u2","9.0.31-1~deb10u3","9.0.31-1~deb10u4","9.0.31-1~deb10u5","9.0.31-1~deb10u6","9.0.31-1~deb10u7","9.0.31-1~deb10u8","9.0.31-1~deb10u9"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.6-1+deb12u2"}]}],"versions":["10.1.6-1","10.1.6-1+deb12u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:11","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-2~deb11u10"}]}],"versions":["9.0.43-1","9.0.43-2~deb11u1","9.0.43-2~deb11u2","9.0.43-2~deb11u3","9.0.43-2~deb11u4","9.0.43-2~deb11u5","9.0.43-2~deb11u6","9.0.43-2~deb11u7","9.0.43-2~deb11u8","9.0.43-2~deb11u9"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.0-M17"}]}],"versions":["11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.19"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.2","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"fixed":"9.0.86"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.99"}]}],"versions":["8.5.0","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.99"}]}],"versions":["8.5.0","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-M1"},{"fixed":"9.0.86"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.19"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.2","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.0-M17"}]}],"versions":["11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9"]},{"source":"osv","ecosystem":"Mageia:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.96-1.oe2203sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.96-1.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.96-1.oe2203sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.96-1.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.96-2.oe2403"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-17.redhat_17.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-17.redhat_17.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-17.redhat_17.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-17.redhat_17.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-17.redhat_17.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.31-17.redhat_17.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el7jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.7::el9","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.62-41.redhat_00020.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el8","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.0::el9","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.8-6.redhat_00013.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.16-root.io.5"},{"fixed":"10.1.16-root.io.6"},{"fixed":"10.1.16-root.io.7"},{"fixed":"9.0.63-root.io.1"},{"fixed":"10.1.16-root.io.8"},{"fixed":"10.1.16-root.io.9"},{"fixed":"10.1.16-root.io.10"},{"fixed":"10.1.16-root.io.11"},{"fixed":"9.0.63-root.io.2"},{"fixed":"10.1.16-root.io.12"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.16-aikido.9"},{"fixed":"10.1.16-aikido.10"},{"fixed":"10.1.16-aikido.11"},{"fixed":"9.0.63-aikido.2"},{"fixed":"10.1.16-aikido.12"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.20-150200.5.22.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.20-150200.5.22.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.124.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.124.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.3","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"apache-commons-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-150200.11.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"apache-commons-dbcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-150200.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"apache-commons-pool2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-150200.11.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"geronimo-specs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-150200.15.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"jakarta-taglibs-standard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-150000.4.10.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-150200.65.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+esm5"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2","8.5.39-1ubuntu1~18.04.3","8.5.39-1ubuntu1~18.04.3+esm1","8.5.39-1ubuntu1~18.04.3+esm2","8.5.39-1ubuntu1~18.04.3+esm3","8.5.39-1ubuntu1~18.04.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+esm7"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1","9.0.16-3ubuntu0.18.04.2+esm2","9.0.16-3ubuntu0.18.04.2+esm3","9.0.16-3ubuntu0.18.04.2+esm4","9.0.16-3ubuntu0.18.04.2+esm5","9.0.16-3ubuntu0.18.04.2+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+esm2"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1","9.0.31-1ubuntu0.2","9.0.31-1ubuntu0.3","9.0.31-1ubuntu0.4","9.0.31-1ubuntu0.5","9.0.31-1ubuntu0.6","9.0.31-1ubuntu0.7","9.0.31-1ubuntu0.8","9.0.31-1ubuntu0.9","9.0.31-1ubuntu0.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.58-1ubuntu0.2+esm3"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1","9.0.58-1ubuntu0.1+esm2","9.0.58-1ubuntu0.1+esm3","9.0.58-1ubuntu0.1+esm4","9.0.58-1ubuntu0.2","9.0.58-1ubuntu0.2+esm1","9.0.58-1ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.16-1ubuntu0.1~esm2"}]}],"versions":["10.1.10-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.16-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2ubuntu0.1+esm2"}]}],"versions":["9.0.70-1ubuntu1","9.0.70-2","9.0.70-2ubuntu0.1","9.0.70-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2ubuntu3"}]}],"versions":["9.0.70-2ubuntu1.1","9.0.70-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.39-1ubuntu1~18.04.3+esm5"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2","8.5.39-1ubuntu1~18.04.3","8.5.39-1ubuntu1~18.04.3+esm1","8.5.39-1ubuntu1~18.04.3+esm2","8.5.39-1ubuntu1~18.04.3+esm3","8.5.39-1ubuntu1~18.04.3+esm4"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+esm7"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1","9.0.16-3ubuntu0.18.04.2+esm2","9.0.16-3ubuntu0.18.04.2+esm3","9.0.16-3ubuntu0.18.04.2+esm4","9.0.16-3ubuntu0.18.04.2+esm5","9.0.16-3ubuntu0.18.04.2+esm6"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+esm2"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1","9.0.31-1ubuntu0.2","9.0.31-1ubuntu0.3","9.0.31-1ubuntu0.4","9.0.31-1ubuntu0.5","9.0.31-1ubuntu0.6","9.0.31-1ubuntu0.7","9.0.31-1ubuntu0.8","9.0.31-1ubuntu0.9","9.0.31-1ubuntu0.9+esm1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.58-1ubuntu0.2+esm3"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1","9.0.58-1ubuntu0.1+esm2","9.0.58-1ubuntu0.1+esm3","9.0.58-1ubuntu0.1+esm4","9.0.58-1ubuntu0.2","9.0.58-1ubuntu0.2+esm1","9.0.58-1ubuntu0.2+esm2"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.16-1ubuntu0.1~esm2"}]}],"versions":["10.1.10-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.16-1ubuntu0.1~esm1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2ubuntu0.1+esm2"}]}],"versions":["9.0.70-1ubuntu1","9.0.70-2","9.0.70-2ubuntu0.1","9.0.70-2ubuntu0.1+esm1"],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.87-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.20-1.1"}]}],"bundled":2}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240402-0002/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/04/msg00001.html","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/13/3","tags":["x_transferred","Mailing