{"id":"CVE-2025-48988","aliases":["ALSA-2025:14177","ALSA-2025:14178","ALSA-2025:14181","BIT-tomcat-2025-48988","CLSA-2025-1751500955","CLSA-2025-1756253007","CLSA-2025-1759795579","CLSA-2025-1763338014","CLSA-2025-1764720465","CLSA-2025-1766448497","CLSA-2026-1768262917","CLSA-2026-1775521833","CLSA-2026-1776386110","CLSA-2026-1778130778","CLSA-2026-1784682930","CLSA-2026-1792575257","CLSA-2026-1792667085","CLSA-2026-1793011037","CLSA-2026-1793011786","CLSA-2026-1793723883","CLSA-2026-1793727391","DEBIAN-CVE-2025-48988","DLA-4244-1","DSA-6120-1","DSA-6121-1","EUVD-2025-18409","GHSA-h3gc-qfqq-6h8f","MGASA-2025-0191","OESA-2025-1644","OESA-2025-1897","RHSA-2025:11695","RHSA-2025:11741","RHSA-2025:14177","RHSA-2025:14178","RHSA-2025:14179","RHSA-2025:14180","RHSA-2025:14181","RHSA-2025:14182","RHSA-2025:14183","RLSA-2025:14177","RLSA-2025:14178","RLSA-2025:14179","RLSA-2025:14181","ROOT-APP-MAVEN-CVE-2025-48988","SUSE-SU-2025:02214-1","SUSE-SU-2025:02261-1","SUSE-SU-2025:02280-1","SUSE-SU-2026:1058-1","UBUNTU-CVE-2025-48988","openSUSE-SU-2025:15301-1","openSUSE-SU-2025:15302-1","openSUSE-SU-2025:15303-1"],"status":"published","title":"Apache Tomcat: FileUpload large number of parts with headers DoS","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.30433,"percentile":0.98247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-770"],"published":"2025-06-16T14:13:40Z","modified":"2026-11-09T12:49:26Z","exploits":[{"source":"pocgithub","id":"Samb102/POC-CVE-2025-48988-CVE-2025-48976","title":"Samb102/POC-CVE-2025-48988-CVE-2025-48976","date":"2025-06-20","url":"https://github.com/Samb102/POC-CVE-2025-48988-CVE-2025-48976"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["11.0.8","10.1.42","9.0.106"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["11.0.8","10.1.42","9.0.106"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"tomcat","fixed_in":["9.0.106","10.1.42","11.0.8"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["9.0.87-tuxcare.5","7.0.109-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["9.0.87-tuxcare.5","7.0.109-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat10","fixed_in":["10.1.52-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat10","fixed_in":["10.1.52-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat10","fixed_in":["10.1.46-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat11","fixed_in":["11.0.15-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat11","fixed_in":["11.0.11-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["11.0.6-aikido.5","10.1.13-aikido.12"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["10.1.16-aikido.9","10.1.39-aikido.16","10.1.16-aikido.10","10.1.39-aikido.17","10.1.34-aikido.5","10.1.39-aikido.18","10.1.34-aikido.6","9.0.74-aikido.2","10.1.16-aikido.11","10.1.39-aikido.19","10.1.16-aikido.12","10.1.39-aikido.20","10.1.34-aikido.7","9.0.74-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat:tomcat-catalina","fixed_in":["10.1.13-root.io.9","10.1.13-root.io.10","11.0.6-root.io.4","10.1.13-root.io.11","11.0.6-root.io.5","10.1.13-root.io.12"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["10.1.39-root.io.9","10.1.39-root.io.10","10.1.39-root.io.11","10.1.39-root.io.12","10.1.34-root.io.1","10.1.34-root.io.2","10.1.39-root.io.13","10.1.39-root.io.14","10.1.39-root.io.15","10.1.34-root.io.3","10.1.16-root.io.8","10.1.39-root.io.18","10.1.16-root.io.9","10.1.39-root.io.16","10.1.16-root.io.10","10.1.39-root.io.17","10.1.34-root.io.5","10.1.34-root.io.6","9.0.74-root.io.2","10.1.16-root.io.11","10.1.39-root.io.19","10.1.16-root.io.12","10.1.39-root.io.20","10.1.34-root.io.7","9.0.74-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"last_affected":"11.0.7"},{"fixed":"11.0.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"last_affected":"10.1.41"},{"fixed":"10.1.42"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"last_affected":"9.0.105"},{"fixed":"9.0.106"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"last_affected":"11.0.7"},{"fixed":"11.0.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"last_affected":"10.1.41"},{"fixed":"10.1.42"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"last_affected":"9.0.105"},{"fixed":"9.0.106"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.100"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.100"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Bitnami","package":"tomcat","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.106"},{"introduced":"10.0.0"},{"fixed":"10.1.42"},{"introduced":"11.0.0"},{"fixed":"11.0.8"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.100"},{"fixed":"8.5.100.tuxcare.1"}]}],"versions":["8.5.100"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.100"},{"fixed":"8.5.100.tuxcare.1"}]}],"versions":["8.5.100"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.100"},{"fixed":"8.5.100.tuxcare.1"}]}],"versions":["8.5.100"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.90"},{"fixed":"9.0.90-tuxcare.1"}]}],"versions":["9.0.90"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.90"},{"fixed":"9.0.90-tuxcare.1"}]}],"versions":["9.0.90"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.90"},{"fixed":"9.0.90-tuxcare.1"}]}],"versions":["9.0.90"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.90"},{"fixed":"9.0.90-tuxcare.1"}]}],"versions":["9.0.90"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.100"},{"fixed":"9.0.100-tuxcare.2"}]}],"versions":["9.0.100","9.0.100-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.100"},{"fixed":"9.0.100-tuxcare.2"