{"id":"CVE-2026-43512","aliases":["ALSA-2026:68651","ALSA-2026:68660","ALSA-2026:68677","ALSA-2026:69259","BIT-tomcat-2026-43512","CLSA-2026-1779366607","CLSA-2026-1779374454","CLSA-2026-1779893247","CLSA-2026-1779957268","CLSA-2026-1779968889","CLSA-2026-1780649787","CLSA-2026-1782900813","CLSA-2026-1788550289","CLSA-2026-1792666002","CLSA-2026-1793136846","CLSA-2026-1793384138","CLSA-2026-1793726520","CLSA-2026-1793729384","CLSA-2026-1793859817","CLSA-2026-1793861217","CLSA-2026-1793863300","CLSA-2026-1793864318","CLSA-2026-1794170771","DEBIAN-CVE-2026-43512","EUVD-2026-29516","GHSA-h6fc-48rj-7qqh","MGASA-2026-0139","OESA-2026-2296","RHSA-2026:13745","RHSA-2026:16528","RHSA-2026:39188","RHSA-2026:43401","RHSA-2026:67163","RHSA-2026:67164","RHSA-2026:68651","RHSA-2026:68659","RHSA-2026:68660","RHSA-2026:68677","RHSA-2026:68678","RHSA-2026:68679","RHSA-2026:68680","RHSA-2026:69259","RLSA-2026:68651","RLSA-2026:68660","RLSA-2026:68677","RLSA-2026:69259","SUSE-SU-2026:22195-1","SUSE-SU-2026:22196-1","SUSE-SU-2026:22197-1","SUSE-SU-2026:2299-1","SUSE-SU-2026:2374-1","SUSE-SU-2026:2377-1","SUSE-SU-2026:2675-1","UBUNTU-CVE-2026-43512","USN-8383-1","openSUSE-SU-2026:10925-1","openSUSE-SU-2026:10926-1","openSUSE-SU-2026:10927-1","openSUSE-SU-2026:21117-1","openSUSE-SU-2026:21121-1","openSUSE-SU-2026:21122-1"],"status":"published","title":"Apache Tomcat: Digest authenticator will authenticate any unknown user","description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.\nOlder unsupported versions any also be affect\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01326,"percentile":0.71218,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-287","CWE-592"],"published":"2026-05-12T15:24:02Z","modified":"2026-11-09T01:45:06Z","exploits":[{"source":"pocgithub","id":"covepseng/cve-2026-43512-poc","title":"covepseng/cve-2026-43512-poc","date":"2026-06-08","url":"https://github.com/covepseng/cve-2026-43512-poc"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["9.0.118","10.1.55","11.0.22"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["9.0.118","10.1.55","11.0.22"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["9.0.118","10.1.55","11.0.22"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"tomcat","fixed_in":["10.1.55","11.0.22","9.0.118"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["10.1.18-tuxcare.9"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","fixed_in":["10.1.18-tuxcare.9"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["10.1.18-tuxcare.9"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat10","fixed_in":["10.1.55-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat10","fixed_in":["10.1.55-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat10","fixed_in":["10.1.55-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat11","fixed_in":["11.0.22-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat11","fixed_in":["11.0.22-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat6","fixed_in":["6.0.39-1ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat7","fixed_in":["7.0.52-1ubuntu0.16+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","fixed_in":["7.0.68-1ubuntu0.4+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","fixed_in":["9.0.16-3ubuntu0.18.04.2+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tomcat9","fixed_in":["9.0.31-1ubuntu0.9+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","fixed_in":["9.0.58-1ubuntu0.2+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat10","fixed_in":["10.1.16-1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat9","fixed_in":["9.0.70-2ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"tomcat10","fixed_in":["10.1.40-1ubuntu1.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"tomcat9","fixed_in":["9.0.95-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"tomcat10","fixed_in":["10.1.40-1ubuntu1.26.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"tomcat9","fixed_in":["9.0.115-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.55"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.22"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.55"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.22"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.55"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.22"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Bitnami","package":"tomcat","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.1.55"},{"introduced":"11.0.0"},{"fixed":"11.0.22"},{"introduced":"9.0.0"},{"fixed":"9.0.118"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libtomcat9-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libtomcat9-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libservlet3.0-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libservlet3.0-java-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libtomcat7-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libtomcat9-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libtomcat9-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libservlet3.1-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libservlet3.1-java-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.42"},{"fixed":"10.1.42-tuxcare.9"}]}],"versions":["10.1.42","10.1.42-tuxcare.1","10.1.42-tuxcare.2","10.1.42-tuxcare.3","10.1.42-tuxcare.4","10.1.42-tuxcare.5","10.1.42-tuxcare.6","10.1.42-tuxcare.7","10.1.42-tuxcare.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.42"},{"fixed":"10.1.42-tuxcare.9"}]}],"versions":["10.1.42","10.1.42-tuxcare.1","10.1.42-tuxcare.2","10.1.42-tuxcare.3","10.1.42-tuxcare.4","10.1.42-tuxcare.5","10.1.42-tuxcare.6","10.1.42-tuxcare.7","10.1.42-tuxcare.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.42"},{"fixed":"10.1.42-tuxcare.9"}]}],"versions":["10.1.42","10.1.42-tuxcare.1","10.1.42-tuxcare.2","10.1.42-tuxcare.3","10.1.42-tuxcare.4","10.1.42-tuxcare.5","10.1.42-tuxcare.6","10.1.42-tuxcare.7","10.1.42-tuxcare.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.1"}]}],"versions":["10.1.33"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.1"}]}],"versions":["10.1.33"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.1"}]}],"versions":["10.1.33"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.1"}]}],"versions":["10.1.33"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote-ffm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.1"}]}],"versions":["10.1.33"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.1"}]}],"versions":["10.1.33"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.9"}]}],"versions":["10.1.18","10.1.18-tuxcare.1","10.1.18-tuxcare.2","10.1.18-tuxcare.3","10.1.18-tuxcare.4","10.1.18-tuxcare.5","10.1.18-tuxcare.6","10.1.18-tuxcare.7","10.1.18-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.9"}]}],"versions":["10.1.18","10.1.18-tuxcare.1","10.1.18-tuxcare.2","10.1.18-tuxcare.3","10.1.18-tuxcare.4","10.1.18-tuxcare.5","10.1.18-tuxcare.6","10.1.18-tuxcare.7","10.1.18-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.9"}]}],"versions":["10.1.18","10.1.18-tuxcare.1","10.1.18-tuxcare.2","10.1.18-tuxcare.3","10.1.18-tuxcare.4","10.1.18-tuxcare.5","10.1.18-tuxcare.6","10.1.18-tuxcare.7","10.1.18-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.7"}]}],"versions":["9.0.75","9.0.75-tuxcare.1","9.0.75-tuxcare.2","9.0.75-tuxcare.3","9.0.75-tuxcare.4","9.0.75-tuxcare.5","9.0.75-tuxcare.6"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.7"}]}],"versions":["9.0.75","9.0.75-tuxcare.1","9.0.75-tuxcare.2","9.0.75-tuxcare.3","9.0.75-tuxcare.4","9.0.75-tuxcare.5","9.0.75-tuxcare.6"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.7"}]}],"versions":["9.0.75","9.0.75-tuxcare.1","9.0.75-tuxcare.2","9.0.75-tuxcare.3","9.0.75-tuxcare.4","9.0.75-tuxcare.5","9.0.75-tuxcare.6"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.50"},{"fixed":"10.1.50-tuxcare.3"}]}],"versions":["10.1.50","10.1.50-tuxcare.1","10.1.50-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.50"},{"fixed":"10.1.50-tuxcare.3"}]}],"versions":["10.1.50","10.1.50-tuxcare.1","10.1.50-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.50"},{"fixed":"10.1.50-tuxcare.3"}]}],"versions":["10.1.50","10.1.50-tuxcare.1","10.1.50-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.50"},{"fixed":"10.1.50-tuxcare.3"}]}],"versions":["10.1.50","10.1.50-tuxcare.1","10.1.50-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.17"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.11","9.0.50-tuxcare.12","9.0.50-tuxcare.13","9.0.50-tuxcare.14","9.0.50-tuxcare.15","9.0.50-tuxcare.16","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.17"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.11","9.0.50-tuxcare.12","9.0.50-tuxcare.13","9.0.50-tuxcare.14","9.0.50-tuxcare.15","9.0.50-tuxcare.16","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.17"}]}],"versions":["9.0.50","9.0.50-tuxcare.1","9.0.50-tuxcare.10","9.0.50-tuxcare.11","9.0.50-tuxcare.12","9.0.50-tuxcare.13","9.0.50-tuxcare.14","9.0.50-tuxcare.15","9.0.50-tuxcare.16","9.0.50-tuxcare.2","9.0.50-tuxcare.3","9.0.50-tuxcare.4","9.0.50-tuxcare.5","9.0.50-tuxcare.6","9.0.50-tuxcare.7","9.0.50-tuxcare.8","9.0.50-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.5"}]}],"versions":["9.0.13","9.0.13-tuxcare.1","9.0.13-tuxcare.2","9.0.13-tuxcare.3","9.0.13-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.5"}]}],"versions":["9.0.13","9.0.13-tuxcare.1","9.0.13-tuxcare.2","9.0.13-tuxcare.3","9.0.13-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.5"}]}],"versions":["9.0.13","9.0.13-tuxcare.1","9.0.13-tuxcare.2","9.0.13-tuxcare.3","9.0.13-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.5"}]}],"versions":["9.0.13","9.0.13-tuxcare.1","9.0.13-tuxcare.2","9.0.13-tuxcare.3","9.0.13-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.3"}]}],"versions":["9.0.39","9.0.39-tuxcare.1","9.0.39-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.3"}]}],"versions":["9.0.39","9.0.39-tuxcare.1","9.0.39-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.3"}]}],"versions":["9.0.39","9.0.39-tuxcare.1","9.0.39-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.3"}]}],"versions":["9.0.39","9.0.39-tuxcare.1","9.0.39-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.3"}]}],"versions":["9.0.39","9.0.39-tuxcare.1","9.0.39-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.3"}]}],"versions":["9.0.39","9.0.39-tuxcare.1","9.0.39-tuxcare.2"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.16"},{"fixed":"10.1.16-tuxcare.2"}]}],"versions":["10.1.16","10.1.16-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.16"},{"fixed":"10.1.16-tuxcare.2"}]}],"versions":["10.1.16","10.1.16-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.16"},{"fixed":"10.1.16-tuxcare.2"}]}],"versions":["10.1.16","10.1.16-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.16"},{"fixed":"10.1.16-tuxcare.2"}]}],"versions":["10.1.16","10.1.16-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.16"},{"fixed":"10.1.16-tuxcare.2"}]}],"versions":["10.1.16","10.1.16-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.14"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.10","9.0.46-tuxcare.11","9.0.46-tuxcare.12","9.0.46-tuxcare.13","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7","9.0.46-tuxcare.8","9.0.46-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.14"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.10","9.0.46-tuxcare.11","9.0.46-tuxcare.12","9.0.46-tuxcare.13","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7","9.0.46-tuxcare.8","9.0.46-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.14"}]}],"versions":["9.0.46","9.0.46-tuxcare.1","9.0.46-tuxcare.10","9.0.46-tuxcare.11","9.0.46-tuxcare.12","9.0.46-tuxcare.13","9.0.46-tuxcare.2","9.0.46-tuxcare.3","9.0.46-tuxcare.4","9.0.46-tuxcare.5","9.0.46-tuxcare.6","9.0.46-tuxcare.7","9.0.46-tuxcare.8","9.0.46-tuxcare.9"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.7"}]}],"versions":["9.0.83","9.0.83-tuxcare.1","9.0.83-tuxcare.2","9.0.83-tuxcare.3","9.0.83-tuxcare.4","9.0.83-tuxcare.5","9.0.83-tuxcare.6"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.7"}]}],"versions":["9.0.83","9.0.83-tuxcare.1","9.0.83-tuxcare.2","9.0.83-tuxcare.3","9.0.83-tuxcare.4","9.0.83-tuxcare.5","9.0.83-tuxcare.6"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.7"}]}],"versions":["9.0.83","9.0.83-tuxcare.1","9.0.83-tuxcare.2","9.0.83-tuxcare.3","9.0.83-tuxcare.4","9.0.83-tuxcare.5","9.0.83-tuxcare.6"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.7"}]}],"versions":["9.0.83","9.0.83-tuxcare.1","9.0.83-tuxcare.2","9.0.83-tuxcare.3","9.0.83-tuxcare.4","9.0.83-tuxcare.5","9.0.83-tuxcare.6"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-1~deb12u1"}]}],"versions":["10.1.10-1","10.1.13-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.20-1","10.1.23-1","10.1.25-1","10.1.25-1~bpo12+1","10.1.25-2","10.1.30-1","10.1.30-1~bpo12+1","10.1.31-1","10.1.33-1","10.1.33-1~bpo12+1","10.1.34-0+deb12u1","10.1.34-0+deb12u2","10.1.34-1","10.1.35-1","10.1.40-1","10.1.40-1~bpo12+1","10.1.46-1","10.1.52-1","10.1.52-1~deb12u1","10.1.52-1~deb13u1","10.1.52-2","10.1.54-1","10.1.6-1","10.1.6-1+deb12u1","10.1.6-1+deb12u2","10.1.7-1","10.1.8-1","10.1.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-1~deb13u1"}]}],"versions":["10.1.40-1","10.1.46-1","10.1.52-1","10.1.52-1~deb12u1","10.1.52-1~deb13u1","10.1.52-2","10.1.54-1","10.1.55-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-1"}]}],"versions":["10.1.40-1","10.1.46-1","10.1.52-1","10.1.52-1~deb12u1","10.1.52-1~deb13u1","10.1.52-2","10.1.54-1","10.1.55-1~deb12u1","10.1.55-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-1~deb13u1"}]}],"versions":["11.0.11-1","11.0.15-1","11.0.15-1~deb13u1","11.0.18-1","11.0.21-1","11.0.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-1"}]}],"versions":["11.0.11-1","11.0.15-1","11.0.15-1~deb13u1","11.0.18-1","11.0.21-1","11.0.22-1~deb13u1","11.0.6-1"]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118"}]}],"versions":["7.0.0","7.0.100","7.0.103","7.0.104","7.0.105","7.0.106","7.0.107","7.0.108","7.0.109","7.0.11","7.0.12","7.0.14","7.0.16","7.0.19","7.0.2","7.0.20","7.0.21","7.0.22","7.0.23","7.0.25","7.0.26","7.0.27","7.0.28","7.0.29","7.0.30","7.0.32","7.0.33","7.0.34","7.0.35","7.0.37","7.0.39","7.0.4","7.0.40","7.0.41","7.0.42","7.0.47","7.0.5","7.0.50","7.0.52","7.0.53","7.0.54","7.0.55","7.0.56","7.0.57","7.0.59","7.0.6","7.0.61","7.0.62","7.0.63","7.0.64","7.0.65","7.0.67","7.0.68","7.0.69","7.0.70","7.0.72","7.0.73","7.0.75","7.0.76","7.0.77","7.0.78","7.0.79","7.0.8","7.0.81","7.0.82","7.0.84","7.0.85","7.0.86","7.0.88","7.0.90","7.0.91","7.0.92","7.0.93","7.0.94","7.0.96","7.0.99","8.0.0-RC1","8.0.0-RC10","8.0.0-RC3","8.0.0-RC5","8.0.1","8.0.11","8.0.12","8.0.14","8.0.15","8.0.17","8.0.18","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.32","8.0.33","8.0.35","8.0.36","8.0.37","8.0.38","8.0.39","8.0.41","8.0.42","8.0.43","8.0.44","8.0.45","8.0.46","8.0.47","8.0.48","8.0.49","8.0.5","8.0.50","8.0.51","8.0.52","8.0.53","8.0.8","8.0.9","8.5.0","8.5.100","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98","8.5.99","9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.100","9.0.102","9.0.104","9.0.105","9.0.106","9.0.107","9.0.108","9.0.109","9.0.11","9.0.110","9.0.111","9.0.112","9.0.113","9.0.115","9.0.116","9.0.117","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85","9.0.86","9.0.87","9.0.88","9.0.89","9.0.90","9.0.91","9.0.93","9.0.94","9.0.95","9.0.96","9.0.97","9.0.98","9.0.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.55"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.19","10.1.2","10.1.20","10.1.23","10.1.24","10.1.25","10.1.26","10.1.28","10.1.29","10.1.30","10.1.31","10.1.33","10.1.34","10.1.35","10.1.36","10.1.39","10.1.4","10.1.40","10.1.41","10.1.42","10.1.43","10.1.44","10.1.45","10.1.46","10.1.47","10.1.48","10.1.49","10.1.5","10.1.50","10.1.52","10.1.53","10.1.54","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.22"}]}],"versions":["11.0.0","11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M17","11.0.0-M18","11.0.0-M19","11.0.0-M20","11.0.0-M21","11.0.0-M22","11.0.0-M24","11.0.0-M25","11.0.0-M26","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.18","11.0.2","11.0.20","11.0.21","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118"}]}],"versions":["7.0.100","7.0.103","7.0.104","7.0.105","7.0.106","7.0.107","7.0.108","7.0.109","7.0.35","7.0.37","7.0.39","7.0.40","7.0.41","7.0.42","7.0.47","7.0.50","7.0.52","7.0.53","7.0.54","7.0.55","7.0.56","7.0.57","7.0.59","7.0.61","7.0.62","7.0.63","7.0.64","7.0.65","7.0.67","7.0.68","7.0.69","7.0.70","7.0.72","7.0.73","7.0.75","7.0.76","7.0.77","7.0.78","7.0.79","7.0.81","7.0.82","7.0.84","7.0.85","7.0.86","7.0.88","7.0.90","7.0.91","7.0.92","7.0.93","7.0.94","7.0.96","7.0.99","8.0.0-RC1","8.0.0-RC10","8.0.0-RC3","8.0.0-RC5","8.0.1","8.0.11","8.0.12","8.0.14","8.0.15","8.0.17","8.0.18","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.32","8.0.33","8.0.35","8.0.36","8.0.37","8.0.38","8.0.39","8.0.41","8.0.42","8.0.43","8.0.44","8.0.45","8.0.46","8.0.47","8.0.48","8.0.49","8.0.5","8.0.50","8.0.51","8.0.52","8.0.53","8.0.8","8.0.9","8.5.0","8.5.100","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98","8.5.99","9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.100","9.0.102","9.0.104","9.0.105","9.0.106","9.0.107","9.0.108","9.0.109","9.0.11","9.0.110","9.0.111","9.0.112","9.0.113","9.0.115","9.0.116","9.0.117","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85","9.0.86","9.0.87","9.0.88","9.0.89","9.0.90","9.0.91","9.0.93","9.0.94","9.0.95","9.0.96","9.0.97","9.0.98","9.0.