List","discussion","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24549","tags":["web","advisory"]},{"url":"https://github.com/apache/tomcat/commit/0cac540a882220231ba7a82330483cbd5f6b1f96","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/810f49d5ff6d64b704af85d5b8d0aab9ec3c83f5","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/8e03be9f2698f2da9027d40b9e9c0c9429b74dc0","tags":["web","report"]},{"url":"https://github.com/apache/tomcat/commit/d07c82194edb69d99b438828fe2cbfadbb207843","tags":["web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240402-0002","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/736G4GPZWS2DSQO5WKXO3G6OMZKFEK55","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UWIS5MMGYDZBLJYT674ZI5AWFHDZ46B","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7w75-32cg-r6g2"},{"url":"https://access.redhat.com/errata/RHSA-2024:3307","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23672","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24549","tags":["report"]},{"url":"https://bugzilla.redhat.com/2269607","tags":["report"]},{"url":"https://bugzilla.redhat.com/2269608","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-3307.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3666","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-3666.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2022-45143.html","tags":["report"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1740051873.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1786359337.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34750","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52316","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56337","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29146","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24549.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-24549","tags":["advisory"]},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2024-0090.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32980","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/03/13/3","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/03/13/4","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2402","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-43980","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25762","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46589","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23672","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2403","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2404","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2405","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2460","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52318","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1318","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/5.7/html/red_hat_jboss_web_server_5.7_service_pack_8_release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2248616","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269607","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1318.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5678","tags":["advisory"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055","tags":["article"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c","tags":["article"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017","tags":["article"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6","tags":["article"]},{"url":"https://www.openssl.org/news/secadv/20231106.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46589","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46589","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/28/2","tags":["article"]},{"url":"https://lists.apache.org/thread/0rqq6ktozqc42ro8hhxdmmdjm1k1tpxr","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24549","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1324","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/6.0/html/red_hat_jboss_web_server_6.0_service_pack_1_release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235370","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1324.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41080","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41080","tags":["advisory"]},{"url":"https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269608","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3307.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158695","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45143","tags":["advisory"]},{"url":"https://lists.apache.org/thread/yqkd183xrw3wqvnpcg3osbcryq85fkzj","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23672","tags":["advisory"]},{"url":"https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3308","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3308.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3666.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3814","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3814.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172298","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24998","tags":["advisory"]},{"url":"https://commons.apache.org/proper/commons-fileupload/security-reports.html#Fixed_in_Apache_Commons_FileUpload_1.5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28708","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180856","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28708","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28708","tags":["advisory"]},{"url":"https://bz.apache.org/bugzilla/show_bug.cgi?id=66471","tags":["article"]},{"url":"https://lists.apache.org/thread/hdksc59z3s7tm39x0pp33mtwdrt8qr67","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-42795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243752","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-42795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42795","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/9","tags":["article"]},{"url":"https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243749","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45648","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/10","tags":["article"]},{"url":"https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7497","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2332815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2351129","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7497.