{"id":"CVE-2026-43513","aliases":["ALSA-2026:68651","ALSA-2026:68660","ALSA-2026:68677","ALSA-2026:69259","BIT-tomcat-2026-43513","CLSA-2026-1779366607","CLSA-2026-1779374454","CLSA-2026-1779893247","CLSA-2026-1779957268","CLSA-2026-1779968889","CLSA-2026-1780649787","CLSA-2026-1782900813","CLSA-2026-1788550289","CLSA-2026-1792765354","CLSA-2026-1793727391","CLSA-2026-1793730417","CLSA-2026-1793863300","DEBIAN-CVE-2026-43513","EUVD-2026-29517","GHSA-5mp6-jrq3-r938","MGASA-2026-0139","OESA-2026-2296","RHSA-2026:39188","RHSA-2026:43401","RHSA-2026:44426","RHSA-2026:44427","RHSA-2026:67163","RHSA-2026:67164","RHSA-2026:68651","RHSA-2026:68659","RHSA-2026:68660","RHSA-2026:68677","RHSA-2026:68678","RHSA-2026:68679","RHSA-2026:68680","RHSA-2026:69259","RLSA-2026:68651","RLSA-2026:68660","RLSA-2026:68677","RLSA-2026:69259","SUSE-SU-2026:22195-1","SUSE-SU-2026:22196-1","SUSE-SU-2026:22197-1","SUSE-SU-2026:2299-1","SUSE-SU-2026:2374-1","SUSE-SU-2026:2377-1","SUSE-SU-2026:2675-1","UBUNTU-CVE-2026-43513","openSUSE-SU-2026:10925-1","openSUSE-SU-2026:10926-1","openSUSE-SU-2026:10927-1","openSUSE-SU-2026:21117-1","openSUSE-SU-2026:21121-1","openSUSE-SU-2026:21122-1"],"status":"published","title":"Apache Tomcat: LockOutRealm treats user names as case-sensitive","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00503,"percentile":0.43303,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-178"],"published":"2026-05-12T15:26:25Z","modified":"2026-11-05T13:15:03Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["9.0.118","10.1.55","11.0.22"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["9.0.118","10.1.55","11.0.22"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["9.0.118","10.1.55","11.0.22"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"tomcat","fixed_in":["10.1.55","11.0.22","9.0.118"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat10","fixed_in":["10.1.55-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat10","fixed_in":["10.1.55-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat10","fixed_in":["10.1.55-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat11","fixed_in":["11.0.22-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat11","fixed_in":["11.0.22-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat10","fixed_in":["0:10.1.57-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-admin-webapps","fixed_in":["0:10.1.57-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-common","fixed_in":["0:10.1.57-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-docs-webapp","fixed_in":["0:10.1.57-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-el-5.0-api","fixed_in":["0:10.1.57-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-jsp-3.1-api","fixed_in":["0:10.1.57-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-lib","fixed_in":["0:10.1.57-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-servlet-6.0-api","fixed_in":["0:10.1.57-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-user-instance","fixed_in":["0:10.1.57-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-webapps","fixed_in":["0:10.1.57-3.1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat11","fixed_in":["0:11.0.24-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-admin-webapps","fixed_in":["0:11.0.24-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-common","fixed_in":["0:11.0.24-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-docs-webapp","fixed_in":["0:11.0.24-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-el-6.0-api","fixed_in":["0:11.0.24-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-jsp-4.0-api","fixed_in":["0:11.0.24-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-lib","fixed_in":["0:11.0.24-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-servlet-6.1-api","fixed_in":["0:11.0.24-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-user-instance","fixed_in":["0:11.0.24-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-webapps","fixed_in":["0:11.0.24-0.2.hum1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat6","fixed_in":["6.0.39-1ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat7","fixed_in":["7.0.52-1ubuntu0.16+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","fixed_in":["7.0.68-1ubuntu0.4+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","fixed_in":["9.0.16-3ubuntu0.18.04.2+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tomcat9","fixed_in":["9.0.31-1ubuntu0.9+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","fixed_in":["9.0.58-1ubuntu0.2+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat10","fixed_in":["10.1.16-1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat9","fixed_in":["9.0.70-2ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"tomcat10","fixed_in":["10.1.40-1ubuntu1.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"tomcat9","fixed_in":["9.0.95-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"tomcat10","fixed_in":["10.1.40-1ubuntu1.26.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"tomcat9","fixed_in":["9.0.115-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.55"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.22"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.55"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.22"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.55"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.22"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2.alma.1"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2.alma.