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.55"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.19","10.1.2","10.1.20","10.1.23","10.1.24","10.1.25","10.1.26","10.1.28","10.1.29","10.1.30","10.1.31","10.1.33","10.1.34","10.1.35","10.1.36","10.1.39","10.1.4","10.1.40","10.1.41","10.1.42","10.1.43","10.1.44","10.1.45","10.1.46","10.1.47","10.1.48","10.1.49","10.1.5","10.1.50","10.1.52","10.1.53","10.1.54","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.22"}]}],"versions":["11.0.0","11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M17","11.0.0-M18","11.0.0-M19","11.0.0-M20","11.0.0-M21","11.0.0-M22","11.0.0-M24","11.0.0-M25","11.0.0-M26","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.18","11.0.2","11.0.20","11.0.21","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118"}]}],"versions":["7.0.0","7.0.100","7.0.103","7.0.104","7.0.105","7.0.106","7.0.107","7.0.108","7.0.109","7.0.11","7.0.12","7.0.14","7.0.16","7.0.19","7.0.2","7.0.20","7.0.21","7.0.22","7.0.23","7.0.25","7.0.26","7.0.27","7.0.28","7.0.29","7.0.30","7.0.32","7.0.33","7.0.34","7.0.35","7.0.37","7.0.39","7.0.4","7.0.40","7.0.41","7.0.42","7.0.47","7.0.5","7.0.50","7.0.52","7.0.53","7.0.54","7.0.55","7.0.56","7.0.57","7.0.59","7.0.6","7.0.61","7.0.62","7.0.63","7.0.64","7.0.65","7.0.67","7.0.68","7.0.69","7.0.70","7.0.72","7.0.73","7.0.75","7.0.76","7.0.77","7.0.78","7.0.79","7.0.8","7.0.81","7.0.82","7.0.84","7.0.85","7.0.86","7.0.88","7.0.90","7.0.91","7.0.92","7.0.93","7.0.94","7.0.96","7.0.99","8.0.0-RC1","8.0.0-RC10","8.0.0-RC3","8.0.0-RC5","8.0.1","8.0.11","8.0.12","8.0.14","8.0.15","8.0.17","8.0.18","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.32","8.0.33","8.0.35","8.0.36","8.0.37","8.0.38","8.0.39","8.0.41","8.0.42","8.0.43","8.0.44","8.0.45","8.0.46","8.0.47","8.0.48","8.0.49","8.0.5","8.0.50","8.0.51","8.0.52","8.0.53","8.0.8","8.0.9","8.5.0","8.5.100","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98","8.5.99","9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.100","9.0.102","9.0.104","9.0.105","9.0.106","9.0.107","9.0.108","9.0.109","9.0.11","9.0.110","9.0.111","9.0.112","9.0.113","9.0.115","9.0.116","9.0.117","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85","9.0.86","9.0.87","9.0.88","9.0.89","9.0.90","9.0.91","9.0.93","9.0.94","9.0.95","9.0.96","9.0.97","9.0.98","9.0.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.55"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.19","10.1.2","10.1.20","10.1.23","10.1.24","10.1.25","10.1.26","10.1.28","10.1.29","10.1.30","10.1.31","10.1.33","10.1.34","10.1.35","10.1.36","10.1.39","10.1.4","10.1.40","10.1.41","10.1.42","10.1.43","10.1.44","10.1.45","10.1.46","10.1.47","10.1.48","10.1.49","10.1.5","10.1.50","10.1.52","10.1.53","10.1.54","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.22"}]}],"versions":["11.0.0","11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M17","11.0.0-M18","11.0.0-M19","11.0.0-M20","11.0.0-M21","11.0.0-M22","11.0.0-M24","11.0.0-M25","11.0.0-M26","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.18","11.0.2","11.0.20","11.0.21","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Mageia:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.oe2403sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.oe2403sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.oe2403sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.22-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.22-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.22-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.22-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-el-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.22-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-jsp-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.22-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.22-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-servlet-6.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.22-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-user-instance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.22-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.22-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.55-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.55-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.55-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.55-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.55-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.55-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.55-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.55-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-user-instance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.55-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.55-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-150600.13.21.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-150600.13.21.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-150600.13.21.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.39-1ubuntu0.1+esm3"}]}],"versions":["6.0.37-1","6.0.39-1","6.0.39-1ubuntu0.1","6.0.39-1ubuntu0.1+esm1","6.0.39-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.16+esm2"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3","7.0.52-1ubuntu0.6","7.0.52-1ubuntu0.7","7.0.52-1ubuntu0.8","7.0.52-1ubuntu0.9","7.0.52-1ubuntu0.10","7.0.52-1ubuntu0.11","7.0.52-1ubuntu0.13","7.0.52-1ubuntu0.14","7.0.52-1ubuntu0.15","7.0.52-1ubuntu0.16","7.0.52-1ubuntu0.16+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.26-1","8.0.28-1","8.0.30-1","8.0.32-1","8.0.32-1ubuntu1","8.0.32-1ubuntu1.1","8.0.32-1ubuntu1.2","8.0.32-1ubuntu1.3","8.0.32-1ubuntu1.4","8.0.32-1ubuntu1.5","8.0.32-1ubuntu1.6","8.0.32-1ubuntu1.7","8.0.32-1ubuntu1.8","8.0.32-1ubuntu1.9","8.0.32-1ubuntu1.10","8.0.32-1ubuntu1.11","8.0.32-1ubuntu1.13","8.0.32-1ubuntu1.13+esm1","8.0.32-1ubuntu1.13+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+esm4"}]}],"versions":["7.0.64-1","7.0.68-1","7.0.68-1ubuntu0.1","7.0.68-1ubuntu0.3","7.0.68-1ubuntu0.4","7.0.68-1ubuntu0.4+esm1","7.0.68-1ubuntu0.4+esm2","7.0.68-1ubuntu0.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2","8.5.39-1ubuntu1~18.04.3","8.5.39-1ubuntu1~18.04.3+esm1","8.5.39-1ubuntu1~18.04.3+esm2","8.5.39-1ubuntu1~18.04.3+esm3","8.5.39-1ubuntu1~18.04.3+esm4","8.5.39-1ubuntu1~18.04.3+esm5","8.5.39-1ubuntu1~18.04.3+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+esm8"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1","9.0.16-3ubuntu0.18.04.2+esm2","9.0.16-3ubuntu0.18.04.2+esm3","9.0.16-3ubuntu0.18.04.2+esm4","9.0.16-3ubuntu0.18.04.2+esm5","9.0.16-3ubuntu0.18.04.2+esm6","9.0.16-3ubuntu0.18.04.2+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+esm3"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1","9.0.31-1ubuntu0.2","9.0.31-1ubuntu0.3","9.0.31-1ubuntu0.4","9.0.31-1ubuntu0.5","9.0.31-1ubuntu0.6","9.0.31-1ubuntu0.7","9.0.31-1ubuntu0.8","9.0.31-1ubuntu0.9","9.0.31-1ubuntu0.9+esm1","9.0.31-1ubuntu0.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.58-1ubuntu0.2+esm4"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1","9.0.58-1ubuntu0.1+esm2","9.0.58-1ubuntu0.1+esm3","9.0.58-1ubuntu0.1+esm4","9.0.58-1ubuntu0.2","9.0.58-1ubuntu0.2+esm1","9.0.58-1ubuntu0.2+esm2","9.0.58-1ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.16-1ubuntu0.1~esm4"}]}],"versions":["10.1.10-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.16-1ubuntu0.1~esm1","10.1.16-1ubuntu0.1~esm2","10.1.16-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2ubuntu0.1+esm3"}]}],"versions":["9.0.70-1ubuntu1","9.0.70-2","9.0.70-2ubuntu0.1","9.0.70-2ubuntu0.1+esm1","9.0.70-2ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.40-1ubuntu1.25.10.1"}]}],"versions":["10.1.35-1","10.1.40-1","10.1.40-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.95-1ubuntu1.1"}]}],"versions":["9.0.70-2ubuntu1.1","9.0.70-2ubuntu2","9.0.70-2ubuntu3","9.0.95-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.40-1ubuntu1.26.04.1"}]}],"versions":["10.1.40-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-1ubuntu0.1"}]}],"versions":["9.0.95-1ubuntu1","9.0.111-1","9.0.115-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.6-1","11.0.11-1","11.0.15-1","11.0.18-1","11.0.18-1ubuntu0.1~esm1","11.0.22-2ubuntu2~26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.39-1ubuntu0.1+esm3"}]}],"versions":["6.0.37-1","6.0.39-1","6.0.39-1ubuntu0.1","6.0.39-1ubuntu0.1+esm1","6.0.39-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.16+esm2"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3","7.0.52-1ubuntu0.6","7.0.52-1ubuntu0.7","7.0.52-1ubuntu0.8","7.0.52-1ubuntu0.9","7.0.52-1ubuntu0.10","7.0.52-1ubuntu0.11","7.0.52-1ubuntu0.13","7.0.52-1ubuntu0.14","7.0.52-1ubuntu0.15","7.0.52-1ubuntu0.16","7.0.52-1ubuntu0.16+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+esm4"}]}],"versions":["7.0.64-1","7.0.68-1","7.0.68-1ubuntu0.1","7.0.68-1ubuntu0.3","7.0.68-1ubuntu0.4","7.0.68-1ubuntu0.4+esm1","7.0.68-1ubuntu0.4+esm2","7.0.68-1ubuntu0.4+esm3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-160000.1.1"}]}],"bundled":7}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"}],"references":[{"url":"https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/12/8","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43512","tags":["web","advisory"]},{"url":"https://github.com/apache/tomcat/commit/3d4d3fae07a6cd9c2eb193c5491001740ec64448","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/6565a6cb6499e56fe2f34457cec99f9d1c4f39e9","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/a99c355e8199adbfd67c9a1fffbd85b810b196cd","tags":["web"]},{"url":"https://tomcat.apache.org/security-10.