}]}],"versions":["9.0.100","9.0.100-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.100"},{"fixed":"9.0.100-tuxcare.2"}]}],"versions":["9.0.100","9.0.100-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.87"},{"fixed":"9.0.87-tuxcare.5"}]}],"versions":["9.0.87","9.0.87-tuxcare.1","9.0.87-tuxcare.2","9.0.87-tuxcare.3","9.0.87-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.87"},{"fixed":"9.0.87-tuxcare.5"}]}],"versions":["9.0.87","9.0.87-tuxcare.1","9.0.87-tuxcare.2","9.0.87-tuxcare.3","9.0.87-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.4"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.2","9.0.46-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.4"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.2","9.0.46-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.4"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.2","9.0.46-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.4"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.2","9.0.46-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els6"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.3"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.109"},{"fixed":"7.0.109-tuxcare.3"}]}],"versions":["7.0.109","7.0.109-tuxcare.1","7.0.109-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.6"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3","7.0.70-tuxcare.4","7.0.70-tuxcare.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.6"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3","7.0.70-tuxcare.4","7.0.70-tuxcare.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.6"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3","7.0.70-tuxcare.4","7.0.70-tuxcare.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.70"},{"fixed":"7.0.70-tuxcare.6"}]}],"versions":["7.0.70","7.0.70-tuxcare.1","7.0.70-tuxcare.2","7.0.70-tuxcare.3","7.0.70-tuxcare.4","7.0.70-tuxcare.5"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.3"}]}],"versions":["10.1.33","10.1.33-tuxcare.1","10.1.33-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.3"}]}],"versions":["10.1.33","10.1.33-tuxcare.1","10.1.33-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.3"}]}],"versions":["10.1.33","10.1.33-tuxcare.1","10.1.33-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.3"}]}],"versions":["10.1.33","10.1.33-tuxcare.1","10.1.33-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.3"}]}],"versions":["10.1.33","10.1.33-tuxcare.1","10.1.33-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.52-1~deb12u1"}]}],"versions":["10.1.10-1","10.1.13-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.20-1","10.1.23-1","10.1.25-1","10.1.25-1~bpo12+1","10.1.25-2","10.1.30-1","10.1.30-1~bpo12+1","10.1.31-1","10.1.33-1","10.1.33-1~bpo12+1","10.1.34-0+deb12u1","10.1.34-0+deb12u2","10.1.34-1","10.1.35-1","10.1.40-1","10.1.40-1~bpo12+1","10.1.46-1","10.1.6-1","10.1.6-1+deb12u1","10.1.6-1+deb12u2","10.1.7-1","10.1.8-1","10.1.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.52-1~deb13u1"}]}],"versions":["10.1.40-1","10.1.46-1","10.1.52-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.46-1"}]}],"versions":["10.1.40-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.15-1~deb13u1"}]}],"versions":["11.0.11-1","11.0.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.11-1"}]}],"versions":["11.0.6-1"]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.107-0+deb11u1"}]}],"versions":["9.0.43-1","9.0.43-2","9.0.43-2~deb11u1","9.0.43-2~deb11u10","9.0.43-2~deb11u11","9.0.43-2~deb11u12","9.0.43-2~deb11u2","9.0.43-2~deb11u3","9.0.43-2~deb11u4","9.0.43-2~deb11u5","9.0.43-2~deb11u6","9.0.43-2~deb11u7","9.0.43-2~deb11u8","9.0.43-2~deb11u9","9.0.43-3","9.0.53-1","9.0.54-1","9.0.55-1","9.0.58-1","9.0.62-1","9.0.63-1","9.0.64-1","9.0.64-2","9.0.65-1","9.0.67-1","9.0.68-1","9.0.68-1.1","9.0.70-1","9.0.70-2","9.0.95-1"],"bundled":11},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.52-1~deb12u1"}]}],"versions":["10.1.10-1","10.1.13-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.20-1","10.1.23-1","10.1.25-1","10.1.25-1~bpo12+1","10.1.25-2","10.1.30-1","10.1.30-1~bpo12+1","10.1.31-1","10.1.33-1","10.1.33-1~bpo12+1","10.1.34-0+deb12u1","10.1.34-0+deb12u2","10.1.34-1","10.1.35-1","10.1.40-1","10.1.40-1~bpo12+1","10.1.46-1","10.1.6-1","10.1.6-1+deb12u1","10.1.6-1+deb12u2","10.1.7-1","10.1.8-1","10.1.9-1"],"bundled":14},{"source":"osv","ecosystem":"Debian:13","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.52-1~deb13u1"}]}],"versions":["10.1.40-1","10.1.46-1","10.1.52-1~deb12u1"],"bundled":14},{"source":"osv","ecosystem":"Debian:13","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.15-1~deb13u1"}]}],"versions":["11.0.11-1","11.0.6-1"],"bundled":13},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.8"}]}],"versions":["11.0.0","11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M17","11.0.0-M18","11.0.0-M19","11.0.0-M20","11.0.0-M21","11.0.0-M22","11.0.0-M24","11.0.0-M25","11.0.0-M26","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9","11.0.1","11.0.2","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.42"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.19","10.1.2","10.1.20","10.1.23","10.1.24","10.1.25","10.1.26","10.1.28","10.1.29","10.1.30","10.1.31","10.1.33","10.1.34","10.1.35","10.1.36","10.1.39","10.1.4","10.1.40","10.1.41","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.106"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.100","9.0.102","9.0.104","9.0.105","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85","9.0.86","9.0.87","9.0.88","9.0.89","9.0.90","9.0.91","9.0.93","9.0.94","9.0.95","9.0.96","9.0.97","9.0.98","9.0.