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44487","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242803","tags":["report"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["advisory"]},{"url":"https://github.com/dotnet/announcements/issues/277","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2102","tags":["advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","tags":["article"]},{"url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52316","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52316","tags":["advisory"]},{"url":"https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-54677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-54677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54677","tags":["advisory"]},{"url":"https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-56337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2333521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-56337","tags":["advisory"]},{"url":"https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-50379","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-24813","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-24813","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24813","tags":["advisory"]},{"url":"https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3307","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3666","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241204-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221385","tags":["report"]},{"url":"https://bugzilla.suse.com/1221386","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24549","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241205-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241345-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261058-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216182","tags":["report"]},{"url":"https://bugzilla.suse.com/1243895","tags":["report"]},{"url":"https://bugzilla.suse.com/1246318","tags":["report"]},{"url":"https://bugzilla.suse.com/1246389","tags":["report"]},{"url":"https://bugzilla.suse.com/1258371","tags":["report"]},{"url":"https://bugzilla.suse.com/1258385","tags":["report"]},{"url":"https://bugzilla.suse.com/1259224","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24733","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-24549","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7562-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-28708","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-42795","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-21733","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-23672","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-34750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38286","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-24549","title":"Apache Tomcat: HTTP/2 header handling DoS","description":"Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.","status":"published","published":"2024-03-13T15:46:53.085Z","modified":"2025-10-29T11:56:23.336Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:13.64024Z"}],"euvd":[{"id":"EUVD-2024-0863","description":"Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.","status":"published","published":"2024-03-13T15:46:53Z","modified":"2025-10-29T11:56:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:36.644055Z"}],"ghsa":[{"id":"GHSA-7w75-32cg-r6g2","title":"Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests","description":"Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.","status":"published","published":"2024-03-13T18:31:34Z","modified":"2025-02-13T19:07:46Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:31.416868Z"}],"nvd":[{"id":"CVE-2024-24549","description":"Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.","status":"published","published":"2024-03-13T16:15:29.373Z","modified":"2026-06-17T07:14:35.11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:09:40.831473Z"}],"osv":[{"id":"CVE-2024-24549","title":"Apache Tomcat: HTTP/2 header handling DoS","description":"Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.","status":"published","published":"2024-03-13T15:46:53.085Z","modified":"2026-10-28T02:30:47.832107835Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"DEBIAN-CVE-2024-24549","description":"Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected.  Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.","status":"published","published":"2024-03-13T16:15:29.373Z","modified":"2026-11-02T12:00:50.172998657Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-7w75-32cg-r6g2","title":"Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests","description":"Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\n\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.","status":"published","published":"2024-03-13T18:31:34Z","modified":"2026-08-13T20:11:57.58925979Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"OESA-2024-2402","title":"tomcat security update","description":"The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project\r\n\r\nSecurity Fix(es):\r\n\r\nThe simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.(CVE-2021-43980)\r\n\r\nIf a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.(CVE-2022-25762)\r\n\r\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.(CVE-2023-44487)\r\n\r\nImproper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\r\n\r\n(CVE-2023-46589)\r\n\r\nDenial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-23672)\r\n\r\nDenial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-24549)\r\n\r\nImproper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\r\n\r\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\r\n\r\n(CVE-2024-34750)","status":"published","published":"2024-11-15T11:07:52Z","modified":"2026-08-18T01:18:38.7788029Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2403","title":"tomcat security update","description":"The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project\r\n\r\nSecurity Fix(es):\r\n\r\nThe simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.(CVE-2021-43980)\r\n\r\nIf a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.(CVE-2022-25762)\r\n\r\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.(CVE-2023-44487)\r\n\r\nImproper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\r\n\r\n(CVE-2023-46589)\r\n\r\nDenial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-23672)\r\n\r\nDenial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-24549)\r\n\r\nImproper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\r\n\r\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\r\n\r\n(CVE-2024-34750)","status":"published","published":"2024-11-15T11:07:52Z","modified":"2026-08-18T01:18:38.954475963Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2404","title":"tomcat security update","description":"The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project\r\n\r\nSecurity Fix(es):\r\n\r\nThe simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.