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Bitnami","package":"tomcat","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.1.55"},{"introduced":"11.0.0"},{"fixed":"11.0.22"},{"introduced":"9.0.0"},{"fixed":"9.0.118"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-el-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-jsvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.76-16.el7_9.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libtomcat9-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libtomcat9-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"tomcat9-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+tuxcare.els4"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libservlet3.0-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libservlet3.0-java-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libtomcat7-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat7-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+tuxcare.els8"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3.tuxcare.els7"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libtomcat9-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libtomcat9-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"tomcat9-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1~deb10u12+tuxcare.els5"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-embed-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.100-1ubuntu1~18.04.1+tuxcare.els3"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libservlet3.1-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libservlet3.1-java-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libtomcat8-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-examples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"tomcat8-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.32-1ubuntu1.13+tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.42"},{"fixed":"10.1.42-tuxcare.9"}]}],"versions":["10.1.42","10.1.42-tuxcare.1","10.1.42-tuxcare.2","10.1.42-tuxcare.3","10.1.42-tuxcare.4","10.1.42-tuxcare.5","10.1.42-tuxcare.6","10.1.42-tuxcare.7","10.1.42-tuxcare.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.42"},{"fixed":"10.1.42-tuxcare.9"}]}],"versions":["10.1.42","10.1.42-tuxcare.1","10.1.42-tuxcare.2","10.1.42-tuxcare.3","10.1.42-tuxcare.4","10.1.42-tuxcare.5","10.1.42-tuxcare.6","10.1.42-tuxcare.7","10.1.42-tuxcare.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.42"},{"fixed":"10.1.42-tuxcare.9"}]}],"versions":["10.1.42","10.1.42-tuxcare.1","10.1.42-tuxcare.2","10.1.42-tuxcare.3","10.1.42-tuxcare.4","10.1.42-tuxcare.5","10.1.42-tuxcare.6","10.1.42-tuxcare.7","10.1.42-tuxcare.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.50"},{"fixed":"10.1.50-tuxcare.2"}]}],"versions":["10.1.50","10.1.50-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.50"},{"fixed":"10.1.50-tuxcare.2"}]}],"versions":["10.1.50","10.1.50-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.50"},{"fixed":"10.1.50-tuxcare.2"}]}],"versions":["10.1.50","10.1.50-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.50"},{"fixed":"10.1.50-tuxcare.2"}]}],"versions":["10.1.50","10.1.50-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote-ffm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.50"},{"fixed":"10.1.50-tuxcare.2"}]}],"versions":["10.1.50","10.1.50-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.50"},{"fixed":"10.1.50-tuxcare.2"}]}],"versions":["10.1.50","10.1.50-tuxcare.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.3"}]}],"versions":["10.1.33","10.1.33-tuxcare.1","10.1.33-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.3"}]}],"versions":["10.1.33","10.1.33-tuxcare.1","10.1.33-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.3"}]}],"versions":["10.1.33","10.1.33-tuxcare.1","10.1.33-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.3"}]}],"versions":["10.1.33","10.1.33-tuxcare.1","10.1.33-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.3"}]}],"versions":["10.1.33","10.1.33-tuxcare.1","10.1.33-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.10"}]}],"versions":["10.1.18","10.1.18-tuxcare.1","10.1.18-tuxcare.2","10.1.18-tuxcare.3","10.1.18-tuxcare.4","10.1.18-tuxcare.5","10.1.18-tuxcare.6","10.1.18-tuxcare.7","10.1.18-tuxcare.8","10.1.18-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.10"}]}],"versions":["10.1.18","10.1.18-tuxcare.1","10.1.18-tuxcare.2","10.1.18-tuxcare.3","10.1.18-tuxcare.4","10.1.18-tuxcare.5","10.1.18-tuxcare.6","10.1.18-tuxcare.7","10.1.18-tuxcare.8","10.1.18-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.10"}]}],"versions":["10.1.18","10.1.18-tuxcare.1","10.1.18-tuxcare.2","10.1.18-tuxcare.3","10.1.18-tuxcare.4","10.1.18-tuxcare.5","10.1.18-tuxcare.6","10.1.18-tuxcare.7","10.1.18-tuxcare.8","10.1.18-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.10"}]}],"versions":["10.1.18","10.1.18-tuxcare.1","10.1.18-tuxcare.2","10.1.18-tuxcare.3","10.1.18-tuxcare.4","10.1.18-tuxcare.5","10.1.