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.8"}]}],"versions":["11.0.0","11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M17","11.0.0-M18","11.0.0-M19","11.0.0-M20","11.0.0-M21","11.0.0-M22","11.0.0-M24","11.0.0-M25","11.0.0-M26","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9","11.0.1","11.0.2","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.42"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.19","10.1.2","10.1.20","10.1.23","10.1.24","10.1.25","10.1.26","10.1.28","10.1.29","10.1.30","10.1.31","10.1.33","10.1.34","10.1.35","10.1.36","10.1.39","10.1.4","10.1.40","10.1.41","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.106"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.100","9.0.102","9.0.104","9.0.105","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85","9.0.86","9.0.87","9.0.88","9.0.89","9.0.90","9.0.91","9.0.93","9.0.94","9.0.95","9.0.96","9.0.97","9.0.98","9.0.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.100"}]}],"versions":["8.5.0","8.5.100","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98","8.5.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.100"}]}],"versions":["8.5.0","8.5.100","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98","8.5.99"]},{"source":"osv","ecosystem":"Mageia:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-4.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-4.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-4.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-4.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-4.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-6.oe2403sp2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.6-aikido.5"},{"fixed":"10.1.13-aikido.12"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.16-aikido.9"},{"fixed":"10.1.39-aikido.16"},{"fixed":"10.1.16-aikido.10"},{"fixed":"10.1.39-aikido.17"},{"fixed":"10.1.34-aikido.5"},{"fixed":"10.1.39-aikido.18"},{"fixed":"10.1.34-aikido.6"},{"fixed":"9.0.74-aikido.2"},{"fixed":"10.1.16-aikido.11"},{"fixed":"10.1.39-aikido.19"},{"fixed":"10.1.16-aikido.12"},{"fixed":"10.1.39-aikido.20"},{"fixed":"10.1.34-aikido.7"},{"fixed":"9.0.74-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.13-root.io.9"},{"fixed":"10.1.13-root.io.10"},{"fixed":"11.0.6-root.io.4"},{"fixed":"10.1.13-root.io.11"},{"fixed":"11.0.6-root.io.5"},{"fixed":"10.1.13-root.io.12"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.39-root.io.9"},{"fixed":"10.1.39-root.io.10"},{"fixed":"10.1.39-root.io.11"},{"fixed":"10.1.39-root.io.12"},{"fixed":"10.1.34-root.io.1"},{"fixed":"10.1.34-root.io.2"},{"fixed":"10.1.39-root.io.13"},{"fixed":"10.1.39-root.io.14"},{"fixed":"10.1.39-root.io.15"},{"fixed":"10.1.34-root.io.3"},{"fixed":"10.1.16-root.io.8"},{"fixed":"10.1.39-root.io.18"},{"fixed":"10.1.16-root.io.9"},{"fixed":"10.1.39-root.io.16"},{"fixed":"10.1.16-root.io.10"},{"fixed":"10.1.39-root.io.17"},{"fixed":"10.1.34-root.io.5"},{"fixed":"10.1.34-root.io.6"},{"fixed":"9.0.74-root.io.2"},{"fixed":"10.1.16-root.io.11"},{"fixed":"10.1.39-root.io.19"},{"fixed":"10.1.16-root.io.12"},{"fixed":"10.1.39-root.io.20"},{"fixed":"10.1.34-root.io.7"},{"fixed":"9.0.74-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.145.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.145.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.37-1","6.0.39-1","6.0.39-1ubuntu0.1","6.0.39-1ubuntu0.1+esm1","6.0.39-1ubuntu0.1+esm2","6.0.39-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3","7.0.52-1ubuntu0.6","7.0.52-1ubuntu0.7","7.0.52-1ubuntu0.8","7.0.52-1ubuntu0.9","7.0.52-1ubuntu0.10","7.0.52-1ubuntu0.11","7.0.52-1ubuntu0.13","7.0.52-1ubuntu0.14","7.0.52-1ubuntu0.15","7.0.52-1ubuntu0.16","7.0.52-1ubuntu0.16+esm1","7.0.52-1ubuntu0.16+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.26-1","8.0.28-1","8.0.30-1","8.0.32-1","8.0.32-1ubuntu1","8.0.32-1ubuntu1.1","8.0.32-1ubuntu1.2","8.0.32-1ubuntu1.3","8.0.32-1ubuntu1.4","8.0.32-1ubuntu1.5","8.0.32-1ubuntu1.6","8.0.32-1ubuntu1.7","8.0.32-1ubuntu1.8","8.0.32-1ubuntu1.9","8.0.32-1ubuntu1.10","8.0.32-1ubuntu1.11","8.0.32-1ubuntu1.13","8.0.32-1ubuntu1.13+esm1","8.0.32-1ubuntu1.13+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.64-1","7.0.68-1","7.0.68-1ubuntu0.1","7.0.68-1ubuntu0.3","7.0.68-1ubuntu0.4","7.0.68-1ubuntu0.4+esm1","7.0.68-1ubuntu0.4+esm2","7.0.68-1ubuntu0.4+esm3","7.0.68-1ubuntu0.4+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2","8.5.39-1ubuntu1~18.04.3","8.5.39-1ubuntu1~18.04.3+esm1","8.5.39-1ubuntu1~18.04.3+esm2","8.5.39-1ubuntu1~18.04.3+esm3","8.5.39-1ubuntu1~18.04.3+esm4","8.5.39-1ubuntu1~18.04.3+esm5","8.5.39-1ubuntu1~18.04.3+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1","9.0.16-3ubuntu0.18.04.2+esm2","9.0.16-3ubuntu0.18.04.2+esm3","9.0.16-3ubuntu0.18.04.2+esm4","9.0.16-3ubuntu0.18.04.2+esm5","9.0.16-3ubuntu0.18.04.2+esm6","9.0.16-3ubuntu0.18.04.2+esm7","9.0.16-3ubuntu0.18.04.2+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1","9.0.31-1ubuntu0.2","9.0.31-1ubuntu0.3","9.0.31-1ubuntu0.4","9.0.31-1ubuntu0.5","9.0.31-1ubuntu0.6","9.0.31-1ubuntu0.7","9.0.31-1ubuntu0.8","9.0.31-1ubuntu0.9","9.0.31-1ubuntu0.9+esm1","9.0.31-1ubuntu0.9+esm2","9.0.31-1ubuntu0.9+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1","9.0.58-1ubuntu0.1+esm2","9.0.58-1ubuntu0.1+esm3","9.0.58-1ubuntu0.1+esm4","9.0.58-1ubuntu0.2","9.0.58-1ubuntu0.2+esm1","9.0.58-1ubuntu0.2+esm2","9.0.58-1ubuntu0.2+esm3","9.0.58-1ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.10-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.16-1ubuntu0.1~esm1","10.1.16-1ubuntu0.1~esm2","10.1.16-1ubuntu0.1~esm3","10.1.16-1ubuntu0.1~esm4","10.1.55-1ubuntu2~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.35-1","10.1.40-1","10.1.40-1ubuntu1","10.1.40-1ubuntu1.