(CVE-2021-43980)\r\n\r\nIf a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.(CVE-2022-25762)\r\n\r\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.(CVE-2023-44487)\r\n\r\nImproper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\r\n\r\n(CVE-2023-46589)\r\n\r\nDenial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-23672)\r\n\r\nDenial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-24549)\r\n\r\nImproper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\r\n\r\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\r\n\r\n(CVE-2024-34750)","status":"published","published":"2024-11-15T11:07:52Z","modified":"2026-08-18T01:18:38.806059434Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2405","title":"tomcat security update","description":"The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project\r\n\r\nSecurity Fix(es):\r\n\r\nThe simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.(CVE-2021-43980)\r\n\r\nIf a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.(CVE-2022-25762)\r\n\r\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.(CVE-2023-44487)\r\n\r\nImproper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\r\n\r\n(CVE-2023-46589)\r\n\r\nDenial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-23672)\r\n\r\nDenial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-24549)\r\n\r\nImproper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\r\n\r\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\r\n\r\n(CVE-2024-34750)","status":"published","published":"2024-11-15T11:07:52Z","modified":"2026-08-18T01:18:39.093006087Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2460","title":"tomcat security update","description":"The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project\r\n\r\nSecurity Fix(es):\r\n\r\nThe simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.(CVE-2021-43980)\r\n\r\nIf a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.(CVE-2022-25762)\r\n\r\nThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.(CVE-2023-44487)\r\n\r\nImproper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.\r\n\r\n(CVE-2023-46589)\r\n\r\nDenial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-23672)\r\n\r\nDenial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.\r\n\r\n(CVE-2024-24549)\r\n\r\nImproper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.\r\n\r\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.\r\n\r\nUsers are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.\r\n\r\n(CVE-2024-34750)\r\n\r\n(CVE-2024-52318)","status":"published","published":"2024-11-22T11:07:56Z","modified":"2026-08-18T01:18:41.61739436Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2024:1318","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.8 release and security update","status":"published","published":"2024-09-20T14:48:19Z","modified":"2026-10-15T10:07:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1324","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 6.0.1 release and security update","status":"published","published":"2024-09-20T14:48:02Z","modified":"2026-10-13T10:06:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:3307","title":"Red Hat Security Advisory: tomcat security and bug fix update","status":"published","published":"2024-09-16T18:43:20Z","modified":"2026-10-02T10:04:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3308","title":"Red Hat Security Advisory: tomcat security and bug fix update","status":"published","published":"2024-09-16T18:43:11Z","modified":"2026-09-28T10:03:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3666","title":"Red Hat Security Advisory: tomcat security and bug fix update","status":"published","published":"2024-09-16T18:43:28Z","modified":"2026-10-02T10:04:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3814","title":"Red Hat Security Advisory: tomcat security and bug fix update","status":"published","published":"2024-09-16T18:43:36Z","modified":"2026-10-13T10:07:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2025:7497","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-05-14T10:06:39Z","modified":"2026-10-15T10:11:39Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"ROOT-APP-MAVEN-CVE-2024-24549","title":"CVE-2024-24549 in io.root.org.apache.tomcat.embed:tomcat-embed-core - Patched by Root","description":"Root has patched CVE-2024-24549 in the io.root.org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-08-03T06:45:39Z","modified":"2026-08-03T13:45:17.109651223Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2024-24549","description":"Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through 10.1.18, from 9.0.0-M1 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M17, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.","status":"published","published":"2024-03-13T16:15:00Z","modified":"2026-06-01T17:15:10.123656949Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:42.68848Z"},{"id":"ALSA-2024:3307","title":"Important: tomcat security and bug fix update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)\n* Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)\n\nBug Fix(es) and Enhancement(s):\n\n* Rebase tomcat to version 9.0.87 (JIRA:AlmaLinux-34815)\n* Amend tomcat's changelog so that fixed CVEs are mentioned explicitly (JIRA:AlmaLinux-35328)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.","status":"published","published":"2024-05-23T00:00:00Z","modified":"2026-10-29T11:31:45.301511251Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:3666","title":"Important: tomcat security and bug fix update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)\n* Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)\n\nBug Fix(es):\n\n* Rebase tomcat to version 9.0.87 (JIRA:AlmaLinux-35813)\n* Amend tomcat package's changelog so that fixed CVEs are mentioned explicitly (JIRA:AlmaLinux-38548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-06-06T00:00:00Z","modified":"2026-10-29T11:12:03.77247802Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"BIT-tomcat-2024-24549","title":"Apache Tomcat: HTTP/2 header handling DoS","description":"Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.This issue affects Apache Tomcat: from 11.0.0 through 11.0.0, from 10.1.0 through 10.1.18, from 9.0.0 through 9.0.85, from 8.5.0 through 8.5.98. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.0, 10.1.19, 9.0.86 or 8.5.99 which fix the issue.","status":"published","published":"2025-07-17T08:09:49.355Z","modified":"2026-09-08T08:48:20.912070142Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2025-1740051873","title":"tomcat: Fix of CVE-2024-24549","description":"- CVE-2024-24549: fix improper input validation vulnerability for HTTP/2\n  requests","status":"published","published":"2025-02-20T11:44:39Z","modified":"2026-06-01T00:30:20.857962082Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1756253007","title":"TuxCare security update for 5 packages (18 CVEs)","description":"TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1.","status":"published","published":"2026-08-04T14:52:04Z","modified":"2026-11-02T19:45:08.567289918Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1759795579","title":"TuxCare security update for 6 packages (18 CVEs)","description":"TuxCare rebuilt 6 packages to address 18 CVEs. Fixed in 9.0.83-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-10-30T07:30:07.718953578Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1768262917","title":"TuxCare security update for 6 packages (22 CVEs)","description":"TuxCare rebuilt 6 packages to address 22 CVEs. Fixed in 10.1.18-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:12.278630051Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1786359337","title":"Fix of 8 CVEs","description":"   * SECURITY UPDATE: HTTP/2 header limit errors deferred until whole header block read\n     - debian/patches/CVE-2024-24549.patch: validate headers after each HEADERS/CONTINUATION payload instead of only at end of block in java/org/apache/coyote/http2/Http2Parser.java, and swap the header emitter to the sink once validation fails in java/org/apache/coyote/http2/{Stream,Http2UpgradeHandler}.java\n     - CVE-2024-24549\n   * SECURITY UPDATE: HTTP/2 active stream miscount leading to infinite connection timeout\n     - debian/patches/CVE-2024-34750.patch: count each stream out of the active set exactly once in java/org/apache/coyote/http2/{Http2UpgradeHandler,Http2AsyncUpgradeHandler,Stream}.java\n     - CVE-2024-34750\n   * SECURITY UPDATE: RCE via TOCTOU race in write-enabled default servlet on case insensitive file systems\n     - debian/patches/CVE-2024-50379.patch: add path-keyed read/write locking via the new java/org/apache/catalina/WebResourceLockSet.java and use it in java/org/apache/catalina/webresources/{DirResourceSet,FileResource}.java\n     - CVE-2024-50379\n   * SECURITY UPDATE: incomplete mitigation for CVE-2024-50379 on Java 8 and Java 11\n     - debian/patches/CVE-2024-56337.patch: set -Dsun.io.useCanonCaches=false before any file system access in bin/catalina.sh\n     - CVE-2024-56337\n   * SECURITY UPDATE: authentication bypass when a Jakarta Authentication component throws\n     - debian/patches/CVE-2024-52316.patch: set a 500 status when validateRequest() throws AuthException in java/org/apache/catalina/authenticator/AuthenticatorBase.java\n     - CVE-2024-52316\n   * SECURITY UPDATE: HTTP/2 denial of service via client triggered server side stream resets\n     - debian/patches/CVE-2025-48989.patch: charge server initiated resets to the overhead counter in java/org/apache/coyote/http2/{Http2UpgradeHandler,Http2AsyncUpgradeHandler}.java\n     - CVE-2025-48989\n   * SECURITY UPDATE: directory traversal via Rewrite Valve normalizing before decoding\n     - debian/patches/CVE-2025-55752.patch: decode the rewritten URL before normalizing it in java/org/apache/catalina/valves/rewrite/RewriteValve.java\n     - CVE-2025-55752\n   * SECURITY UPDATE: EncryptInterceptor padding oracle from the CBC default\n     - debian/patches/CVE-2026-29146.patch: reject cipher modes that provide no protection and warn on the weaker ones in java/org/apache/catalina/tribes/group/interceptors/EncryptInterceptor.java; AES/GCM/PKCS5Padding, AES/CBC/NoPadding, AES/CFB/NoPadding and AES/OFB/NoPadding are now refused at startup\n     - CVE-2026-29146","status":"published","published":"2026-08-10T10:55:54Z","modified":"2026-10-26T09:43:33.048913023Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1790631899","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 9.0.46-tuxcare.11.","status":"published","published":"2026-09-28T21:44:59Z","modified":"2026-11-02T19:46:24.371922192Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1792575257","title":"TuxCare security update for 8 packages (32 CVEs)","description":"TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.","status":"published","published":"2026-10-21T09:34:17Z","modified":"2026-11-02T19:46:30.353719339Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793011037","title":"TuxCare security update for 5 packages (26 CVEs)","description":"TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.","status":"published","published":"2026-10-26T10:37:17Z","modified":"2026-11-02T19:46:31.628369017Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793011786","title":"TuxCare security update for 7 packages (22 CVEs)","description":"TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.","status":"published","published":"2026-10-26T10:49:46Z","modified":"2026-11-02T19:46:31.559502384Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793125014","title":"TuxCare security update for 6 packages (3 CVEs)","description":"TuxCare rebuilt 6 packages to address 3 CVEs. Fixed in 9.0.50-tuxcare.16.","status":"published","published":"2026-10-27T18:16:54Z","modified":"2026-11-02T19:46:32.122826248Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"DLA-3779-1","title":"tomcat9 - security update","status":"published","published":"2024-04-06T00:00:00Z","modified":"2026-03-09T01:18:27.102826Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5665-1","title":"tomcat10 - security update","status":"published","published":"2024-04-17T00:00:00Z","modified":"2026-03-09T02:11:33.04307Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"DSA-5667-1","title":"tomcat9 - security update","status":"published","published":"2024-04-19T00:00:00Z","modified":"2026-03-09T02:11:40.582652Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0090","title":"Updated tomcat packages fix security vulnerabilities","description":"Denial of Service via incomplete cleanup vulnerability in Apache Tomcat.\nIt was possible for WebSocket clients to keep WebSocket connections open\nleading to increased resource consumption. (CVE-2024-23672)\nDenial of Service due to improper input validation vulnerability for\nHTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if\nthe request exceeded any of the configured limits for headers, the\nassociated HTTP/2 stream was not reset until after all of the headers\nhad been processed. (CVE-2024-24549)\n","status":"published","published":"2024-03-26T22:02:49Z","modified":"2026-04-16T04:42:39.234215073Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13832-1","title":"tomcat-9.0.87-1.1 on GA media","description":"These are all security issues fixed in the tomcat-9.0.87-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:08.970085Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:13833-1","title":"tomcat10-10.1.20-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.20-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:28:55.088933Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"RLSA-2024:3307","title":"Important: tomcat security and bug fix