18-tuxcare.6","10.1.18-tuxcare.7","10.1.18-tuxcare.8","10.1.18-tuxcare.9"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.16"},{"fixed":"10.1.16-tuxcare.2"}]}],"versions":["10.1.16","10.1.16-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.16"},{"fixed":"10.1.16-tuxcare.2"}]}],"versions":["10.1.16","10.1.16-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.16"},{"fixed":"10.1.16-tuxcare.2"}]}],"versions":["10.1.16","10.1.16-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.16"},{"fixed":"10.1.16-tuxcare.2"}]}],"versions":["10.1.16","10.1.16-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.16"},{"fixed":"10.1.16-tuxcare.2"}]}],"versions":["10.1.16","10.1.16-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-1~deb12u1"}]}],"versions":["10.1.10-1","10.1.13-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.20-1","10.1.23-1","10.1.25-1","10.1.25-1~bpo12+1","10.1.25-2","10.1.30-1","10.1.30-1~bpo12+1","10.1.31-1","10.1.33-1","10.1.33-1~bpo12+1","10.1.34-0+deb12u1","10.1.34-0+deb12u2","10.1.34-1","10.1.35-1","10.1.40-1","10.1.40-1~bpo12+1","10.1.46-1","10.1.52-1","10.1.52-1~deb12u1","10.1.52-1~deb13u1","10.1.52-2","10.1.54-1","10.1.6-1","10.1.6-1+deb12u1","10.1.6-1+deb12u2","10.1.7-1","10.1.8-1","10.1.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-1~deb13u1"}]}],"versions":["10.1.40-1","10.1.46-1","10.1.52-1","10.1.52-1~deb12u1","10.1.52-1~deb13u1","10.1.52-2","10.1.54-1","10.1.55-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-1"}]}],"versions":["10.1.40-1","10.1.46-1","10.1.52-1","10.1.52-1~deb12u1","10.1.52-1~deb13u1","10.1.52-2","10.1.54-1","10.1.55-1~deb12u1","10.1.55-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-1~deb13u1"}]}],"versions":["11.0.11-1","11.0.15-1","11.0.15-1~deb13u1","11.0.18-1","11.0.21-1","11.0.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-1"}]}],"versions":["11.0.11-1","11.0.15-1","11.0.15-1~deb13u1","11.0.18-1","11.0.21-1","11.0.22-1~deb13u1","11.0.6-1"]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118"}]}],"versions":["7.0.0","7.0.100","7.0.103","7.0.104","7.0.105","7.0.106","7.0.107","7.0.108","7.0.109","7.0.11","7.0.12","7.0.14","7.0.16","7.0.19","7.0.2","7.0.20","7.0.21","7.0.22","7.0.23","7.0.25","7.0.26","7.0.27","7.0.28","7.0.29","7.0.30","7.0.32","7.0.33","7.0.34","7.0.35","7.0.37","7.0.39","7.0.4","7.0.40","7.0.41","7.0.42","7.0.47","7.0.5","7.0.50","7.0.52","7.0.53","7.0.54","7.0.55","7.0.56","7.0.57","7.0.59","7.0.6","7.0.61","7.0.62","7.0.63","7.0.64","7.0.65","7.0.67","7.0.68","7.0.69","7.0.70","7.0.72","7.0.73","7.0.75","7.0.76","7.0.77","7.0.78","7.0.79","7.0.8","7.0.81","7.0.82","7.0.84","7.0.85","7.0.86","7.0.88","7.0.90","7.0.91","7.0.92","7.0.93","7.0.94","7.0.96","7.0.99","8.0.0-RC1","8.0.0-RC10","8.0.0-RC3","8.0.0-RC5","8.0.1","8.0.11","8.0.12","8.0.14","8.0.15","8.0.17","8.0.18","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.32","8.0.33","8.0.35","8.0.36","8.0.37","8.0.38","8.0.39","8.0.41","8.0.42","8.0.43","8.0.44","8.0.45","8.0.46","8.0.47","8.0.48","8.0.49","8.0.5","8.0.50","8.0.51","8.0.52","8.0.53","8.0.8","8.0.9","8.5.0","8.5.100","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98","8.5.99","9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.100","9.0.102","9.0.104","9.0.105","9.0.106","9.0.107","9.0.108","9.0.109","9.0.11","9.0.110","9.0.111","9.0.112","9.0.113","9.0.115","9.0.116","9.0.117","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85","9.0.86","9.0.87","9.0.88","9.0.89","9.0.90","9.0.91","9.0.93","9.0.94","9.0.95","9.0.96","9.0.97","9.0.98","9.0.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.55"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.19","10.1.2","10.1.20","10.1.23","10.1.24","10.1.25","10.1.26","10.1.28","10.1.29","10.1.30","10.1.31","10.1.33","10.1.34","10.1.35","10.1.36","10.1.39","10.1.4","10.1.40","10.1.41","10.1.42","10.1.43","10.1.44","10.1.45","10.1.46","10.1.47","10.1.48","10.1.49","10.1.5","10.1.50","10.1.52","10.1.53","10.1.54","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.22"}]}],"versions":["11.0.0","11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M17","11.0.0-M18","11.0.0-M19","11.0.0-M20","11.0.0-M21","11.0.0-M22","11.0.0-M24","11.0.0-M25","11.0.0-M26","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.18","11.0.2","11.0.20","11.0.21","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118"}]}],"versions":["7.0.100","7.0.103","7.0.104","7.0.105","7.0.106","7.0.107","7.0.108","7.0.109","7.0.35","7.0.37","7.0.39","7.0.40","7.0.41","7.0.42","7.0.47","7.0.50","7.0.52","7.0.53","7.0.54","7.0.55","7.0.56","7.0.57","7.0.59","7.0.61","7.0.62","7.0.63","7.0.64","7.0.65","7.0.67","7.0.68","7.0.69","7.0.70","7.0.72","7.0.73","7.0.75","7.0.76","7.0.77","7.0.78","7.0.79","7.0.81","7.0.82","7.0.84","7.0.85","7.0.86","7.0.88","7.0.90","7.0.91","7.0.92","7.0.93","7.0.94","7.0.96","7.0.99","8.0.0-RC1","8.0.0-RC10","8.0.0-RC3","8.0.0-RC5","8.0.1","8.0.11","8.0.12","8.0.14","8.0.15","8.0.17","8.0.18","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.32","8.0.33","8.0.35","8.0.36","8.0.37","8.0.38","8.0.39","8.0.41","8.0.42","8.0.43","8.0.44","8.0.45","8.0.46","8.0.47","8.0.48","8.0.49","8.0.5","8.0.50","8.0.51","8.0.52","8.0.53","8.0.8","8.0.9","8.5.0","8.5.100","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98","8.5.99","9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.100","9.0.102","9.0.104","9.0.105","9.0.106","9.0.107","9.0.108","9.0.109","9.0.11","9.0.110","9.0.111","9.0.112","9.0.113","9.0.115","9.0.116","9.0.117","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85","9.0.86","9.0.87","9.0.88","9.0.89","9.0.90","9.0.91","9.0.93","9.0.94","9.0.95","9.0.96","9.0.97","9.0.98","9.0.