{"id":"CVE-2025-24813","aliases":["ALSA-2025:3645","ALSA-2025:3683","ALSA-2025:7494","ALSA-2025:7497","BIT-tomcat-2025-24813","CLSA-2025-1742577759","CLSA-2025-1742733084","CLSA-2025-1742737069","CLSA-2025-1750752721","CLSA-2025-1751500955","CLSA-2025-1755272015","CLSA-2025-1755513827","CLSA-2025-1755516017","CLSA-2025-1759795579","CLSA-2025-1760712981","CLSA-2025-1764720465","CLSA-2025-1765411683","CLSA-2025-1765930090","CLSA-2026-1768262917","CLSA-2026-1770077338","CLSA-2026-1773188120","CLSA-2026-1787675020","CLSA-2026-1792575257","CLSA-2026-1792667085","CLSA-2026-1793011037","CLSA-2026-1793011786","CLSA-2026-1793202343","DEBIAN-CVE-2025-24813","DLA-4108-1","DSA-5893-1","EUVD-2025-6498","GHSA-83qj-6fr2-vhqg","MGASA-2025-0105","RHSA-2025:3454","RHSA-2025:3608","RHSA-2025:3645","RHSA-2025:3646","RHSA-2025:3647","RHSA-2025:3683","RHSA-2025:3684","RHSA-2025:7494","RHSA-2025:7497","RLSA-2025:3645","RLSA-2025:3683","RLSA-2025:7494","RLSA-2025:7497","ROOT-APP-MAVEN-CVE-2025-24813","SUSE-SU-2025:0954-1","SUSE-SU-2025:1024-1","SUSE-SU-2025:1126-1","SUSE-SU-2026:1058-1","UBUNTU-CVE-2025-24813","USN-7525-1","USN-7525-2","openSUSE-SU-2025:14896-1","openSUSE-SU-2025:14897-1"],"status":"published","title":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.99942,"percentile":0.99972,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-44","CWE-502","CWE-706"],"published":"2025-03-10T16:44:03Z","modified":"2026-11-02T19:46:32Z","kev":{"date_added":"2025-04-01","due_date":"2025-04-22","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2025-04-01"},{"source":"kev","since":"2025-04-01"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/tomcat_partial_put_deserialization","title":"Tomcat Partial PUT Java Deserialization","type":"exploit","platform":"Linux,Unix,Windows","date":"2025-03-10","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/tomcat_partial_put_deserialization"},{"source":"pocgithub","id":"iSee857/CVE-2025-24813-PoC","title":"iSee857/CVE-2025-24813-PoC","date":"2025-03-13","url":"https://github.com/iSee857/CVE-2025-24813-PoC"},{"source":"pocgithub","id":"N0c1or/CVE-2025-24813_POC","title":"N0c1or/CVE-2025-24813_POC","date":"2025-03-14","url":"https://github.com/N0c1or/CVE-2025-24813_POC"},{"source":"pocgithub","id":"absholi7ly/POC-CVE-2025-24813","title":"absholi7ly/POC-CVE-2025-24813","date":"2025-03-14","url":"https://github.com/absholi7ly/POC-CVE-2025-24813"},{"source":"pocgithub","id":"gregk4sec/CVE-2025-24813","title":"gregk4sec/CVE-2025-24813","date":"2025-03-14","url":"https://github.com/gregk4sec/CVE-2025-24813"},{"source":"pocgithub","id":"qzy0x/cve-2025-24813_poc","title":"qzy0x/cve-2025-24813_poc","date":"2025-03-14","url":"https://github.com/qzy0x/cve-2025-24813_poc"},{"source":"pocgithub","id":"charis3306/CVE-2025-24813","title":"charis3306/CVE-2025-24813","date":"2025-03-16","url":"https://github.com/charis3306/CVE-2025-24813"},{"source":"pocgithub","id":"imbas007/CVE-2025-24813-apache-tomcat","title":"imbas007/CVE-2025-24813-apache-tomcat","date":"2025-03-17","url":"https://github.com/imbas007/CVE-2025-24813-apache-tomcat"},{"source":"pocgithub","id":"msadeghkarimi/CVE-2025-24813-Exploit","title":"msadeghkarimi/CVE-2025-24813-Exploit","date":"2025-03-18","url":"https://github.com/msadeghkarimi/CVE-2025-24813-Exploit"},{"source":"pocgithub","id":"michael-david-fry/Apache-Tomcat-Vulnerability-POC-CVE-2025-24813","title":"michael-david-fry/Apache-Tomcat-Vulnerability-POC-CVE-2025-24813","date":"2025-03-19","url":"https://github.com/michael-david-fry/Apache-Tomcat-Vulnerability-POC-CVE-2025-24813"},{"source":"pocgithub","id":"ps-interactive/lab-cve-2025-24813","title":"ps-interactive/lab-cve-2025-24813","date":"2025-03-19","url":"https://github.com/ps-interactive/lab-cve-2025-24813"},{"source":"pocgithub","id":"n0n-zer0/Spring-Boot-Tomcat-CVE-2025-24813","title":"n0n-zer0/Spring-Boot-Tomcat-CVE-2025-24813","date":"2025-03-20","url":"https://github.com/n0n-zer0/Spring-Boot-Tomcat-CVE-2025-24813"},{"source":"pocgithub","id":"Alaatk/CVE-2025-24813-POC","title":"Alaatk/CVE-2025-24813-POC","date":"2025-03-21","url":"https://github.com/Alaatk/CVE-2025-24813-POC"},{"source":"pocgithub","id":"tonyarris/CVE-2025-24813-PoC","title":"tonyarris/CVE-2025-24813-PoC","date":"2025-03-22","url":"https://github.com/tonyarris/CVE-2025-24813-PoC"},{"source":"pocgithub","id":"u238/Tomcat-CVE_2025_24813","title":"u238/Tomcat-CVE_2025_24813","date":"2025-03-24","url":"https://github.com/u238/Tomcat-CVE_2025_24813"},{"source":"pocgithub","id":"AlperenY-cs/CVE-2025-24813","title":"AlperenY-cs/CVE-2025-24813","date":"2025-03-28","url":"https://github.com/AlperenY-cs/CVE-2025-24813"},{"source":"pocgithub","id":"manjula-aw/CVE-2025-24813","title":"manjula-aw/CVE-2025-24813","date":"2025-03-30","url":"https://github.com/manjula-aw/CVE-2025-24813"},{"source":"pocgithub","id":"B1gN0Se/Tomcat-CVE-2025-24813","title":"B1gN0Se/Tomcat-CVE-2025-24813","date":"2025-03-31","url":"https://github.com/B1gN0Se/Tomcat-CVE-2025-24813"},{"source":"pocgithub","id":"AsaL1n/CVE-2025-24813","title":"AsaL1n/CVE-2025-24813","date":"2025-04-05","url":"https://github.com/AsaL1n/CVE-2025-24813"},{"source":"pocgithub","id":"MuhammadWaseem29/CVE-2025-24813","title":"MuhammadWaseem29/CVE-2025-24813","date":"2025-04-05","url":"https://github.com/MuhammadWaseem29/CVE-2025-24813"},{"source":"pocgithub","id":"La3B0z/CVE-2025-24813-POC","title":"La3B0z/CVE-2025-24813-POC","date":"2025-04-06","url":"https://github.com/La3B0z/CVE-2025-24813-POC"},{"source":"exploitdb","id":"EDB-52134","title":"Apache Tomcat 11.0.3 - Remote Code Execution","type":"webapps","platform":"multiple","date":"2025-04-07","url":"https://www.exploit-db.com/exploits/52134"},{"source":"pocgithub","id":"Heimd411/CVE-2025-24813-noPoC","title":"Heimd411/CVE-2025-24813-noPoC","date":"2025-04-07","url":"https://github.com/Heimd411/CVE-2025-24813-noPoC"},{"source":"pocgithub","id":"horsehacks/CVE-2025-24813-checker","title":"horsehacks/CVE-2025-24813-checker","date":"2025-04-07","url":"https://github.com/horsehacks/CVE-2025-24813-checker"},{"source":"pocgithub","id":"NamelessSaint8/CVE-2025-24813-POC","title":"NamelessSaint8/CVE-2025-24813-POC","date":"2025-04-09","url":"https://github.com/NamelessSaint8/CVE-2025-24813-POC"},{"source":"pocgithub","id":"Franconyu/Poc_for_CVE-2025-24813","title":"Franconyu/Poc_for_CVE-2025-24813","date":"2025-04-10","url":"https://github.com/Franconyu/Poc_for_CVE-2025-24813"},{"source":"pocgithub","id":"cchopin/CVE-Arsenal-Lab","title":"cchopin/CVE-Arsenal-Lab","date":"2025-04-10","url":"https://github.com/cchopin/CVE-Arsenal-Lab"},{"source":"nuclei","id":"CVE-2025-24813","title":"Apache Tomcat Path Equivalence - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24813.yaml"}],"exploits_more":35,"fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["11.0.3","10.1.35","9.0.99"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["11.0.3","10.1.35","9.0.99"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:10","package":"tomcat9","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"tomcat9-admin-webapps","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"tomcat9-docs-webapp","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"tomcat9-el-3.0-api","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"tomcat9-jsp-2.3-api","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"tomcat9-lib","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"tomcat9-servlet-4.0-api","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"tomcat9-webapps","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"tomcat","fixed_in":["9.0.99","10.1.35","11.0.3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat9-embed-java","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat9-java","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-admin","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-common","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-docs","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-examples","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-user","fixed_in":["9.0.16-3ubuntu0.18.04.2+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-admin-webapps","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-docs-webapp","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-el-3.0-api","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-jsp-2.3-api","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-lib","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-servlet-4.0-api","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-webapps","fixed_in":["1:9.0.62-11.el9_2.3.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libtomcat9-embed-java","fixed_in":["9.0.31-1ubuntu0.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libtomcat9-java","fixed_in":["9.0.31-1ubuntu0.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9","fixed_in":["9.0.31-1ubuntu0.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-admin","fixed_in":["9.0.31-1ubuntu0.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-common","fixed_in":["9.0.31-1ubuntu0.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-docs","fixed_in":["9.0.31-1ubuntu0.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-examples","fixed_in":["9.0.31-1ubuntu0.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-user","fixed_in":["9.0.31-1ubuntu0.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","fixed_in":["8.5.100-1ubuntu1~18.04.1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","fixed_in":["8.5.100-1ubuntu1~18.04.1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","fixed_in":["8.5.100-1ubuntu1~18.04.1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","fixed_in":["8.5.100-1ubuntu1~18.04.1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","fixed_in":["8.5.100-1ubuntu1~18.04.1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","fixed_in":["8.5.100-1ubuntu1~18.04.1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","fixed_in":["8.5.100-1ubuntu1~18.04.1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","fixed_in":["8.5.100-1ubuntu1~18.04.1+tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat","fixed_in":["7.0.76-16.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-admin-webapps","fixed_in":["7.0.76-16.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-docs-webapp","fixed_in":["7.0.76-16.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-el-2.2-api","fixed_in":["7.0.76-16.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-javadoc","fixed_in":["7.0.76-16.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-jsp-2.2-api","fixed_in":["7.0.76-16.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-jsvc","fixed_in":["7.0.76-16.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-lib","fixed_in":["7.0.76-16.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-servlet-3.0-api","fixed_in":["7.0.76-16.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"tomcat-webapps","fixed_in":["7.0.76-16.el7_9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"tomcat6","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"tomcat6-admin-webapps","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"tomcat6-docs-webapp","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"tomcat6-el-2.1-api","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"tomcat6-javadoc","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"tomcat6-jsp-2.1-api","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"tomcat6-lib","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"tomcat6-servlet-2.5-api","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"tomcat6-webapps","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-admin-webapps","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-docs-webapp","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-el-2.1-api","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-javadoc","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-jsp-2.1-api","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-lib","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-servlet-2.5-api","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-webapps","fixed_in":["6.0.24-115.el6_10.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libtomcat9-embed-java","fixed_in":["9.0.31-1~deb10u12+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libtomcat9-java","fixed_in":["9.0.31-1~deb10u12+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"tomcat9","fixed_in":["9.0.31-1~deb10u12+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"tomcat9-admin","fixed_in":["9.0.31-1~deb10u12+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"tomcat9-common","fixed_in":["9.0.31-1~deb10u12+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"tomcat9-docs","fixed_in":["9.0.31-1~deb10u12+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"tomcat9-examples","fixed_in":["9.0.31-1~deb10u12+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"tomcat9-user","fixed_in":["9.0.31-1~deb10u12+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat10","fixed_in":["10.1.34-0+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat10","fixed_in":["10.1.35-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat10","fixed_in":["10.1.35-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"tomcat9","fixed_in":["9.0.43-2~deb11u12"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat","fixed_in":["0:9.0.87-8.redhat_00008.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-admin-webapps","fixed_in":["0:9.0.87-8.redhat_00008.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-docs-webapp","fixed_in":["0:9.0.87-8.redhat_00008.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-el-3.0-api","fixed_in":["0:9.0.87-8.redhat_00008.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-java-jdk11","fixed_in":["0:9.0.87-8.redhat_00008.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-java-jdk8","fixed_in":["0:9.0.87-8.redhat_00008.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-javadoc","fixed_in":["0:9.0.87-8.redhat_00008.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-jsp-2.3-api","fixed_in":["0:9.0.87-8.redhat_00008.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-lib","fixed_in":["0:9.0.87-8.redhat_00008.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-selinux","fixed_in":["0:9.0.87-8.redhat_00008.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-servlet-4.0-api","fixed_in":["0:9.0.87-8.redhat_00008.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-webapps","fixed_in":["0:9.0.87-8.redhat_00008.1.el7jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat","fixed_in":["0:9.0.87-8.redhat_00008.