update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)\n\n* Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)\n\nBug Fix(es) and Enhancement(s):\n\n* Rebase tomcat to version 9.0.87 (JIRA:Rocky Linux-34815)\n\n* Amend tomcat's changelog so that fixed CVEs are mentioned explicitly (JIRA:Rocky Linux-35328)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.","status":"published","published":"2024-06-14T14:00:40.182624Z","modified":"2026-02-05T05:00:14.527161Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:3666","title":"Important: tomcat security and bug fix update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)\n\n* Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)\n\nBug Fix(es):\n\n* Rebase tomcat to version 9.0.87 (JIRA:Rocky Linux-35813)\n\n* Amend tomcat package's changelog so that fixed CVEs are mentioned explicitly (JIRA:Rocky Linux-38548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-06-14T13:59:30.118978Z","modified":"2026-02-05T13:00:05.954996Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:1204-1","title":"Security update for tomcat10","description":"This update for tomcat10 fixes the following issues:\n\n- CVE-2024-24549: Fixed denial of service during header validation for HTTP/2 stream (bsc#1221386)\n- CVE-2024-23672: Fixed denial of service due to malicious WebSocket client keeping connection open (bsc#1221385)\n\nOther fixes:\n- Update to Tomcat 10.1.20\n  * Catalina\n    + Fix:  Minor performance improvement for building filter chains. \n      Based on ideas from #702 by Luke Miao. (remm)\n    + Fix:  Align error handling for Writer and OutputStream. Ensure \n      use of either once the response has been recycled triggers a \n      NullPointerException provided that discardFacades is configured with \n      the default value of true. (markt)\n    + Fix:  68692: The standard thread pool implementations that are \n      configured using the Executor element now implement ExecutorService \n      for better support NIO2. (remm)\n    + Fix:  68495: When restoring a saved POST request after a \n      successful FORM authentication, ensure that neither the URI, the \n      query string nor the protocol are corrupted when restoring the \n      request body. (markt)\n    + Fix:  After forwarding a request, attempt to unwrap the \n      response in order to suspend it, instead of simply closing it if it \n      was wrapped. Add a new suspendWrappedResponseAfterForward boolean \n      attribute on Context to control the bahavior, defaulting to false. \n      (remm)\n    + Fix:  68721: Workaround a possible cause of duplicate class \n      definitions when using ClassFileTransformers and the transformation \n      of a class also triggers the loading of the same class. (markt)\n    + Fix:  The rewrite valve should not do a rewrite if the output \n      is identical to the input. (remm)\n    + Update:  Add a new valveSkip (or VS) rule flag to the rewrite \n      valve to allow skipping over the next valve in the Catalina pipeline. \n      (remm)\n    + Update:  Add highConcurrencyStatus attribute to the \n      SemaphoreValve to optionally allow the valve to return an error \n      status code to the client when a permit cannot be acquired from the \n      semaphore. (remm)\n    + Add:  Add checking of the 'age' of the running Tomcat instance \n      since its build-date to the SecurityListener, and log a warning if \n      the server is old. (schultz)\n    + Fix:  When using the AsyncContext, throw an \n      IllegalStateException, rather than allowing an NullPointerException, \n      if an attempt is made to use the AsyncContext after it has been \n      recycled. (markt)\n    + Fix:  Correct JPMS and OSGi meta-data for tomcat-embed-core.jar \n      by removing reference to org.apache.catalina.ssi package that is no \n      longer included in the JAR. Based on pull request #684 by Jendrik \n      Johannes. (markt)\n    + Fix:  Fix ServiceBindingPropertySource so that trailing \\r\\n \n      sequences are correctly removed from files containing property values \n      when configured to do so. Bug identified by Coverity Scan. (markt)\n    + Add:  Add improvements to the CSRF prevention filter including \n      the ability to skip adding nonces for resource name and subtree URL \n      patterns. (schultz)\n    + Fix:  Review usage of debug logging and downgrade trace or data \n      dumping operations from debug level to trace. (remm)\n    + Fix:  68089: Further improve the performance of request \n      attribute access for ApplicationHttpRequest and ApplicationRequest. \n      (markt)\n    + Fix:  68559: Allow asynchronous error handling to write to the \n      response after an error during asynchronous processing. (markt)\n  * Coyote\n    + Fix:  Improve the HTTP/2 stream prioritisation process. If a \n      stream uses all of the connection windows and still has content to \n      write, it will now be added to the backlog immediately rather than \n      waiting until the write attempt for the remaining content. (markt)\n    + Fix:  Add threadsMaxIdleTime attribute to the endpoint, to \n      allow configuring the amount of time before an internal executor will \n      scale back to the configured minSpareThreads size. (remm)\n    + Fix:  Correct a regression in the support for user provided \n      SSLContext instances that broke the \n      org.apache.catalina.security.TLSCertificateReloadListener. (markt)\n    + Fix:  Setting a null value for a cookie attribute should remove \n      the attribute. (markt)\n    + Fix:  Make asynchronous error handling more robust. Ensure that \n      once a connection is marked to be closed, further asynchronous \n      processing cannot change that. (markt)\n    + Fix:  Make asynchronous error handling more robust. Ensure that \n      once the call to AsyncListener.onError() has returned to the \n      container, only container threads can access the AsyncContext. This \n      protects against various race conditions that woudl otherwise occur \n      if application threads continued to access the AsyncContext.