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.55"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.19","10.1.2","10.1.20","10.1.23","10.1.24","10.1.25","10.1.26","10.1.28","10.1.29","10.1.30","10.1.31","10.1.33","10.1.34","10.1.35","10.1.36","10.1.39","10.1.4","10.1.40","10.1.41","10.1.42","10.1.43","10.1.44","10.1.45","10.1.46","10.1.47","10.1.48","10.1.49","10.1.5","10.1.50","10.1.52","10.1.53","10.1.54","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.22"}]}],"versions":["11.0.0","11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M17","11.0.0-M18","11.0.0-M19","11.0.0-M20","11.0.0-M21","11.0.0-M22","11.0.0-M24","11.0.0-M25","11.0.0-M26","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.18","11.0.2","11.0.20","11.0.21","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118"}]}],"versions":["7.0.0","7.0.100","7.0.103","7.0.104","7.0.105","7.0.106","7.0.107","7.0.108","7.0.109","7.0.11","7.0.12","7.0.14","7.0.16","7.0.19","7.0.2","7.0.20","7.0.21","7.0.22","7.0.23","7.0.25","7.0.26","7.0.27","7.0.28","7.0.29","7.0.30","7.0.32","7.0.33","7.0.34","7.0.35","7.0.37","7.0.39","7.0.4","7.0.40","7.0.41","7.0.42","7.0.47","7.0.5","7.0.50","7.0.52","7.0.53","7.0.54","7.0.55","7.0.56","7.0.57","7.0.59","7.0.6","7.0.61","7.0.62","7.0.63","7.0.64","7.0.65","7.0.67","7.0.68","7.0.69","7.0.70","7.0.72","7.0.73","7.0.75","7.0.76","7.0.77","7.0.78","7.0.79","7.0.8","7.0.81","7.0.82","7.0.84","7.0.85","7.0.86","7.0.88","7.0.90","7.0.91","7.0.92","7.0.93","7.0.94","7.0.96","7.0.99","8.0.0-RC1","8.0.0-RC10","8.0.0-RC3","8.0.0-RC5","8.0.1","8.0.11","8.0.12","8.0.14","8.0.15","8.0.17","8.0.18","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.32","8.0.33","8.0.35","8.0.36","8.0.37","8.0.38","8.0.39","8.0.41","8.0.42","8.0.43","8.0.44","8.0.45","8.0.46","8.0.47","8.0.48","8.0.49","8.0.5","8.0.50","8.0.51","8.0.52","8.0.53","8.0.8","8.0.9","8.5.0","8.5.100","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98","8.5.99","9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.100","9.0.102","9.0.104","9.0.105","9.0.106","9.0.107","9.0.108","9.0.109","9.0.11","9.0.110","9.0.111","9.0.112","9.0.113","9.0.115","9.0.116","9.0.117","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85","9.0.86","9.0.87","9.0.88","9.0.89","9.0.90","9.0.91","9.0.93","9.0.94","9.0.95","9.0.96","9.0.97","9.0.98","9.0.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.55"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.19","10.1.2","10.1.20","10.1.23","10.1.24","10.1.25","10.1.26","10.1.28","10.1.29","10.1.30","10.1.31","10.1.33","10.1.34","10.1.35","10.1.36","10.1.39","10.1.4","10.1.40","10.1.41","10.1.42","10.1.43","10.1.44","10.1.45","10.1.46","10.1.47","10.1.48","10.1.49","10.1.5","10.1.50","10.1.52","10.1.53","10.1.54","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.22"}]}],"versions":["11.0.0","11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M17","11.0.0-M18","11.0.0-M19","11.0.0-M20","11.0.0-M21","11.0.0-M22","11.0.0-M24","11.0.0-M25","11.0.0-M26","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.18","11.0.2","11.0.20","11.0.21","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Mageia:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.mga9"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.oe2403sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.oe2403sp1"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.oe2403sp3"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.oe2003sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.oe2203sp4"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el10","package":"jws7-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el10jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el8","package":"jws7-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el8jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:7.0::el9","package":"jws7-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.21-5.redhat_00004.1.el9jws"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el10","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el10jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el8","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el8jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.2::el9","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.49-15.redhat_00013.1.el9jws"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.57-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.57-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.57-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.57-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.57-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.57-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.57-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.57-