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-admin-webapps","fixed_in":["0:9.0.87-8.redhat_00008.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-docs-webapp","fixed_in":["0:9.0.87-8.redhat_00008.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-el-3.0-api","fixed_in":["0:9.0.87-8.redhat_00008.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-javadoc","fixed_in":["0:9.0.87-8.redhat_00008.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-jsp-2.3-api","fixed_in":["0:9.0.87-8.redhat_00008.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-lib","fixed_in":["0:9.0.87-8.redhat_00008.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-selinux","fixed_in":["0:9.0.87-8.redhat_00008.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-servlet-4.0-api","fixed_in":["0:9.0.87-8.redhat_00008.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-webapps","fixed_in":["0:9.0.87-8.redhat_00008.1.el8jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat","fixed_in":["0:9.0.87-8.redhat_00008.1.el9jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-admin-webapps","fixed_in":["0:9.0.87-8.redhat_00008.1.el9jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-docs-webapp","fixed_in":["0:9.0.87-8.redhat_00008.1.el9jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-el-3.0-api","fixed_in":["0:9.0.87-8.redhat_00008.1.el9jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-javadoc","fixed_in":["0:9.0.87-8.redhat_00008.1.el9jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-jsp-2.3-api","fixed_in":["0:9.0.87-8.redhat_00008.1.el9jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-lib","fixed_in":["0:9.0.87-8.redhat_00008.1.el9jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-selinux","fixed_in":["0:9.0.87-8.redhat_00008.1.el9jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-servlet-4.0-api","fixed_in":["0:9.0.87-8.redhat_00008.1.el9jws"],"sources":["osv"]},{"ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-webapps","fixed_in":["0:9.0.87-8.redhat_00008.1.el9jws"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-admin-webapps","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-docs-webapp","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-el-3.0-api","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-jsp-2.3-api","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-lib","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-servlet-4.0-api","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-webapps","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"tomcat9","fixed_in":["1:9.0.87-5.el10_0"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["10.1.16-aikido.9","10.1.16-aikido.10","10.1.34-aikido.5","10.1.34-aikido.6","9.0.74-aikido.2","10.1.16-aikido.11","10.1.16-aikido.12","10.1.34-aikido.7","9.0.74-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["10.1.13-aikido.12"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat:tomcat-catalina","fixed_in":["10.1.13-root.io.3","10.1.13-root.io.4","10.1.13-root.io.5","10.1.13-root.io.6","10.1.13-root.io.7","10.1.13-root.io.8","10.1.13-root.io.9","10.1.13-root.io.10","10.1.13-root.io.11","10.1.13-root.io.12"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["10.1.34-root.io.1","10.1.34-root.io.2","10.1.16-root.io.2","10.1.16-root.io.3","10.1.16-root.io.4","10.1.16-root.io.5","10.1.16-root.io.6","10.1.16-root.io.7","10.1.34-root.io.3","10.1.16-root.io.8","10.1.16-root.io.9","10.1.16-root.io.10","10.1.34-root.io.5","10.1.34-root.io.6","9.0.74-root.io.2","10.1.16-root.io.11","10.1.16-root.io.12","10.1.34-root.io.7","9.0.74-root.io.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"tomcat","fixed_in":["9.0.36-3.139.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tomcat","fixed_in":["9.0.36-3.139.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","fixed_in":["9.0.16-3ubuntu0.18.04.2+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tomcat9","fixed_in":["9.0.31-1ubuntu0.9+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","fixed_in":["9.0.58-1ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat10","fixed_in":["10.1.16-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat9","fixed_in":["9.0.70-2ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"tomcat9","fixed_in":["9.0.70-2ubuntu2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.35"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.99"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.35"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.99"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.100"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.100"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Bitnami","package":"tomcat","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.99"},{"introduced":"10.0.0"},{"fixed":"10.1.35"},{"introduced":"11.0.0"},{"fixed":"11.0.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat9-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat9-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat9-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-11.el9_2.3.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libtomcat9-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libtomcat9-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.100"},{"fixed":"8.5.100.tuxcare.1"}]}],"versions":["8.5.100"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.100"},{"fixed":"8.5.100.tuxcare.1"}]}],"versions":["8.5.100"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.100"},{"fixed":"8.5.100.tuxcare.1"}]}],"versions":["8.5.100"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-el-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.24-115.el6_10.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libtomcat9-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libtomcat9-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.87"},{"fixed":"9.0.87-tuxcare.1"}]}],"versions":["9.0.87"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.87"},{"fixed":"9.0.87-tuxcare.1"}]}],"versions":["9.0.87"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.87"},{"fixed":"9.0.87-tuxcare.1"}]}],"versions":["9.0.87"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.87"},{"fixed":"9.0.87-tuxcare.1"}]}],"versions":["9.0.87"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.2"}]}],"versions":["9.0.75","9.0.75-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.2"}]}],"versions":["9.0.75","9.0.75-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.2"}]}],"versions":["9.0.75","9.0.75-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.2"}]}],"versions":["9.0.75","9.0.75-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.2"}]}],"versions":["9.0.75","9.0.75-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.2"}]}],"versions":["9.0.75","9.0.75-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.90"},{"fixed":"9.0.90-tuxcare.2"}]}],"versions":["9.0.90","9.0.90-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.90"},{"fixed":"9.0.90-tuxcare.2"}]}],"versions":["9.0.90","9.0.90-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.90"},{"fixed":"9.0.90-tuxcare.2"}]}],"versions":["9.0.90","9.0.90-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.1"}]}],"versions":["7.0.70"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.1"}]}],"versions":["7.0.70"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.1"}]}],"versions":["7.0.70"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.2"}]}],"versions":["10.1.33","10.1.33-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.2"}]}],"versions":["10.1.33","10.1.33-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.2"}]}],"versions":["10.1.33","10.1.33-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.34-0+deb12u2"}]}],"versions":["10.1.10-1","10.1.13-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.20-1","10.1.23-1","10.1.25-1","10.1.25-1~bpo12+1","10.1.25-2","10.1.30-1","10.1.30-1~bpo12+1","10.1.31-1","10.1.33-1","10.1.33-1~bpo12+1","10.1.34-0+deb12u1","10.1.6-1","10.1.6-1+deb12u1","10.1.6-1+deb12u2","10.1.7-1","10.1.8-1","10.1.