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.40-1ubuntu1","10.1.54-1","10.1.54-1ubuntu1","10.1.54-1ubuntu2","10.1.55-1ubuntu1","10.1.55-1ubuntu2","10.1.57~us1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.40-1ubuntu1","10.1.40-1ubuntu1.26.04.1","10.1.55-1ubuntu2~26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.8-1.1"}]}],"bundled":3}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"}],"references":[{"url":"https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/06/16/1","tags":["Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48988","tags":["web","advisory"]},{"url":"https://github.com/apache/tomcat/commit/2b0ab14fb55d4edc896e5f1817f2ab76f714ae5e","tags":["web","report"]},{"url":"https://github.com/apache/tomcat/commit/cdde8e655bc1c5c60a07efd216251d77c52fd7f6","tags":["web","report"]},{"url":"https://github.com/apache/tomcat/commit/ee8042ffce4cb9324dfd79efda5984f37bbb6910","tags":["web","report"]},{"url":"https://tomcat.apache.org/security-10.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-11.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h3gc-qfqq-6h8f"},{"url":"https://access.redhat.com/errata/RHSA-2025:14177","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48976","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48988","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48989","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49125","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-52434","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-52520","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-53506","tags":["report"]},{"url":"https://bugzilla.redhat.com/2373015","tags":["report"]},{"url":"https://bugzilla.redhat.com/2373018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2373020","tags":["report"]},{"url":"https://bugzilla.redhat.com/2373309","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379374","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379382","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379386","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-14177.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14178","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-14178.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14181","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-14181.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1778130778.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48988.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-48988","tags":["advisory"]},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0191.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34376","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/06/16/1","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/06/16/2","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1644","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49125","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1897","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52434","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52520","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53506","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11695","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html/red_hat_jboss_web_server_5.8_service_pack_5_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379386","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11695.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48976","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48976","tags":["advisory"]},{"url":"https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","tags":["article"]},{"url":"https://lists.apache.org/thread/w7dbnfyqn1yc05kbqqbbyct7wbomv7lf","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48988","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49125","tags":["advisory"]},{"url":"https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-52434","tags":["advisory"]},{"url":"https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-52520","tags":["advisory"]},{"url":"https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-53506","tags":["advisory"]},{"url":"https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11741","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_service_pack_1_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11741.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373309","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14177.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48989","tags":["advisory"]},{"url":"https://kb.cert.org/vuls/id/767506","tags":["article"]},{"url":"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.44","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14178.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14179","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14179.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14180","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14180.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14181.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14182","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14182.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14183","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14183.