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-11.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h6fc-48rj-7qqh"},{"url":"https://access.redhat.com/errata/RHSA-2026:68651","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32990","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41293","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42498","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43512","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43513","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43515","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59083","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59084","tags":["report"]},{"url":"https://bugzilla.redhat.com/2457025","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476511","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476513","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476516","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476519","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476520","tags":["report"]},{"url":"https://bugzilla.redhat.com/2499917","tags":["report"]},{"url":"https://bugzilla.redhat.com/2499931","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-68651.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-41284.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-43514.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-50229.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-53404.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-53434.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-55276.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-55955.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-55956.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68660","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-68660.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68677","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55957","tags":["report"]},{"url":"https://bugzilla.redhat.com/2494669","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-68677.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2024-52316.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2024-54677.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-46701.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-55668.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-55754.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-61795.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-66614.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-24733.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-24880.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-25854.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-29145.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-34483.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-34487.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69259","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-69259.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1779366607.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1779374454.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1779893247.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779957268.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55668","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41293","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42498","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43513","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43514","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43515","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1779968889.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1780649787.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1782900813.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43512.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-43512","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0139.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35523","tags":["report"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.118","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/8","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/9","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/10","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/11","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/12","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/13","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/14","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2296","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:13745","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43514","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13745.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476516","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42498","tags":["advisory"]},{"url":"https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476511","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43512","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476512","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43514","tags":["advisory"]},{"url":"https://lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476519","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43515","tags":["advisory"]},{"url":"https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:16528","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16528.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39188","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/7.0/html/red_hat_jboss_web_server_7.0_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457027","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476513","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476520","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494676","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39188.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-29146","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-29146","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29146","tags":["advisory"]},{"url":"https://lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34486","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34486","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34486","tags":["advisory"]},{"url":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41284","tags":["advisory"]},{"url":"https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41293","tags":["advisory"]},{"url":"https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43513","tags":["advisory"]},{"url":"https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55956","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55956","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55956","tags":["advisory"]},{"url":"https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43401","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.2/html/red_hat_jboss_web_server_6.2_service_pack_4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494681","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43401.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53404","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53404","tags":["advisory"]},{"url":"https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67163","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457025","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494669","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499917","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499931","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67163.