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.35-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.35-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.43-2~deb11u12"}]}],"versions":["9.0.43-1","9.0.43-2~deb11u1","9.0.43-2~deb11u10","9.0.43-2~deb11u11","9.0.43-2~deb11u2","9.0.43-2~deb11u3","9.0.43-2~deb11u4","9.0.43-2~deb11u5","9.0.43-2~deb11u6","9.0.43-2~deb11u7","9.0.43-2~deb11u8","9.0.43-2~deb11u9"]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.34-0+deb12u2"}]}],"versions":["10.1.10-1","10.1.13-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.20-1","10.1.23-1","10.1.25-1","10.1.25-1~bpo12+1","10.1.25-2","10.1.30-1","10.1.30-1~bpo12+1","10.1.31-1","10.1.33-1","10.1.33-1~bpo12+1","10.1.34-0+deb12u1","10.1.6-1","10.1.6-1+deb12u1","10.1.6-1+deb12u2","10.1.7-1","10.1.8-1","10.1.9-1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.3"}]}],"versions":["11.0.0","11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M17","11.0.0-M18","11.0.0-M19","11.0.0-M20","11.0.0-M21","11.0.0-M22","11.0.0-M24","11.0.0-M25","11.0.0-M26","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9","11.0.1","11.0.2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.35"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.19","10.1.2","10.1.20","10.1.23","10.1.24","10.1.25","10.1.26","10.1.28","10.1.29","10.1.30","10.1.31","10.1.33","10.1.34","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.99"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85","9.0.86","9.0.87","9.0.88","9.0.89","9.0.90","9.0.91","9.0.93","9.0.94","9.0.95","9.0.96","9.0.97","9.0.98"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.3"}]}],"versions":["11.0.0","11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M17","11.0.0-M18","11.0.0-M19","11.0.0-M20","11.0.0-M21","11.0.0-M22","11.0.0-M24","11.0.0-M25","11.0.0-M26","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9","11.0.1","11.0.2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.35"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.19","10.1.2","10.1.20","10.1.23","10.1.24","10.1.25","10.1.26","10.1.28","10.1.29","10.1.30","10.1.31","10.1.33","10.1.34","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.99"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85","9.0.86","9.0.87","9.0.88","9.0.89","9.0.90","9.0.91","9.0.93","9.0.94","9.0.95","9.0.96","9.0.97","9.0.98"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.100"}]}],"versions":["8.5.0","8.5.100","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98","8.5.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.100"}]}],"versions":["8.5.0","8.5.100","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98","8.5.99"]},{"source":"osv","ecosystem":"Mageia:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el7jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el8jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el9jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el9jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el9jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el9jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el9jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el9jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el9jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el9jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el9jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-8.redhat_00008.1.el9jws"}]}]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-6.redhat_00007.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-jakartaee-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-2.redhat_00003.1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-1.redhat_1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-1.redhat_1.el8jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-jakartaee-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-2.redhat_00003.1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-1.redhat_1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-1.redhat_1.el9jws"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-2.el9_5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.16-aikido.9"},{"fixed":"10.1.16-aikido.10"},{"fixed":"10.1.34-aikido.5"},{"fixed":"10.1.34-aikido.6"},{"fixed":"9.0.74-aikido.2"},{"fixed":"10.1.16-aikido.11"},{"fixed":"10.1.16-aikido.12"},{"fixed":"10.1.34-aikido.7"},{"fixed":"9.0.74-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.13-aikido.12"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.13-root.io.3"},{"fixed":"10.1.13-root.io.4"},{"fixed":"10.1.13-root.io.5"},{"fixed":"10.1.13-root.io.6"},{"fixed":"10.1.13-root.io.7"},{"fixed":"10.1.13-root.io.8"},{"fixed":"10.1.13-root.io.9"},{"fixed":"10.1.13-root.io.10"},{"fixed":"10.1.13-root.io.11"},{"fixed":"10.1.13-root.io.12"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.34-root.io.1"},{"fixed":"10.1.34-root.io.2"},{"fixed":"10.1.16-root.io.2"},{"fixed":"10.1.16-root.io.3"},{"fixed":"10.1.16-root.io.4"},{"fixed":"10.1.16-root.io.5"},{"fixed":"10.1.16-root.io.6"},{"fixed":"10.1.16-root.io.7"},{"fixed":"10.1.34-root.io.3"},{"fixed":"10.1.16-root.io.8"},{"fixed":"10.1.16-root.io.9"},{"fixed":"10.1.16-root.io.10"},{"fixed":"10.1.34-root.io.5"},{"fixed":"10.1.34-root.io.6"},{"fixed":"9.0.74-root.io.2"},{"fixed":"10.1.16-root.io.11"},{"fixed":"10.1.16-root.io.12"},{"fixed":"10.1.34-root.io.7"},{"fixed":"9.0.74-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.139.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.139.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.39-150200.5.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.39-150200.5.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.39-150200.5.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.39-150200.5.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.39-150200.5.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.39-150200.5.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.102-150200.78.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+esm6"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1","9.0.16-3ubuntu0.18.04.2+esm2","9.0.16-3ubuntu0.18.04.2+esm3","9.0.16-3ubuntu0.18.04.2+esm4","9.0.16-3ubuntu0.18.04.