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:14177","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:14178","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:14179","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:14181","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502214-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243815","tags":["report"]},{"url":"https://bugzilla.suse.com/1244649","tags":["report"]},{"url":"https://bugzilla.suse.com/1244656","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49125","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502261-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1242722","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502280-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261058-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216182","tags":["report"]},{"url":"https://bugzilla.suse.com/1243895","tags":["report"]},{"url":"https://bugzilla.suse.com/1246318","tags":["report"]},{"url":"https://bugzilla.suse.com/1246389","tags":["report"]},{"url":"https://bugzilla.suse.com/1258371","tags":["report"]},{"url":"https://bugzilla.suse.com/1258385","tags":["report"]},{"url":"https://bugzilla.suse.com/1259224","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24733","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-48988","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-48988","title":"Apache Tomcat: FileUpload large number of parts with headers DoS","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T14:13:40.457Z","modified":"2025-11-03T20:05:03.939Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:32:41.41198Z"}],"euvd":[{"id":"EUVD-2025-18409","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T14:13:40Z","modified":"2025-11-03T20:05:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:32.896597Z"}],"ghsa":[{"id":"GHSA-h3gc-qfqq-6h8f","title":"Apache Tomcat - DoS in multipart upload","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T15:32:28Z","modified":"2025-11-03T21:34:01Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:39:04.350802Z"}],"nvd":[{"id":"CVE-2025-48988","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T15:15:24.563Z","modified":"2026-06-17T09:30:37.383Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:11:13.247441Z"}],"osv":[{"id":"CVE-2025-48988","title":"Apache Tomcat: FileUpload large number of parts with headers DoS","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T14:13:40.457Z","modified":"2026-10-28T02:31:14.667265978Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-48988","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.  This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are  known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions  may also be affected.   Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T15:15:24.563Z","modified":"2026-09-01T20:05:53.419843525Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-h3gc-qfqq-6h8f","title":"Apache Tomcat - DoS in multipart upload","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T15:32:28Z","modified":"2026-09-10T03:50:25.525981341Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"OESA-2025-1644","title":"tomcat security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nAllocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-48988)\n\nAuthentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-49125)","status":"published","published":"2025-06-20T11:08:44Z","modified":"2026-08-18T01:18:00.222779855Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1897","title":"tomcat security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nA vulnerability, which was classified as problematic, has been found in Apache Tomcat up to 9.0.105/10.1.41/11.0.7 (Application Server Software).Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.Impacted is availability.Upgrading to version 9.0.106, 10.1.42 or 11.0.8 eliminates this vulnerability.(CVE-2025-48988)\n\nConcurrent Execution using Shared Resource with Improper Synchronization (\u0026apos;Race Condition\u0026apos;) vulnerability in Apache Tomcat when using the APR/Native connector. This was particularly noticeable with client initiated closes of HTTP/2 connections.\n\nThis issue affects Apache Tomcat: from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 9.0.107, which fixes the issue.(CVE-2025-52434)\n\nFor some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-52520)\n\nUncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106.\n\nUsers are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.(CVE-2025-53506)","status":"published","published":"2025-07-25T11:08:59Z","modified":"2026-08-18T01:18:55.019720013Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"RHSA-2025:11695","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update","status":"published","published":"2025-07-29T10:07:17Z","modified":"2026-10-09T10:13:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:11741","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.1 release and security update","status":"published","published":"2025-07-31T10:08:51Z","modified":"2026-10-09T10:13:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14177","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:54Z","modified":"2026-10-09T10:14:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14178","title":"Red Hat Security Advisory: tomcat9 security