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-user-instance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.57-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat10-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.57-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.24-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.24-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.24-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.24-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-el-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.24-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-jsp-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.24-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.24-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-servlet-6.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.24-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-user-instance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.24-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"tomcat11-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.0.24-0.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_0"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-1.el10_0"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_6"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_2"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el9_4"}]}],"bundled":30},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_8"}]}],"bundled":29},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-2.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.120-1.el8_10"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.49-4.el10_2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-150600.13.21.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-150600.13.21.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-150600.13.21.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-150200.5.67.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-150200.108.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.39-1ubuntu0.1+esm3"}]}],"versions":["6.0.37-1","6.0.39-1","6.0.39-1ubuntu0.1","6.0.39-1ubuntu0.1+esm1","6.0.39-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.52-1ubuntu0.16+esm2"}]}],"versions":["7.0.42-1","7.0.47-1","7.0.50-1","7.0.52-1","7.0.52-1ubuntu0.1","7.0.52-1ubuntu0.3","7.0.52-1ubuntu0.6","7.0.52-1ubuntu0.7","7.0.52-1ubuntu0.8","7.0.52-1ubuntu0.9","7.0.52-1ubuntu0.10","7.0.52-1ubuntu0.11","7.0.52-1ubuntu0.13","7.0.52-1ubuntu0.14","7.0.52-1ubuntu0.15","7.0.52-1ubuntu0.16","7.0.52-1ubuntu0.16+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.26-1","8.0.28-1","8.0.30-1","8.0.32-1","8.0.32-1ubuntu1","8.0.32-1ubuntu1.1","8.0.32-1ubuntu1.2","8.0.32-1ubuntu1.3","8.0.32-1ubuntu1.4","8.0.32-1ubuntu1.5","8.0.32-1ubuntu1.6","8.0.32-1ubuntu1.7","8.0.32-1ubuntu1.8","8.0.32-1ubuntu1.9","8.0.32-1ubuntu1.10","8.0.32-1ubuntu1.11","8.0.32-1ubuntu1.13","8.0.32-1ubuntu1.13+esm1","8.0.32-1ubuntu1.13+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.68-1ubuntu0.4+esm4"}]}],"versions":["7.0.64-1","7.0.68-1","7.0.68-1ubuntu0.1","7.0.68-1ubuntu0.3","7.0.68-1ubuntu0.4","7.0.68-1ubuntu0.4+esm1","7.0.68-1ubuntu0.4+esm2","7.0.68-1ubuntu0.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.5.21-1ubuntu1","8.5.29-1","8.5.30-1","8.5.30-1ubuntu1","8.5.30-1ubuntu1.2","8.5.30-1ubuntu1.3","8.5.30-1ubuntu1.4","8.5.39-1ubuntu1~18.04.1","8.5.39-1ubuntu1~18.04.2","8.5.39-1ubuntu1~18.04.3","8.5.39-1ubuntu1~18.04.3+esm1","8.5.39-1ubuntu1~18.04.3+esm2","8.5.39-1ubuntu1~18.04.3+esm3","8.5.39-1ubuntu1~18.04.3+esm4","8.5.39-1ubuntu1~18.04.3+esm5","8.5.39-1ubuntu1~18.04.3+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.16-3ubuntu0.18.04.2+esm8"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1","9.0.16-3ubuntu0.18.04.2+esm2","9.0.16-3ubuntu0.18.04.2+esm3","9.0.16-3ubuntu0.18.04.2+esm4","9.0.16-3ubuntu0.18.04.2+esm5","9.0.16-3ubuntu0.18.04.2+esm6","9.0.16-3ubuntu0.18.04.2+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.31-1ubuntu0.9+esm3"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1","9.0.31-1ubuntu0.2","9.0.31-1ubuntu0.3","9.0.31-1ubuntu0.4","9.0.31-1ubuntu0.5","9.0.31-1ubuntu0.6","9.0.31-1ubuntu0.7","9.0.31-1ubuntu0.8","9.0.31-1ubuntu0.9","9.0.31-1ubuntu0.9+esm1","9.0.31-1ubuntu0.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.58-1ubuntu0.2+esm4"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1","9.0.58-1ubuntu0.1+esm2","9.0.58-1ubuntu0.1+esm3","9.0.58-1ubuntu0.1+esm4","9.0.58-1ubuntu0.2","9.0.58-1ubuntu0.2+esm1","9.0.58-1ubuntu0.2+esm2","9.0.58-1ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.16-1ubuntu0.1~esm4"}]}],"versions":["10.1.10-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.16-1ubuntu0.1~esm1","10.1.16-1ubuntu0.1~esm2","10.1.16-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2ubuntu0.1+esm3"}]}],"versions":["9.0.70-1ubuntu1","9.0.70-2","9.0.70-2ubuntu0.1","9.0.70-2ubuntu0.1+esm1","9.0.70-2ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.40-1ubuntu1.25.10.1"}]}],"versions":["10.1.35-1","10.1.40-1","10.1.40-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.95-1ubuntu1.1"}]}],"versions":["9.0.70-2ubuntu1.1","9.0.70-2ubuntu2","9.0.70-2ubuntu3","9.0.95-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.40-1ubuntu1.26.04.1"}]}],"versions":["10.1.40-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-1ubuntu0.1"}]}],"versions":["9.0.95-1ubuntu1","9.0.111-1","9.0.115-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.6-1","11.0.11-1","11.0.15-1","11.0.18-1","11.0.18-1ubuntu0.1~esm1","11.0.22-2ubuntu2~26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.118-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.22-160000.1.