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+esm1"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1","9.0.31-1ubuntu0.2","9.0.31-1ubuntu0.3","9.0.31-1ubuntu0.4","9.0.31-1ubuntu0.5","9.0.31-1ubuntu0.6","9.0.31-1ubuntu0.7","9.0.31-1ubuntu0.8","9.0.31-1ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.58-1ubuntu0.2+esm2"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1","9.0.58-1ubuntu0.1+esm2","9.0.58-1ubuntu0.1+esm3","9.0.58-1ubuntu0.1+esm4","9.0.58-1ubuntu0.2","9.0.58-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.16-1ubuntu0.1~esm1"}]}],"versions":["10.1.10-1","10.1.14-1","10.1.15-1","10.1.16-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2ubuntu0.1+esm1"}]}],"versions":["9.0.70-1ubuntu1","9.0.70-2","9.0.70-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2ubuntu2"}]}],"versions":["9.0.70-2ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+esm6"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1","9.0.16-3ubuntu0.18.04.2+esm2","9.0.16-3ubuntu0.18.04.2+esm3","9.0.16-3ubuntu0.18.04.2+esm4","9.0.16-3ubuntu0.18.04.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+esm1"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1","9.0.31-1ubuntu0.2","9.0.31-1ubuntu0.3","9.0.31-1ubuntu0.4","9.0.31-1ubuntu0.5","9.0.31-1ubuntu0.6","9.0.31-1ubuntu0.7","9.0.31-1ubuntu0.8","9.0.31-1ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.58-1ubuntu0.2+esm2"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1","9.0.58-1ubuntu0.1+esm2","9.0.58-1ubuntu0.1+esm3","9.0.58-1ubuntu0.1+esm4","9.0.58-1ubuntu0.2","9.0.58-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.16-1ubuntu0.1~esm1"}]}],"versions":["10.1.10-1","10.1.14-1","10.1.15-1","10.1.16-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2ubuntu0.1+esm1"}]}],"versions":["9.0.70-1ubuntu1","9.0.70-2","9.0.70-2ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.99-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.35-1.1"}]}],"bundled":2}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"},{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"bootstrap_os"}],"references":[{"url":"https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq","tags":["vendor-advisory","Vendor Advisory","advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/03/10/5","tags":["Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce","tags":["Issue Tracking","report","web"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce","tags":["Issue Tracking","report","web"]},{"url":"https://security.netapp.com/advisory/ntap-20250321-0001/","tags":["Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability","tags":["Issue Tracking","report","web"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability","tags":["Issue Tracking","report","web"]},{"url":"https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md","tags":["exploit","Exploit","evidence","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813","tags":["government-resource","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24813","tags":["web","advisory"]},{"url":"https://github.com/apache/tomcat/commit/0a668e0c27f2b7ca0cc7c6eea32253b9b5ecb29c","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/eb61aade8f8daccaecabf07d428b877975622f72","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/f6c01d6577cf9a1e06792be47e623d36acc3b5dc","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20250321-0001","tags":["web"]},{"url":"https://github.com/advisories/GHSA-83qj-6fr2-vhqg"},{"url":"https://access.redhat.com/errata/RHSA-2025:3645","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-50379","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-24813","tags":["report"]},{"url":"https://bugzilla.redhat.com/2332817","tags":["report"]},{"url":"https://bugzilla.redhat.com/2351129","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-3645.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3683","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-3683.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7494","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-7494.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:7497","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52316","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-54677","tags":["report"]},{"url":"https://bugzilla.redhat.com/2326972","tags":["report"]},{"url":"https://bugzilla.redhat.com/2332815","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-7497.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1742577759.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1742733084.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/ubuntu20.04-els/CLSA-2025-1742737069.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2025-1750752721.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2025-1755272015.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2025-1755513827.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2025-1755516017.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1760712981.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24813.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-24813","tags":["advisory"]},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0105.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34112","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/WQRQ6JSFISH4LSDOH7IDJHNYPKMGUF5X/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3454","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html/red_hat_jboss_web_server_5.8_service_pack_3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2351129","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3454.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-24813","tags":["advisory","report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article","report"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3608","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2362783","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3608.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52316","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52316","tags":["advisory"]},{"url":"https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-31650","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-31650","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31650","tags":["advisory"]},{"url":"https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2332817","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3645.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-50379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50379","tags":["advisory"]},{"url":"https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3646","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3646.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3647","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3647.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3683.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3684","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3684.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7494.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2332815","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7497.