update","status":"published","published":"2025-08-21T10:03:54Z","modified":"2026-10-09T10:14:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14179","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:55Z","modified":"2026-10-09T10:14:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14180","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:55Z","modified":"2026-10-09T10:14:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14181","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:55Z","modified":"2026-10-09T10:14:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14182","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:56Z","modified":"2026-10-09T10:14:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14183","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:56Z","modified":"2026-10-09T10:14:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RLSA-2025:14177","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-09-08T14:19:16.612452Z","modified":"2025-09-08T15:03:16.580879Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:14178","title":"Important: tomcat9 security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:48.482776Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:14179","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-03T20:19:16.34748Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:14181","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-04T00:50:08.535095Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-48988","title":"CVE-2025-48988 in org.apache.tomcat:tomcat-catalina - Patched by Root","description":"Root has patched CVE-2025-48988 in the org.apache.tomcat:tomcat-catalina package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-29T12:02:56Z","modified":"2026-10-29T13:15:07.535174129Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2025-48988","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T15:15:00Z","modified":"2026-11-09T12:49:26.629181822Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-09T13:27:42.046613Z"},{"id":"ALSA-2025:14177","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n  * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n  * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n  * tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-08-20T00:00:00Z","modified":"2026-10-29T11:02:22.332186276Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:14178","title":"Important: tomcat9 security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.  \n\nSecurity Fix(es):  \n\n  * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n  * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n  * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n  * tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-08-20T00:00:00Z","modified":"2026-10-29T11:30:04.065723321Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:14181","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n  * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n  * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n  * tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-08-20T00:00:00Z","modified":"2026-10-29T11:32:27.691470691Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"BIT-tomcat-2025-48988","title":"Apache Tomcat: FileUpload large number of parts with headers DoS","description":"Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.0 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-07-10T10:47:06.961Z","modified":"2026-09-08T08:48:20.911190281Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2025-1751500955","title":"TuxCare security update for 3 packages (10 CVEs)","description":"TuxCare rebuilt 3 packages to address 10 CVEs. Fixed in 8.5.100.tuxcare.1.","status":"published","published":"2026-08-04T14:52:04Z","modified":"2026-11-02T19:45:09.85903347Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1756253007","title":"TuxCare security update for 5 packages (18 CVEs)","description":"TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1.","status":"published","published":"2026-08-04T14:52:04Z","modified":"2026-11-02T19:45:08.567289918Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1759795579","title":"TuxCare security update for 6 packages (18 CVEs)","description":"TuxCare rebuilt 6 packages to address 18 CVEs. Fixed in 9.0.83-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-10-30T07:30:07.718953578Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1763338014","title":"TuxCare security update for 4 packages (10 CVEs)","description":"TuxCare rebuilt 4 packages to address 10 CVEs. Fixed in 9.0.90-tuxcare.1.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-11-02T19:45:07.216786099Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1764720465","title":"TuxCare security update for 5 packages (18 CVEs)","description":"TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.50-tuxcare.2.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-11-02T19:45:14.144527872Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1766448497","title":"TuxCare security update for 3 packages (2 CVEs)","description":"TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.0.100-tuxcare.2.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-11-02T19:45:14.721278062Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1768262917","title":"TuxCare security update for 6 packages (22 CVEs)","description":"TuxCare rebuilt 6 packages to address 22 CVEs. Fixed in 10.1.18-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:12.278630051Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1775521833","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 9.0.87-tuxcare.5.