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.55-160000.1.1"}]}],"bundled":7}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"}],"references":[{"url":"https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/12/9","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43513","tags":["web","advisory"]},{"url":"https://github.com/apache/tomcat/commit/4a90d3fa93988c447cd5bb7482f76ff70d7f15c2","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/6dd75beb55bd42fc5f78e929596b25018cd17717","tags":["web"]},{"url":"https://github.com/apache/tomcat/commit/83f3e51df7b87f5f6e626951c575ded1a512e8ef","tags":["web"]},{"url":"https://tomcat.apache.org/security-10.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-11.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5mp6-jrq3-r938"},{"url":"https://access.redhat.com/errata/RHSA-2026:68651","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32990","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41293","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42498","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43512","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43513","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43515","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59083","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59084","tags":["report"]},{"url":"https://bugzilla.redhat.com/2457025","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476511","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476513","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476516","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476519","tags":["report"]},{"url":"https://bugzilla.redhat.com/2476520","tags":["report"]},{"url":"https://bugzilla.redhat.com/2499917","tags":["report"]},{"url":"https://bugzilla.redhat.com/2499931","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-68651.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-41284.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-43514.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-50229.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-53404.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-53434.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-55276.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-55955.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-55956.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68660","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-68660.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68677","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55957","tags":["report"]},{"url":"https://bugzilla.redhat.com/2494669","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-68677.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2024-52316.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2024-54677.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-46701.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-55668.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-55754.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-61795.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2025-66614.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-24733.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-24880.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-25854.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-29145.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-34483.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2026-34487.html","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69259","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-69259.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1779366607.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1779374454.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1779893247.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779957268.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55668","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41293","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42498","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43512","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43514","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43515","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1779968889.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1780649787.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1782900813.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43513.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-43513","tags":["advisory"]},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0139.