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235370","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41080","tags":["advisory"]},{"url":"https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-42795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243752","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-42795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42795","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/9","tags":["article"]},{"url":"https://lists.apache.org/thread/065jfyo583490r9j2v73nhpyxdob56lw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44487","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242803","tags":["report"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://github.com/dotnet/announcements/issues/277","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2102","tags":["advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","tags":["article"]},{"url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-45648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243749","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45648","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/10","tags":["article"]},{"url":"https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46589","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252050","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46589","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46589","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/28/2","tags":["article"]},{"url":"https://lists.apache.org/thread/0rqq6ktozqc42ro8hhxdmmdjm1k1tpxr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23672","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269608","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23672","tags":["advisory"]},{"url":"https://lists.apache.org/thread/cmpswfx6tj4s7x0nxxosvfqs11lvdx2f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-24549","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269607","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-24549","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24549","tags":["advisory"]},{"url":"https://lists.apache.org/thread/4c50rmomhbbsdgfjsgwlb51xdwfjdcvg","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-54677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54677","tags":["advisory"]},{"url":"https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-56337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2333521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-56337","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56337","tags":["advisory"]},{"url":"https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2025:3645","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:3683","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7494","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7497","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250954-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239302","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24813","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251024-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239676","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56337","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251126-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261058-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216182","tags":["report"]},{"url":"https://bugzilla.suse.com/1243895","tags":["report"]},{"url":"https://bugzilla.suse.com/1246318","tags":["report"]},{"url":"https://bugzilla.suse.com/1246389","tags":["report"]},{"url":"https://bugzilla.suse.com/1258371","tags":["report"]},{"url":"https://bugzilla.suse.com/1258385","tags":["report"]},{"url":"https://bugzilla.suse.com/1259224","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24733","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-24813","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7525-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7525-2","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WQRQ6JSFISH4LSDOH7IDJHNYPKMGUF5X/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7OKLY4MUG7KKGPWMJ2OO7BLP5MD4C3UC/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-24813","title":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","status":"published","published":"2025-03-10T16:44:03.715Z","modified":"2025-10-29T11:49:44.413Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-44","CWE-502"],"updated_at":"2026-11-02T14:32:44.11109Z"}],"euvd":[{"id":"EUVD-2025-6498","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","status":"published","published":"2025-03-10T16:44:03Z","modified":"2025-10-29T11:49:44Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2025-04-01","updated_at":"2026-11-02T19:49:36.644055Z"}],"ghsa":[{"id":"GHSA-83qj-6fr2-vhqg","title":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\n\nIf all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","status":"published","published":"2025-03-10T18:31:56Z","modified":"2025-10-22T19:28:21Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-44","CWE-502"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2025-24813","title":"Apache Tomcat Path Equivalence Vulnerability","description":"Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.","cwes":["CWE-44","CWE-502"],"kev":{"date_added":"2025-04-01","due_date":"2025-04-22","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2025-24813","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","status":"published","published":"2025-03-10T17:15:35.067Z","modified":"2026-06-17T08:59:39.593Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-44","CWE-502","CWE-706"],"updated_at":"2026-11-02T14:10:53.101324Z"}],"osv":[{"id":"CVE-2025-24813","title":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to       perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","status":"published","published":"2025-03-10T16:44:03.715Z","modified":"2026-10-28T02:31:08.030057424Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-44","CWE-502"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"DEBIAN-CVE-2025-24813","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.  This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are  known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions  may also be affected.   If all of the following were true, a malicious user was able to view       security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT  If all of the following were true, a malicious user was able to       perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack  Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","status":"published","published":"2025-03-10T17:15:35.067Z","modified":"2026-09-01T20:05:44.848983794Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"GHSA-83qj-6fr2-vhqg","title":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\n\nIf all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","status":"published","published":"2025-03-10T18:31:56Z","modified":"2026-09-10T03:50:23.313083129Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A","level":"critical"}],"cwes":["CWE-44","CWE-502"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"RHSA-2025:3454","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.3 release and security update","status":"published","published":"2025-04-03T10:06:56Z","modified":"2026-09-17T10:05:25Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:3608","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.0 release and security