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-11-02T19:45:20.807803836Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1776386110","title":"TuxCare security update for 4 packages (3 CVEs)","description":"TuxCare rebuilt 4 packages to address 3 CVEs. Fixed in 9.0.46-tuxcare.4.","status":"published","published":"2026-08-04T14:52:26Z","modified":"2026-11-02T19:45:21.924766426Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1778130778","title":"tomcat: Fix of 2 CVEs","description":"- CVE-2025-48988: limit number and header size of multipart parts\n- CVE-2025-52520: use Math.addExact and long postSize to prevent overflow\n  bypass of maxPostSize during multipart upload","status":"published","published":"2026-05-07T05:13:06Z","modified":"2026-06-01T00:31:34.752497294Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1784682930","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 7.0.109-tuxcare.3.","status":"published","published":"2026-08-04T14:52:46Z","modified":"2026-11-02T19:45:46.22723782Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1792575257","title":"TuxCare security update for 8 packages (32 CVEs)","description":"TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.","status":"published","published":"2026-10-21T09:34:17Z","modified":"2026-11-02T19:46:30.353719339Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792667085","title":"TuxCare security update for 7 packages (24 CVEs)","description":"TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.","status":"published","published":"2026-10-22T11:04:45Z","modified":"2026-11-02T19:46:30.557831164Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793011037","title":"TuxCare security update for 5 packages (26 CVEs)","description":"TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.","status":"published","published":"2026-10-26T10:37:17Z","modified":"2026-11-02T19:46:31.628369017Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793011786","title":"TuxCare security update for 7 packages (22 CVEs)","description":"TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.","status":"published","published":"2026-10-26T10:49:46Z","modified":"2026-11-02T19:46:31.559502384Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793723883","title":"TuxCare security update for 4 packages (6 CVEs)","description":"TuxCare rebuilt 4 packages to address 6 CVEs. Fixed in 7.0.70-tuxcare.6.","status":"published","published":"2026-11-03T17:38:05Z","modified":"2026-11-03T19:30:08.170075195Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CLSA-2026-1793727391","title":"TuxCare security update for 5 packages (8 CVEs)","description":"TuxCare rebuilt 5 packages to address 8 CVEs. Fixed in 10.1.33-tuxcare.3.","status":"published","published":"2026-11-03T18:36:31Z","modified":"2026-11-04T02:30:02.665066571Z","updated_at":"2026-11-04T02:55:01.518827Z"},{"id":"DLA-4244-1","title":"tomcat9 - security update","status":"published","published":"2025-07-21T00:00:00Z","modified":"2026-03-09T02:09:38.37694Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6120-1","title":"tomcat10 - security update","status":"published","published":"2026-02-05T00:00:00Z","modified":"2026-03-09T02:11:28.926265Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"DSA-6121-1","title":"tomcat11 - security update","status":"published","published":"2026-02-05T00:00:00Z","modified":"2026-03-09T02:08:55.570487Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0191","title":"Updated tomcat packages fix security vulnerabilities","description":"FileUpload large number of parts with headers DoS. (CVE-2025-48988)\nSecurity constraint bypass for pre/post-resources. (CVE-2025-49125)\n","status":"published","published":"2025-06-25T05:31:45Z","modified":"2026-04-16T04:43:26.285732071Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15301-1","title":"tomcat-9.0.106-1.1 on GA media","description":"These are all security issues fixed in the tomcat-9.0.106-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:37.017176Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15302-1","title":"tomcat10-10.1.42-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.42-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:36.880351Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15303-1","title":"tomcat11-11.0.8-1.1 on GA media","description":"These are all security issues fixed in the tomcat11-11.0.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:36.924688Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:02214-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n - CVE-2025-46701: Refactored CGI servlet to access resources via WebResources (bsc#1243815).\n - CVE-2025-48988: Limited the total number of parts in a multi-part request and limits the size of the headers provided with each part (bsc#1244656).\n - CVE-2025-49125: Expand checks for webAppMount (bsc#1244649).\n","status":"published","published":"2025-07-03T08:04:04Z","modified":"2026-02-04T03:20:37.187233Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02261-1","title":"Security update for tomcat10","description":"This update for tomcat10 fixes the following issues:\n\n- Fixed refactor CGI servlet to access resources via WebResources (bsc#1243815).\n- Fixed limits the total number of parts in a multi-part request and \n  limits the size of the headers provided with each part (bsc#1244656).\n- Fixed expand checks for webAppMount (bsc#1244649).