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35523","tags":["report"]},{"url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.118","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/8","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/9","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/10","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/11","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/12","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/13","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/12/14","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2296","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39188","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/7.0/html/red_hat_jboss_web_server_7.0_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457027","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476511","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476512","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476513","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476516","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2476520","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494676","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39188.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-29146","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-29146","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29146","tags":["advisory"]},{"url":"https://lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34486","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34486","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34486","tags":["advisory"]},{"url":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41284","tags":["advisory"]},{"url":"https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41293","tags":["advisory"]},{"url":"https://lists.apache.org/thread/qwg0q16z7xkb2qrr853wdll5531mvl1r","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42498","tags":["advisory"]},{"url":"https://lists.apache.org/thread/n61zwf75jrv09rz90j4jssncm244bwdb","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43512","tags":["advisory"]},{"url":"https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43513","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43514","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43514","tags":["advisory"]},{"url":"https://lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43515","tags":["advisory"]},{"url":"https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55956","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55956","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55956","tags":["advisory"]},{"url":"https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43401","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.2/html/red_hat_jboss_web_server_6.2_service_pack_4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494681","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43401.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53404","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53404","tags":["advisory"]},{"url":"https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44426","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_44426.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44427","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_44427.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67163","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457025","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494669","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499917","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499931","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67163.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-34750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295651","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-34750","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34750","tags":["advisory"]},{"url":"https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-38286","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2314686","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-38286","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38286","tags":["advisory"]},{"url":"https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-46701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2369253","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-46701","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46701","tags":["advisory"]},{"url":"https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55668","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2388226","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55668","tags":["advisory"]},{"url":"https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6","tags":["article"]},{"url":"https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21","tags":["article"]},{"url":"https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95","tags":["article"]},{"url":"https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55754","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2406590","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55754","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55754","tags":["advisory