update","status":"published","published":"2025-04-08T10:04:02Z","modified":"2026-09-26T10:03:35Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:3645","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-04-08T10:04:15Z","modified":"2026-09-26T10:03:37Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:3646","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-04-08T10:04:15Z","modified":"2026-09-26T10:03:37Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:3647","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-04-08T10:04:16Z","modified":"2026-09-26T10:03:38Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:3683","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-04-09T10:04:15Z","modified":"2026-09-26T10:03:38Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:3684","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-04-09T10:04:15Z","modified":"2026-09-26T10:03:39Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7494","title":"Red Hat Security Advisory: tomcat9 security update","status":"published","published":"2025-05-14T10:06:38Z","modified":"2026-09-17T10:05:45Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RHSA-2025:7497","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-05-14T10:06:39Z","modified":"2026-10-15T10:11:39Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:3645","title":"Moderate: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)\n\n* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:40:19.644888Z","modified":"2025-10-07T17:39:19.419556Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:3683","title":"Moderate: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)\n\n* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T15:00:04.612775Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:7494","title":"Moderate: tomcat9 security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.\n\nSecurity Fix(es):\n\n* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:38.528969Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:7497","title":"Moderate: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)\n\n* tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)\n\n* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:38.601512Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-24813","title":"CVE-2025-24813 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root","description":"Root has patched CVE-2025-24813 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-29T12:02:56Z","modified":"2026-10-29T13:15:09.498341888Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2025-24813","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","status":"published","published":"2025-03-10T17:15:00Z","modified":"2026-04-02T20:28:54.114191Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"ALSA-2025:3645","title":"Moderate: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)\n  * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-04-07T00:00:00Z","modified":"2026-10-29T11:32:15.763318466Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:3683","title":"Moderate: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)\n  * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-04-08T00:00:00Z","modified":"2026-10-29T11:02:23.052395178Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7494","title":"Moderate: tomcat9 security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.  \n\nSecurity Fix(es):  \n\n  * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:58:12.235626Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:7497","title":"Moderate: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)\n  * tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)\n  * tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:58:13.679553Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"BIT-tomcat-2025-24813","title":"Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT","description":"Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0 through 11.0.2, from 10.1.0 through 10.1.34, from 9.0.0 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.","status":"published","published":"2025-07-10T10:46:47.051Z","modified":"2026-09-10T16:00:11.81025772Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2025-1742577759","title":"Fix CVE(s): CVE-2025-24813","description":"   * SECURITY UPDATE: path Equivalence leading to Remote Code Execution and/or\n     Information disclosure in Apache Tomcat\n     - debian/patches/CVE-2025-24813.patch: Enhance lifecycle of temporary files\n       used by partial PUT\n     - CVE-2025-24813","status":"published","published":"2025-03-21T17:22:45Z","modified":"2026-06-04T10:03:48.252233Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1742733084","title":"tomcat: Fix of CVE-2025-24813","description":"- CVE-2025-24813: Fix path equivalence vulnerability to prevent remote code\n  execution and information disclosure in Default Servlet","status":"published","published":"2025-03-23T13:34:38Z","modified":"2026-06-01T00:30:36.614347428Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1742737069","title":"Fix CVE(s): CVE-2025-24813","description":"   * SECURITY UPDATE: path Equivalence Vulnerability\n     - debian/patches/CVE-2025-24813.patch: enhance lifecycle of temporary files\n       used by partial PUT to delete temporary file right after finishing request\n       processing\n     - CVE-2025-24813","status":"published","published":"2025-03-23T13:37:55Z","modified":"2026-06-04T10:03:41.988793Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1750752721","title":"Fix CVE(s): CVE-2025-24813","description":"   * SECURITY UPDATE: Remote code execution\n     - debian/patches/CVE-2025-24813.patch: Delete temporary file right after\n       finishing request processing\n     - CVE-2025-24813","status":"published","published":"2025-06-24T13:57:49Z","modified":"2026-06-04T10:03:41.258242Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1751500955","title":"TuxCare security update for 3 packages (10 CVEs)","description":"TuxCare rebuilt 3 packages to address 10 CVEs. Fixed in 8.5.100.tuxcare.1.","status":"published","published":"2026-08-04T14:52:04Z","modified":"2026-11-02T19:45:09.85903347Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1755272015","title":"tomcat: Fix of CVE-2025-24813","description":"- CVE-2025-24813: fix path equivalence vulnerability leading to remote code\n  execution and information disclosure","status":"published","published":"2025-08-15T15:33:39Z","modified":"2026-06-01T00:33:18.057477195Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1755513827","title":"tomcat6: Fix of CVE-2025-24813","description":"- CVE-2025-24813: enhance lifecycle of temporary files used by partial PUT","status":"published","published":"2025-08-18T10:43:51Z","modified":"2026-06-01T00:33:16.733186706Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1755516017","title":"tomcat6: Fix of CVE-2025-24813","description":"- CVE-2025-24813: enhance lifecycle of temporary files used by partial PUT","status":"published","published":"2025-08-18T11:20:21Z","modified":"2026-06-01T00:33:25.984804524Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2025-1759795579","title":"TuxCare security update for 6 packages (18 CVEs)","description":"TuxCare rebuilt 6 packages to address 18 CVEs. Fixed in 9.0.83-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-10-30T07:30:07.718953578Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1760712981","title":"Fix CVE(s): CVE-2025-24813","description":"   * SECURITY UPDATE: path Equivalence leads to Remote Code Execution and/or\n     Information disclosure\n     - debian/patches/CVE-2025-24813.patch: Enhance lifecycle of temporary files\n       used by partial PUT\n     - CVE-2025-24813","status":"published","published":"2025-10-20T13:56:02Z","modified":"2026-06-04T10:03:20.524978Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1764720465","title":"TuxCare security update for 5 packages (18 CVEs)","description":"TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.50-tuxcare.2.