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-34750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295651","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34750","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34750","tags":["advisory"]},{"url":"https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-38286","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2314686","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-38286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38286","tags":["advisory"]},{"url":"https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-46701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369253","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-46701","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46701","tags":["advisory"]},{"url":"https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55668","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2388226","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55668","tags":["advisory"]},{"url":"https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6","tags":["article"]},{"url":"https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21","tags":["article"]},{"url":"https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95","tags":["article"]},{"url":"https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55754","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2406590","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55754","tags":["advisory"]},{"url":"https://github.com/apache/tomcat/commit/5a3db092982c0c58d4855304167ee757fe5e79bb","tags":["article"]},{"url":"https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2406588","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61795","tags":["advisory"]},{"url":"https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06","tags":["article"]},{"url":"https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-66614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2440430","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66614","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66614","tags":["advisory"]},{"url":"https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24733","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2440437","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24733","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24733","tags":["advisory"]},{"url":"https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24880","tags":["advisory"]},{"url":"https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457039","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25854","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25854","tags":["advisory"]},{"url":"https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-29145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-29145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29145","tags":["advisory"]},{"url":"https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32990","tags":["advisory"]},{"url":"https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34483","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457044","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34483","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34483","tags":["advisory"]},{"url":"https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34487","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457038","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34487","tags":["advisory"]},{"url":"https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494688","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50229","tags":["advisory"]},{"url":"https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494668","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53434","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53434","tags":["advisory"]},{"url":"https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55276","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494675","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55276","tags":["advisory"]},{"url":"https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55955","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55955","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55955","tags":["advisory"]},{"url":"https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55957","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55957","tags":["advisory"]},{"url":"https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59083","tags":["advisory"]},{"url":"https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59084","tags":["advisory"]},{"url":"https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67164","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67164.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68651.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68659","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68659.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52316","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326972","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52316","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52316","tags":["advisory"]},{"url":"https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-54677","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2332815","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-54677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54677","tags":["advisory"]},{"url":"https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68660.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68677.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68678","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68678.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68679","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68679.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68680","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68680.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69259.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:68651","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:68660","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:68677","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:69259","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622195-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1265145","tags":["report"]},{"url":"https://bugzilla.suse.com/1265162","tags":["report"]},{"url":"https://bugzilla.suse.com/1265163","tags":["report"]},{"url":"https://bugzilla.suse.com/1265165","tags":["report"]},{"url":"https://bugzilla.suse.com/1265166","tags":["report"]},{"url":"https://bugzilla.suse.com/1265167","tags":["report"]},{"url":"https://bugzilla.suse.com/1265168","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43515","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622196-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622197-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262299-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262374-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262377-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262675-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-43512","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8383-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8417-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-43513","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43515","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-43512","title":"Apache Tomcat: Digest authenticator will authenticate any unknown user","description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.\nOlder unsupported versions any also be affect\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T15:24:02.424Z","modified":"2026-05-14T19:53:34.555Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-592"],"updated_at":"2026-11-02T13:37:36.275898Z"}],"euvd":[{"id":"EUVD-2026-29516","description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.\nOlder unsupported versions any also be affect\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T15:24:02Z","modified":"2026-05-14T19:53:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:04:30.595644Z"}],"ghsa":[{"id":"GHSA-h6fc-48rj-7qqh","title":"Apache Tomcat - Digest authenticator will authenticate any unknown user","description":"Versions Affected:\nApache Tomcat 11.0.0-M1 to 11.0.21\nApache Tomcat 10.1.0-M1 to 10.1.54\nApache Tomcat 9.0.0.M1 to 9.0.117\nOlder, unsupported versions may also be affected\n\nDescription:\nWhen DIGEST authentication was configured, any user not known to the\nconfigured Realm would be authenticated if they presented the password\n\"null\".\n\nMitigation:\nUsers of the affected versions should apply one of the following\nmitigations:\n- Upgrade to Apache Tomcat 11.0.22 or later\n- Upgrade to Apache Tomcat 10.1.55 or later\n- Upgrade to Apache Tomcat 9.0.118 or later","status":"published","published":"2026-05-12T18:30:38Z","modified":"2026-05-18T20:38:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:40:12.430932Z"}],"nvd":[{"id":"CVE-2026-43512","description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.