\n    + Fix:  Review usage of debug logging and downgrade trace or data \n      dumping operations from debug level to trace. In particular, most of \n      the HTTP/2 debug logging has been changed to trace level. (remm)\n    + Fix:  Add support for user provided SSLContext instances \n      configured on SSLHostConfigCertificate instances. Based on pull \n      request #673 provided by Hakan Altındağ. (markt)\n    + Fix:  Partial fix for 68558: Cache the result of converting to \n      String for request URI, HTTP header names and the request \n      Content-Type value to improve performance by reducing repeated byte[] \n      to String conversions. (markt)\n    + Fix:  Improve error reporting to HTTP/2 clients for header \n      processing errors by reporting problems at the end of the frame where \n      the error was detected rather than at the end of the headers. (markt)\n    + Fix:  Remove the remaining reference to a stream once the \n      stream has been recycled. This makes the stream eligible for garbage \n      collection earlier and thereby improves scalability. (markt)\n  * Jasper\n    + Add:  Add support for specifying Java 22 (with the value 22) as \n      the compiler source and/or compiler target for JSP compilation. If \n      used with an Eclipse JDT compiler version that does not support these \n      values, a warning will be logged and the default will used. (markt)\n    + Fix:  Handle the case where the JSP engine forwards a \n      request/response to a Servlet that uses an OutputStream rather than a \n      Writer. This was triggering an IllegalStateException on code paths \n      where there was a subsequent attempt to obtain a Writer. (markt)\n    + Fix:  Correctly handle the case where a tag library is packaged \n      in a JAR file and the web application is deployed as a WAR file \n      rather than an unpacked directory. (markt)\n    + Fix:  68546: Generate optimal size and types for JSP imports \n      maps, as suggested by John Engebretson. (remm)\n    + Fix:  Review usage of debug logging and downgrade trace or data \n      dumping operations from debug level to trace. (remm)\n  *\tCluster\n    + Fix:  Avoid updating request count stats on async. (remm)\n  * WebSocket\n    + Fix:  Correct a regression in the fix for 66508 that could \n      cause an UpgradeProcessor leak in some circumstances. (markt)\n    + Fix:  Review usage of debug logging and downgrade trace or data \n      dumping operations from debug level to trace. (remm)\n    + Fix:  Ensure that WebSocket connection closure completes if the \n      connection is closed when the server side has used the proprietary \n      suspend/resume feature to suspend the connection. (markt)\n  * Web applications\n      Add:  Add support for responses in JSON format from the examples \n      application RequestHeaderExample. (schultz)\n  * Other\n    + Add:  Improvements to French translations. (remm)\n    + Add:  Improvements to Japanese translations by tak7iji. (markt)\n    + Fix:  57130: Allow digest.(sh|bat) to accept password from a \n      file or stdin. (csutherl/schultz)\n    + Update:  Update Checkstyle to 10.14.1. (markt)\n    + Fix:  Correct the remaining OSGi contract references in the \n      manifest files to refer to the Jakarta EE contract names rather than \n      the Java EE contract names. Based on pull request #685 provided by \n      Paul A. Nicolucci. (markt)\n    + Update:  Update Checkstyle to 10.13.0. (markt)\n    + Update:  Update JSign to 6.0. (markt)\n    + Update:  Update the packaged version of the Tomcat Migration \n      Tool for Jakarta EE to 1.0.7. (markt)\n    + Update:  Update Tomcat Native to 2.0.7. (markt)\n    + Update:  Add strings for debug level messages. (remm)\n    + Add:  Improvements to French translations. (remm)\n    + Add:  Improvements to Japanese translations by tak7iji. (markt)\n","status":"published","published":"2024-04-11T10:43:42Z","modified":"2026-02-04T04:14:55.632105Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1205-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n  - CVE-2024-24549: Fixed denial of service during header validation for HTTP/2 stream (bsc#1221386)\n  - CVE-2024-23672: Fixed denial of service due to malicious WebSocket client keeping connection open (bsc#1221385)\n","status":"published","published":"2024-04-11T10:44:02Z","modified":"2026-02-04T03:00:41.372532Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1345-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2024-24549: Fixed denial of service during header validation for HTTP/2 stream (bsc#1221386)\n- CVE-2024-23672: Fixed denial of service due to malicious WebSocket client keeping connection open (bsc#1221385)\n\nOther fixes:\n- Update to Tomcat 9.0.87    \n  * Catalina\n    + Fix:  Minor performance improvement for building filter chains. Based \n      on ideas from #702 by Luke Miao. (remm)\n    + Fix:  Align error handling for Writer and OutputStream. Ensure use of \n      either once the response has been recycled triggers a \n      NullPointerException provided that discardFacades is configured with \n      the default value of true. (markt)\n    + Fix:  68692: The standard thread pool implementations that are configured\n      using the Executor element now implement ExecutorService for better \n      support NIO2. (remm)\n    + Fix:  68495: When restoring a saved POST request after a successful FORM \n      authentication, ensure that neither the URI, the query string nor the \n      protocol are corrupted when restoring the request body. (markt)\n    + Fix:  68721: Workaround a possible cause of duplicate class definitions \n      when using ClassFileTransformers and the transformation of a class also\n      triggers the loading of the same class. (markt)\n    + Fix:  The rewrite valve should not do a rewrite if the output is \n      identical to the input. (remm)\n    + Update:  Add a new valveSkip (or VS) rule flag to the rewrite valve to \n      allow skipping over the next valve in the Catalina pipeline. (remm)\n    + Fix:  Correct JPMS and OSGi meta-data for tomcat-enbed-core.jar by \n      removing reference to org.apache.catalina.ssi package that is no longer \n      included in the JAR. Based on pull request #684 by Jendrik Johannes. \n      (markt)\n    + Fix:  Fix ServiceBindingPropertySource so that trailing \\r\\n sequences \n      are correctly removed from files containing property values when \n      configured to do so. Bug identified by Coverity Scan. (markt)\n    + Add:  Add improvements to the CSRF prevention filter including the \n      ability to skip adding nonces for resource name and subtree URL patterns.\n      (schultz)\n    + Fix:  Review usage of debug logging and downgrade trace or data dumping \n      operations from debug level to trace. (remm)\n    + Fix:  68089: Further improve the performance of request attribute \n      access for ApplicationHttpRequest and ApplicationRequest. (markt)\n    + Fix:  68559: Allow asynchronous error handling to write to the \n      response after an error during asynchronous processing. (markt)\n  * Coyote\n    + Fix:  Improve the HTTP/2 stream prioritisation process. If a stream \n      uses all of the connection windows and still has content to write, it \n      will now be added to the backlog immediately rather than waiting until \n      the write  attempt for the remaining content. (markt)\n    + Fix:  Make asynchronous error handling more robust. Ensure that once \n      a connection is marked to be closed, further asynchronous processing \n      cannot change that. (markt)\n    + Fix:  Make asynchronous error handling more robust. Ensure that once \n      the call to AsyncListener.onError() has returned to the container, only \n      container threads can access the AsyncContext. This protects against \n      various race conditions that woudl otherwise occur if application threads\n      continued to access the AsyncContext.