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-11-02T19:45:14.144527872Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1765411683","title":"TuxCare security update for 4 packages (15 CVEs)","description":"TuxCare rebuilt 4 packages to address 15 CVEs. Fixed in 9.0.87-tuxcare.1.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-11-02T19:45:10.572519586Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1765930090","title":"TuxCare security update for 6 packages (9 CVEs)","description":"TuxCare rebuilt 6 packages to address 9 CVEs. Fixed in 9.0.75-tuxcare.2.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-11-02T19:45:14.47967672Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1768262917","title":"TuxCare security update for 6 packages (22 CVEs)","description":"TuxCare rebuilt 6 packages to address 22 CVEs. Fixed in 10.1.18-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:12.278630051Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1770077338","title":"TuxCare security update for 3 packages (4 CVEs)","description":"TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 9.0.90-tuxcare.2.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:14.486284855Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1773188120","title":"TuxCare security update for 5 packages (23 CVEs)","description":"TuxCare rebuilt 5 packages to address 23 CVEs. Fixed in 9.0.46-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-11-02T19:45:15.814263441Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1787675020","title":"TuxCare security update for 3 packages (3 CVEs)","description":"TuxCare rebuilt 3 packages to address 3 CVEs. Fixed in 7.0.70-tuxcare.1.","status":"published","published":"2026-08-25T16:23:40Z","modified":"2026-11-02T19:45:57.945575152Z","updated_at":"2026-11-02T20:29:49.757752Z"},{"id":"CLSA-2026-1792575257","title":"TuxCare security update for 8 packages (32 CVEs)","description":"TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.","status":"published","published":"2026-10-21T09:34:17Z","modified":"2026-11-02T19:46:30.353719339Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792667085","title":"TuxCare security update for 7 packages (24 CVEs)","description":"TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.","status":"published","published":"2026-10-22T11:04:45Z","modified":"2026-11-02T19:46:30.557831164Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793011037","title":"TuxCare security update for 5 packages (26 CVEs)","description":"TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.","status":"published","published":"2026-10-26T10:37:17Z","modified":"2026-11-02T19:46:31.628369017Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793011786","title":"TuxCare security update for 7 packages (22 CVEs)","description":"TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.","status":"published","published":"2026-10-26T10:49:46Z","modified":"2026-11-02T19:46:31.559502384Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793202343","title":"TuxCare security update for 3 packages (5 CVEs)","description":"TuxCare rebuilt 3 packages to address 5 CVEs. Fixed in 10.1.33-tuxcare.2.","status":"published","published":"2026-10-28T15:45:43Z","modified":"2026-11-02T19:46:32.592120933Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"DLA-4108-1","title":"tomcat9 - security update","status":"published","published":"2025-04-01T00:00:00Z","modified":"2026-03-09T01:22:41.301819Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5893-1","title":"tomcat10 - security update","status":"published","published":"2025-04-05T00:00:00Z","modified":"2026-03-09T02:10:05.325655Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0105","title":"Updated tomcat packages fix security vulnerabilities","description":"Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in\nApache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through\n11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\nThe mitigation for CVE-2024-50379 was incomplete. Users running Tomcat\non a case insensitive file system with the default servlet write enabled\n(readonly initialisation parameter set to the non-default value of\nfalse) may need additional configuration to fully mitigate\nCVE-2024-50379 depending on which version of Java they are using with\nTomcat: - running on Java 8 or Java 11: the system property\nsun.io.useCanonCaches must be explicitly set to false (it defaults to\ntrue) - running on Java 17: the system property sun.io.useCanonCaches,\nif set, must be set to false (it defaults to false) - running on Java 21\nonwards: no further configuration is required (the system property and\nthe problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and\n9.0.99 onwards will include checks that sun.io.useCanonCaches is set\nappropriately before allowing the default servlet to be write enabled on\na case insensitive file system. Tomcat will also set\nsun.io.useCanonCaches to false by default where it can. (CVE-2004-56337)\nPath Equivalence: 'file.Name' (Internal Dot) leading to Remote Code\nExecution and/or Information disclosure and/or malicious content added\nto uploaded files via write enabled Default Servlet in Apache Tomcat.\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from\n10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the\nfollowing were true, a malicious user was able to view security\nsensitive files and/or inject content into those files: - writes enabled\nfor the default servlet (disabled by default) - support for partial PUT\n(enabled by default) - a target URL for security sensitive uploads that\nwas a sub-directory of a target URL for public uploads - attacker\nknowledge of the names of security sensitive files being uploaded - the\nsecurity sensitive files also being uploaded via partial PUT If all of\nthe following were true, a malicious user was able to perform remote\ncode execution: - writes enabled for the default servlet (disabled by\ndefault) - support for partial PUT (enabled by default) - application\nwas using Tomcat's file based session persistence with the default\nstorage location - application included a library that may be leveraged\nin a deserialization attack Users are recommended to upgrade to version\n11.0.3, 10.1.35 or 9.0.99, which fixes the issue (CVE-2025-24813).\n","status":"published","published":"2025-03-19T23:44:37Z","modified":"2026-04-16T04:43:07.582949725Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:14896-1","title":"tomcat-9.0.99-1.1 on GA media","description":"These are all security issues fixed in the tomcat-9.0.99-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-15T00:00:00Z","modified":"2026-02-04T15:00:05.795952Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:14897-1","title":"tomcat10-10.1.35-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.35-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-15T00:00:00Z","modified":"2026-02-04T21:15:07.117449Z","updated_at":"2026-11-02T16:58:37.399567Z"}]},"sources_more":{"osv":6}}