\nOlder unsupported versions any also be affect\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T16:16:17.99Z","modified":"2026-10-26T00:10:00.15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-592"],"updated_at":"2026-11-02T14:12:18.613259Z"}],"osv":[{"id":"CVE-2026-43512","title":"Apache Tomcat: Digest authenticator will authenticate any unknown user","description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.\nOlder unsupported versions any also be affect\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T15:24:02.424Z","modified":"2026-10-28T02:30:34.688006212Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-592"],"updated_at":"2026-11-02T15:45:04.479642Z"},{"id":"DEBIAN-CVE-2026-43512","description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.  This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect  Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T16:16:17.99Z","modified":"2026-10-26T11:47:38.87450408Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-h6fc-48rj-7qqh","title":"Apache Tomcat - Digest authenticator will authenticate any unknown user","description":"Versions Affected:\nApache Tomcat 11.0.0-M1 to 11.0.21\nApache Tomcat 10.1.0-M1 to 10.1.54\nApache Tomcat 9.0.0.M1 to 9.0.117\nOlder, unsupported versions may also be affected\n\nDescription:\nWhen DIGEST authentication was configured, any user not known to the\nconfigured Realm would be authenticated if they presented the password\n\"null\".\n\nMitigation:\nUsers of the affected versions should apply one of the following\nmitigations:\n- Upgrade to Apache Tomcat 11.0.22 or later\n- Upgrade to Apache Tomcat 10.1.55 or later\n- Upgrade to Apache Tomcat 9.0.118 or later","status":"published","published":"2026-05-12T18:30:38Z","modified":"2026-09-11T08:25:26.501986953Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"OESA-2026-2296","title":"tomcat security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nAllocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.\nOlder, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.(CVE-2026-41284)\n\nImproper Input Validation vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.\nOlder, end of support versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.(CVE-2026-41293)\n\nExposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.(CVE-2026-42498)\n\nDEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.\nOlder unsupported versions any also be affect\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.(CVE-2026-43512)\n\nImproper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.(CVE-2026-43513)\n\nObservable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.(CVE-2026-43514)\n\nImproper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.(CVE-2026-43515)","status":"published","published":"2026-05-15T11:11:16Z","modified":"2026-08-18T01:19:53.405745121Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"RHSA-2026:13745","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-29T10:08:03Z","modified":"2026-10-09T10:19:11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:16528","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-29T10:08:45Z","modified":"2026-10-09T10:19:59Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:39188","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.0 security release","status":"published","published":"2026-07-18T10:11:26Z","modified":"2026-10-17T10:13:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:43401","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.4 release and security update","status":"published","published":"2026-07-23T10:14:25Z","modified":"2026-10-17T10:14:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:67163","title":"Red Hat Security Advisory: tomcat9 security update","status":"published","published":"2026-09-14T10:10:22Z","modified":"2026-10-17T10:18:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67164","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2026-09-14T10:10:22Z","modified":"2026-10-17T10:18:05Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68651","title":"Red Hat Security Advisory: tomcat9 security update","status":"published","published":"2026-09-19T10:14:10Z","modified":"2026-10-17T10:18:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68659","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2026-09-18T10:15:27Z","modified":"2026-10-17T10:18:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68660","title":"Red Hat Security Advisory: tomcat security, bug fix, and enhancement update","status":"published","published":"2026-09-18T10:15:28Z","modified":"2026-10-17T10:18:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68677","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2026-09-18T10:15:29Z","modified":"2026-10-17T10:18:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68678","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2026-09-18T10:15:29Z","modified":"2026-10-17T10:18:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68679","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2026-09-18T10:15:30Z","modified":"2026-10-17T10:18:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68680","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2026-09-18T10:15:31Z","modified":"2026-10-17T10:18:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69259","title":"Red Hat Security Advisory: tomcat update","status":"published","published":"2026-09-22T10:19:51Z","modified":"2026-10-17T10:18:50Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:68651","title":"Moderate: tomcat9 security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.\n\nSecurity Fix(es):\n\n* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n\n* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n\n* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n\n* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n\n* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n\n* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n\n* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n\n* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-19T12:09:22.893412Z","modified":"2026-09-19T12:30:02.57579679Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:68660","title":"Moderate: tomcat security, bug fix, and enhancement update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n\n* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n\n* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n\n* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n\n* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n\n* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n\n* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n\n* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\nBug Fix(es) and Enhancement(s):\n\n* Tomcat fails to respond to client connections when using Java 8 [rhel-9.8] (JIRA:Rocky Linux-257456)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-19T12:04:58.550496Z","modified":"2026-09-19T12:30:02.573355431Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:68677","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n\n* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n\n* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n\n* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n\n* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n\n* tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)\n\n* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n\n* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-19T06:01:33.521772Z","modified":"2026-09-19T06:30:02.60709599Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:69259","title":"Moderate: tomcat update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n\n* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n\n* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n\n* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498)\n\n* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n\n* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-22T12:08:07.529031Z","modified":"2026-09-22T12:30:02.644996484Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-43512","description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T16:16:00Z","modified":"2026-07-15T19:46:01.242897253Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:22.075798Z"},{"id":"ALSA-2026:68651","title":"Moderate: tomcat9 security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.  \n\nSecurity Fix(es):  \n\n  * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n  * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n  * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n  * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n  * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n  * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n  * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n  * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-10-29T11:42:24.762833197Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:68660","title":"Moderate: tomcat security, bug fix, and enhancement update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n  * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n  * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n  * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n  * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n  * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n  * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n  * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Tomcat fails to respond to client connections when using Java 8 [almalinux-9.8] (JIRA:AlmaLinux-257456)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-10-29T11:42:26.054533103Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:68677","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n  * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n  * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n  * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n  * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n  * tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)\n  * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n  * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-10-29T11:12:09.199968453Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:69259","title":"Moderate: tomcat update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n  * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n  * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n  * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498)\n  * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n  * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-10-29T11:42:22.37381471Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"BIT-tomcat-2026-43512","title":"Apache Tomcat: Digest authenticator will authenticate any unknown user","description":"DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.\nOlder unsupported versions any also be affect\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-09-11T05:58:11.334Z","modified":"2026-09-11T08:25:26.501986953Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2026-1779366607","title":"tomcat: Fix of 4 CVEs","description":"- CVE-2026-43514: fix observable timing discrepancy when comparing AJP secret (Low)\n- CVE-2026-43512: fix authentication bypass in DIGEST authentication when password is null (Moderate)\n- CVE-2026-43515: fix improper authorization when multiple method constraints apply to the same extension pattern (Moderate)\n- CVE-2026-43513: fix LockOutRealm bypass via case-variant usernames against case-insensitive realms (Low)","status":"published","published":"2026-05-21T15:42:09Z","modified":"2026-10-26T09:43:50.886657883Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779374454","title":"Fix of 7 CVEs","description":"   * SECURITY UPDATE: multiple security fixes\n     - debian/patches/CVE-2026-41284.patch: add a configurable\n       maxRequestBodySize init-param to the WebDAV servlet to bound\n       LOCK/PROPFIND XML request bodies; reject oversized bodies with\n       413 Request Entity Too Long. Includes the upstream\n       BoundedByteArrayOutputStream helper and associated tests\n     - CVE-2026-41284\n     - debian/patches/CVE-2026-41293.patch: filter invalid HTTP/2 header\n       names in HpackDecoder / HPackHuffman / Stream / Http2Parser using\n       a new HttpParser.isToken-based check; folds upstream follow-up\n       (HttpParser i\u003e32 hex/decimal fix, additional LocalStrings keys,\n       HpackHuffman field-name branch simplification) and ships the new\n       TestHPackHuffman / TestHttp2Section_8_2 tests.\n     - debian/patches/CVE-2026-41293-tests.patch: adapt\n       TestHttp2Section_8_2 to the 9.0.31 readFrame(boolean) signature\n     - CVE-2026-41293\n     - debian/patches/CVE-2026-42498.patch: strip Authorization and\n       Proxy-Authorization headers from WebSocket client userProperties\n       after the proxy CONNECT, HTTP redirect, and successful upgrade\n       paths so credentials are not leaked to redirect or proxy targets\n     - CVE-2026-42498\n     - debian/patches/CVE-2026-43512.patch: fix DIGEST authentication\n       handling of unknown users and users with a null password so they\n       cannot authenticate; adds regression tests to\n       TestDigestAuthenticator\n     - CVE-2026-43512\n     - debian/patches/CVE-2026-43513.patch: add caseSensitive attribute\n       to LockOutRealm and route usernames through a null-safe\n       normalizeUsername helper so case-insensitive realms cannot be\n       brute-forced by varying the case of the username. Folds the\n       upstream Coverity NPE follow-up and adds the new TestLockoutRealm\n       JUnit tests\n     - CVE-2026-43513\n     - debian/patches/CVE-2026-43514.patch: switch the AJP secret\n       comparison in AjpProcessor to a constant-time comparison using\n       the new ConstantTime utility; includes the upstream\n       ByteChunk start-offset follow-up\n     - CVE-2026-43514\n     - debian/patches/CVE-2026-43515.patch: ensure RealmBase finds all\n       matching extension-based security constraints by moving the match\n       bookkeeping inside the inner extension-pattern loop; adds the\n       upstream TestRealmBase.testUncoveredMethods regression test and\n       a TesterRequest.getRequestPathMB() helper\n     - CVE-2026-43515","status":"published","published":"2026-05-21T14:41:06Z","modified":"2026-06-04T10:03:59.659545Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779893247","title":"Fix of 5 CVEs","description":"   * SECURITY UPDATE: add case sensitive attribute to LockOutRealm\n     - debian/patches/CVE-2026-43513.patch: add case sensitive attribute to LockOutRealm\n     - CVE-2026-43513\n   * SECURITY UPDATE: fix the handling of invalid users with DIGEST authentication\n     - debian/patches/CVE-2026-43512.patch: fix the handling of invalid users with DIGEST authentication\n     - CVE-2026-43512\n   * SECURITY UPDATE: switch AJP secret comparison to a constant time algorithm\n     - debian/patches/CVE-2026-43514.patch: switch AJP secret comparison to a constant time algorithm\n     - CVE-2026-43514\n   * SECURITY UPDATE: ensure RealmBase finds all matching extension based constraints\n     - debian/patches/CVE-2026-43515.patch: ensure RealmBase finds all matching extension based constraints\n     - CVE-2026-43515\n   * SECURITY UPDATE: add a configurable limit for WebDAV XML request bodies\n     - debian/patches/CVE-2026-41284.patch: add a configurable limit for WebDAV XML request bodies\n     - CVE-2026-41284","status":"published","published":"2026-05-27T14:47:32Z","modified":"2026-06-04T10:04:24.274977925Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779957268","title":"tomcat: Fix of 8 CVEs","description":"- CVE-2026-43512: fix the handling of invalid users with DIGEST authentication\n- CVE-2026-43513: add case sensitive attribute to LockOutRealm\n- CVE-2026-43514: switch AJP secret comparison to a constant time algorithm\n- CVE-2026-43515: ensure RealmBase finds all matching extension based constraints\n- CVE-2026-41284: add a configurable limit for WebDAV XML request bodies\n- CVE-2026-42498: fix WebSocket + proxy + DIGEST auth on proxy\n- CVE-2026-41293: HTTP/2 header filtering — validate decoded HPACK names/values\n  against RFC 7230 token/field-vchar/field-content rules","status":"published","published":"2026-06-01T10:19:02Z","modified":"2026-10-26T09:43:43.38665348Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779968889","title":"Fix of 7 CVEs","description":"   * SECURITY UPDATE: Authentication Bypass in digest authentication\n     - debian/patches/CVE-2026-43512.patch: reject digest authentication\n       attempts for unknown users in getDigest()\n     - CVE-2026-43512\n   * SECURITY UPDATE: Account lockout bypass in LockOutRealm via case\n     variation of user names\n     - debian/patches/CVE-2026-43513.patch: add a caseSensitive attribute\n       to LockOutRealm and treat user names case-insensitively by default\n     - CVE-2026-43513\n   * SECURITY UPDATE: Observable timing discrepancy in AJP secret comparison\n     - debian/patches/CVE-2026-43514.patch: add ConstantTime helper and\n       switch the AJP secret comparison to a constant time algorithm\n     - CVE-2026-43514\n   * SECURITY UPDATE: Improper authorisation when multiple method\n     constraints define an HTTP method for the same extension\n     - debian/patches/CVE-2026-43515.patch: evaluate findMethod() against\n       every matching SecurityCollection rather than only the last one\n     - CVE-2026-43515\n   * SECURITY UPDATE: Exposure of HTTP authorisation header to unexpected\n     hosts during WebSocket authentication\n     - debian/patches/CVE-2026-42498.patch: drop the cached Authorization\n       header from userProperties before following a WebSocket upgrade\n       