\n    + Fix:  Review usage of debug logging and downgrade trace or data \n      dumping operations from debug level to trace. In particular, most of the \n      HTTP/2 debug logging has been changed to trace level. (remm)\n    + Fix:  Add support for user provided SSLContext instances configured \n      on SSLHostConfigCertificate instances. Based on pull request #673 \n      provided by Hakan Altındağ. (markt)\n    + Fix:  Improve the Tomcat Native shutdown process to reduce the likelihood\n      of a JVM crash during Tomcat shutdown. (markt)\n    + Fix:  Partial fix for 68558: Cache the result of converting to String \n      for request URI, HTTP header names and the request Content-Type value to \n      improve performance by reducing repeated byte[] to String conversions. \n      (markt)\n    + Fix:  Improve error reporting to HTTP/2 clients for header processing \n      errors by reporting problems at the end of the frame where the error was \n      detected rather than at the end of the headers. (markt)\n    + Fix:  Remove the remaining reference to a stream once the stream has \n      been recycled. This makes the stream eligible for garbage collection \n      earlier and thereby improves scalability. (markt)\n  * Jasper\n    + Add:  Add support for specifying Java 22 (with the value 22) as the \n      compiler source and/or compiler target for JSP compilation. If used with \n      an  Eclipse JDT compiler version that does not support these values, a \n      warning will be logged and the default will used. (markt)\n    + Fix:  68546: Generate optimal size and types for JSP imports maps, as \n      suggested by John Engebretson. (remm)\n    + Fix:  Review usage of debug logging and downgrade trace or data \n      dumping operations from debug level to trace. (remm)\n  * Cluster\n    + Fix:  Avoid updating request count stats on async. (remm)\n  * WebSocket\n    + Fix:  Correct a regression in the fix for 66508 that could cause an \n      UpgradeProcessor leak in some circumstances. (markt)\n    + Fix:  Review usage of debug logging and downgrade trace or data dumping\n      operations from debug level to trace. (remm)\n    + Fix:  Ensure that WebSocket connection closure completes if the \n      connection is closed when the server side has used the proprietary \n      suspend/resume feature to suspend the connection. (markt)\n  * Web applications\n    + Add:  Add support for responses in JSON format from the examples \n      application RequestHeaderExample. (schultz)\n  * Other\n    + Add:  Improvements to French translations. (remm)\n    + Add:  Improvements to Japanese translations by tak7iji. (markt)\n    + Update:  Update Checkstyle to 10.13.0. (markt)\n    + Update:  Update JSign to 6.0. (markt)\n    + Update:  Add strings for debug level messages. (remm)\n    + Update:  Update Tomcat Native to 1.3.0. (markt)\n    + Add:  Improvements to French translations. (remm)\n    + Add:  Improvements to Japanese translations by tak7iji. (markt)\n","status":"published","published":"2024-04-18T17:15:53Z","modified":"2026-02-04T02:37:14.108837Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2026:1058-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\nUpdate to Tomcat 9.0.115:\n\n- CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).\n- CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash\n  (bsc#1246389).\n- CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).\n- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).\n- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).\n- CVE-2023-44487: Rapid reset attack (bsc#1216182).\n","status":"published","published":"2026-03-26T09:46:45Z","modified":"2026-03-27T08:48:24.814862Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"USN-7562-1","title":"tomcat vulnerabilities","description":"It was discovered that Tomcat did not include the secure attribute for\nsession cookies when using the RemoteIpFilter with requests from a reverse\nproxy. An attacker could possibly use this issue to leak sensitive\ninformation. This issue was fixed for tomcat8 on Ubuntu 18.04 LTS and for\ntomcat9 on Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04.\n(CVE-2023-28708)\n\nIt was discovered that Tomcat incorrectly recycled\ncertain objects, which could lead to information leaking from one request\nto the next. An attacker could potentially use this issue to leak sensitive\ninformation. This issue was fixed for tomcat8 on Ubuntu 18.04 LTS  and for\ntomcat9 on Ubuntu 24.04 LTS, Ubuntu 24.10, and  Ubuntu 25.04.\n(CVE-2023-42795)\n\nIt was discovered that Tomcat incorrectly handled HTTP\ntrailer headers. A remote attacker could possibly use this issue to perform\nHTTP request smuggling. This issue was fixed for tomcat8 on Ubuntu 18.04\nLTS and  for tomcat9 on Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04.\n(CVE-2023-45648)\n\nIt was discovered that Tomcat incorrectly handled\nincomplete POST requests, which could cause error responses to contain data\nfrom previous requests. An attacker could potentially use this issue to\nleak sensitive information.  This issue was fixed for tomcat8 on Ubuntu\n18.04 LTS and for tomcat9 on  Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2024-21733)\n\nIt was discovered that Tomcat incorrectly handled socket\ncleanup, which could lead to websocket connections staying open. An\nattacker could possibly use this issue to cause a denial of service. This\nissue was fixed  for tomcat8 on Ubuntu 18.04 LTS, tomcat9 on Ubuntu 24.04\nLTS,  Ubuntu 24.10, and Ubuntu 25.04, and for tomcat10 on Ubuntu 24.04 LTS.\n(CVE-2024-23672)\n\nIt was discovered that Tomcat incorrectly handled HTTP/2\nrequests that exceeded configured header limits. An attacker could possibly\nuse this issue to cause a denial of service. (CVE-2024-24549)\n\nIt was discovered that Tomcat incorrectly handled some cases of excessive HTTP\nheaders when processing HTTP/2 streams. This led to miscounting of active\nstreams and incorrect timeout handling. An attacker could possibly use this\nissue to cause connections to remain open indefinitely, leading to a denial\nof service. This issue was fixed for tomcat9 on Ubuntu 22.04 LTS,  Ubuntu\n24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04, and for tomcat10 on  Ubuntu\n24.04 LTS. (CVE-2024-34750)\n\nIt was discovered that Tomcat incorrectly\nhandled TLS handshake processes under certain configurations. An attacker\ncould possibly use this issue to cause a denial of service. This issue was\nfixed for tomcat9 on Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS,  Ubuntu 24.10, and Ubuntu 25.04, and for tomcat10 on\nUbuntu 24.04 LTS.  (CVE-2024-38286)","status":"published","published":"2025-06-09T14:59:56Z","modified":"2026-04-27T18:03:28.903908Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}