\n- Hardening permissions (bsc#1242722)\n\nUpdate to Tomcat 10.1.42:\n\n  * Fixed CVEs:\n\n    + CVE-2025-46701: refactor CGI servlet to access resources via\n      WebResources (bsc#1243815)\n    + CVE-2025-48988: limits the total number of parts in a\n      multi-part request and limits the size of\n      the headers provided with each part (bsc#1244656)\n    + CVE-2025-49125: Expand checks for webAppMount (bsc#1244649)\n\n  * Catalina:\n\n    + Add: Support for the java:module namespace which mirrors the\n      java:comp namespace.\n    + Add: Support parsing of multiple path parameters separated by ; in a\n      single URL segment. Based on pull request #860 by Chenjp.\n    + Add: Support for limiting the number of parameters in HTTP requests\n      through the new ParameterLimitValve. The valve allows configurable\n      URL-specific limits on the number of parameters.\n    + Fix: 69699: Encode redirect URL used by the rewrite valve with the\n      session id if appropriate, and handle cross context with different\n      session configuration when using rewrite.\n    + Add: #863: Support for comments at the end of lines in text rewrite\n      map files to align behaviour with Apache httpd. Pull request\n      provided by Chenjp.\n    + Fix: 69706: Saved request serialization issue in FORM introduced\n      when allowing infinite session timeouts.\n    + Fix: Expand the path checks for Pre-Resources and Post-Resources\n      mounted at a path within the web application.\n    + Fix: Use of SSS in SimpleDateFormat pattern for AccessLogValve.\n    + Fix: Process possible path parameters rewrite production in the\n      rewrite valve.\n    + Fix: 69588: Enable allowLinking to be set on PreResources,\n      JarResources and PostResources. If not set explicitly, the setting\n      will be inherited from the Resources.\n    + Add: 69633: Support for Filters using context root mappings.\n    + Fix: 69643: Optimize directory listing for large amount of files.\n      Patch submitted by Loic de l'Eprevier.\n    + Fix: #843: Off by one validation logic for partial PUT ranges and\n      associated test case. Submitted by Chenjp.\n    + Refactor: Replace the unused buffer in\n      org.apache.catalina.connector.InputBuffer with a static, zero\n      length buffer.\n    + Refactor: GCI servlet to access resources via the WebResource API.\n    + Fix: 69662: Report name in exception message when a naming lookup\n      failure occurs. Based on code submitted by Donald Smith.\n    + Fix: Ensure that the FORM authentication attribute\n      authenticationSessionTimeout works correctly when sessions have an\n      infinite timeout when authentication starts.\n    + Add: Provide a content type based on file extension when web\n      application resources are accessed via a URL.\n  * Coyote\n    + Refactor: #861: TaskQueue to use the new interface RetryableQueue\n      which enables better integration of custom Executors which provide\n      their own BlockingQueue implementation. Pull request provided by\n      Paulo Almeida.\n    + Add: Finer grained control of multi-part request processing via two\n      new attributes on the Connector element. maxPartCount limits the\n      total number of parts in a multi-part request and maxPartHeaderSize\n      limits the size of the headers provided with each part. Add support\n      for these new attributes to the ParameterLimitValve.\n    + Refactor: The SavedRequestInputFilter so the buffered data is used\n      directly rather than copied.\n\n  * Jasper:\n\n    + Fix: 69696: Mark the JSP wrapper for reload after a failed\n      compilation.\n    + Fix: 69635: Add support to jakarta.el.ImportHandler for resolving\n      inner classes.\n    + Add: #842: Support for optimized execution of c:set and c:remove\n      tags, when activated via JSP servlet param\n      useNonstandardTagOptimizations.\n    + Fix: An edge case compilation bug for JSP and tag files on case\n      insensitive file systems that was exposed by the test case for\n      69635.\n\n  * Web applications:\n\n    + Fix: 69694: Improve error reporting of deployment tasks done using\n      the manager webapp when a copy operation fails.\n    + Add: 68876: Documentation. Update the UML diagrams for server\n      start-up, request processing and authentication using PlantUML and\n      include the source files for each diagram.\n\n  * Other:\n\n    + Add: Thread name to webappClassLoader.stackTraceRequestThread\n      message. Patch provided by Felix Zhang.\n    + Update: Tomcat Native to 2.0.9.\n    + Update: The internal fork of Apache Commons FileUpload to 1.6.0-RC1\n      (2025-06-05).\n    + Update: EasyMock to 5.6.0.\n    + Update: Checkstyle to 10.25.0.\n    + Fix: Use the full path when the installer for Windows sets calls\n      icacls.exe to set file permissions.\n    + Update: Improvements to Japanese translations provided by tak7iji.\n    + Fix: Set sun.io.useCanonCaches in service.bat Based on pull request\n      #841 by Paul Lodge.\n    + Update: Jacoco to 0.8.13.\n    + Code: Explicitly set the locale to be used for Javadoc. For\n      official releases, this locale will be English (US) to support\n      reproducible builds.\n    + Update: Byte Buddy to 1.17.5.\n    + Update: Checkstyle to 10.23.1.\n    + Update: File extension to media type mappings to align with the\n      current list used by the Apache Web Server (httpd).\n    + Update: Improvements to French translations.\n    + Update: Improvements to Japanese translations provided by tak7iji. \n","status":"published","published":"2025-07-09T17:40:32Z","modified":"2026-02-04T03:33:00.695409Z","updated_at":"2026-11-02T15:53:56.647031Z"}]},"sources_more":{"osv":2}}