redirect so it is not sent to the host named in Location\n     - CVE-2026-42498\n   * SECURITY UPDATE: HTTP/2 header values were not validated for control\n     characters and other illegal bytes\n     - debian/patches/CVE-2026-41293.patch: validate field names and values\n       in HpackDecoder and HPackHuffman using the new HttpParser\n       isFieldVChar / isFieldContent tables\n     - CVE-2026-41293\n   * SECURITY UPDATE: Allocation of resources without limits in WebDAV\n     LOCK and PROPFIND request bodies\n     - debian/patches/CVE-2026-41284.patch: read PROPFIND and LOCK bodies\n       through a new BoundedByteArrayOutputStream limited by the new\n       maxRequestBodySize init parameter (default 4096 bytes)\n     - CVE-2026-41284","status":"published","published":"2026-05-28T14:02:01Z","modified":"2026-06-04T10:03:26.487800721Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780649787","title":"Fix of 7 CVEs","description":"   * SECURITY UPDATE: fix the handling of invalid users with DIGEST authentication\n     - debian/patches/CVE-2026-43512.patch: fix the handling of invalid users with DIGEST authentication\n     - CVE-2026-43512\n   * SECURITY UPDATE: add case sensitive attribute to LockOutRealm\n     - debian/patches/CVE-2026-43513.patch: add case sensitive attribute to LockOutRealm\n     - CVE-2026-43513\n   * SECURITY UPDATE: switch AJP secret comparison to a constant time algorithm\n     - debian/patches/CVE-2026-43514.patch: switch AJP secret comparison to a constant time algorithm\n     - CVE-2026-43514\n   * SECURITY UPDATE: ensure RealmBase finds all matching extension based constraints\n     - debian/patches/CVE-2026-43515.patch: ensure RealmBase finds all matching extension based constraints\n     - CVE-2026-43515\n   * SECURITY UPDATE: add a configurable limit for WebDAV XML request bodies\n     - debian/patches/CVE-2026-41284.patch: add a configurable limit for WebDAV XML request bodies\n     - CVE-2026-41284\n   * SECURITY UPDATE: fix WebSocket + proxy + DIGEST auth on proxy\n     - debian/patches/CVE-2026-42498.patch: fix WebSocket + proxy + DIGEST auth on proxy\n     - CVE-2026-42498\n   * SECURITY UPDATE: HTTP/2 header filtering - validate decoded HPACK names/values against RFC 7230 token/field-vchar/field-content rules\n     - debian/patches/CVE-2026-41293.patch: HTTP/2 header filtering - validate decoded HPACK names/values against RFC 7230 token/field-vchar/field-content rules\n     - CVE-2026-41293\n   * Build: refresh debian/test_certs/ test fixtures (CA + RSA/EC server\n     certs + client cert) — upstream localhost-rsa.jks is expired since\n     2025-02-16 and 8.5.x is no longer rotated; new fixtures are signed\n     by a fresh self-signed CA with 10-year validity, applied via the\n     existing TEST_CERTS_DIR overlay in debian/rules.","status":"published","published":"2026-06-05T08:56:53Z","modified":"2026-10-26T09:43:31.53210015Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1782900813","title":"Fix CVE(s): CVE-2026-43512, CVE-2026-43513, CVE-2026-43515","description":"   * SECURITY UPDATE: fix the handling of invalid users with DIGEST\n     authentication\n     - debian/patches/CVE-2026-43512.patch: short-cut the null password case\n       in RealmBase.getDigest()\n     - CVE-2026-43512\n   * SECURITY UPDATE: account lockout bypass via username case variation\n     - debian/patches/CVE-2026-43513.patch: add case sensitive attribute to\n       LockOutRealm and normalise usernames before tracking failures\n     - CVE-2026-43513\n   * SECURITY UPDATE: authorization bypass with extension-based method\n     constraints\n     - debian/patches/CVE-2026-43515.patch: ensure RealmBase finds all\n       matching extension based constraints\n     - CVE-2026-43515","status":"published","published":"2026-07-08T15:55:53Z","modified":"2026-10-26T09:31:46.800345649Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1788550289","title":"TuxCare security update for 3 packages (4 CVEs)","description":"TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 10.1.42-tuxcare.9.","status":"published","published":"2026-09-04T19:31:29Z","modified":"2026-11-02T19:46:08.259893838Z","updated_at":"2026-11-02T20:29:40.716173Z"},{"id":"CLSA-2026-1792666002","title":"TuxCare security update for 6 packages (17 CVEs)","description":"TuxCare rebuilt 6 packages to address 17 CVEs. Fixed in 10.1.33-tuxcare.1.","status":"published","published":"2026-10-22T10:46:42Z","modified":"2026-11-02T19:46:30.755955528Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793136846","title":"TuxCare security update for 3 packages (1 CVE)","description":"TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 10.1.18-tuxcare.9.","status":"published","published":"2026-10-27T21:34:06Z","modified":"2026-11-02T19:46:32.540480125Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793384138","title":"TuxCare security update for 3 packages (4 CVEs)","description":"TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 9.0.75-tuxcare.7.","status":"published","published":"2026-10-30T19:15:39Z","modified":"2026-11-02T19:46:33.416974113Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793726520","title":"TuxCare security update for 4 packages (2 CVEs)","description":"TuxCare rebuilt 4 packages to address 2 CVEs. Fixed in 10.1.50-tuxcare.3.","status":"published","published":"2026-11-03T18:22:00Z","modified":"2026-11-04T02:30:02.661557237Z","updated_at":"2026-11-04T02:55:01.518827Z"},{"id":"CLSA-2026-1793729384","title":"TuxCare security update for 3 packages (3 CVEs)","description":"TuxCare rebuilt 3 packages to address 3 CVEs. Fixed in 9.0.50-tuxcare.17.","status":"published","published":"2026-11-03T19:09:44Z","modified":"2026-11-04T02:30:02.669737867Z","updated_at":"2026-11-04T02:55:01.518827Z"},{"id":"CLSA-2026-1793859817","title":"TuxCare security update for 4 packages (3 CVEs)","description":"TuxCare rebuilt 4 packages to address 3 CVEs. Fixed in 9.0.13-tuxcare.5.","status":"published","published":"2026-11-05T07:23:38Z","modified":"2026-11-05T13:15:02.297126623Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793861217","title":"TuxCare security update for 6 packages (9 CVEs)","description":"TuxCare rebuilt 6 packages to address 9 CVEs. Fixed in 9.0.39-tuxcare.3.","status":"published","published":"2026-11-05T07:46:58Z","modified":"2026-11-05T13:15:05.086514908Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793863300","title":"TuxCare security update for 5 packages (8 CVEs)","description":"TuxCare rebuilt 5 packages to address 8 CVEs. Fixed in 10.1.16-tuxcare.2.","status":"published","published":"2026-11-05T08:21:41Z","modified":"2026-11-05T13:15:03.279495267Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793864318","title":"TuxCare security update for 3 packages (2 CVEs)","description":"TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.0.46-tuxcare.14.","status":"published","published":"2026-11-05T08:38:39Z","modified":"2026-11-05T13:15:04.031857442Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1794170771","title":"TuxCare security update for 4 packages (5 CVEs)","description":"TuxCare rebuilt 4 packages to address 5 CVEs. Fixed in 9.0.83-tuxcare.7.","status":"published","published":"2026-11-08T21:46:12Z","modified":"2026-11-09T01:45:06.143047506Z","updated_at":"2026-11-09T02:15:19.582074Z"},{"id":"MGASA-2026-0139","title":"Updated tomcat packages fix security vulnerability","description":"Unbounded read in WebDAV LOCK and PROPFIND handling. (CVE-2026-41284)\nHTTP/2 request headers not validated. (CVE-2026-41293)\nWebSocket authentication header exposure. (CVE-2026-42498)\nDigest authenticator will authenticate any unknown user.\n(CVE-2026-43512)\nLockOutRealm treats user names as case-sensitive. (CVE-2026-43513)\nAJP secret compared in non-constant time. (CVE-2026-43514)\nSecurity constraints not correctly applied. (CVE-2026-43515)\n","status":"published","published":"2026-05-15T06:17:07Z","modified":"2026-05-15T06:30:06.541303Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10925-1","title":"tomcat-9.0.118-1.1 on GA media","description":"These are all security issues fixed in the tomcat-9.0.118-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-01T00:00:00Z","modified":"2026-06-02T08:45:08.480762853Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:10926-1","title":"tomcat10-10.1.55-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.55-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-01T00:00:00Z","modified":"2026-06-02T08:45:08.412825881Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:10927-1","title":"tomcat11-11.0.22-1.1 on GA media","description":"These are all security issues fixed in the tomcat11-11.0.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-01T00:00:00Z","modified":"2026-06-02T08:45:08.570345426Z","updated_at":"2026-11-02T16:58:38.95195Z"}]},"sources_more":{"osv":11}}