"]},{"url":"https://github.com/apache/tomcat/commit/5a3db092982c0c58d4855304167ee757fe5e79bb","tags":["article"]},{"url":"https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-61795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2406588","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61795","tags":["advisory"]},{"url":"https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06","tags":["article"]},{"url":"https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160pp","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-66614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2440430","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66614","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66614","tags":["advisory"]},{"url":"https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24733","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2440437","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24733","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24733","tags":["advisory"]},{"url":"https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-24880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-24880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24880","tags":["advisory"]},{"url":"https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-25854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457039","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25854","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25854","tags":["advisory"]},{"url":"https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-29145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-29145","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29145","tags":["advisory"]},{"url":"https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32990","tags":["advisory"]},{"url":"https://lists.apache.org/thread/1nl9zqft0ksqlhlkd3j4obyjz1ghoyn7","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34483","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457044","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34483","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34483","tags":["advisory"]},{"url":"https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34487","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457038","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34487","tags":["advisory"]},{"url":"https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494688","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50229","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50229","tags":["advisory"]},{"url":"https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-53434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494668","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-53434","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53434","tags":["advisory"]},{"url":"https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55276","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494675","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55276","tags":["advisory"]},{"url":"https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-55955","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55955","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55955","tags":["advisory"]},{"url":"https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55957","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55957","tags":["advisory"]},{"url":"https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59083","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59083","tags":["advisory"]},{"url":"https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59084","tags":["advisory"]},{"url":"https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67164","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67164.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68651.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68659","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68659.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52316","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326972","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52316","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52316","tags":["advisory"]},{"url":"https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-54677","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2332815","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-54677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-54677","tags":["advisory"]},{"url":"https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68660.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68677.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68678","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68678.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68679","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68679.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68680","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68680.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69259.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:68651","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:68660","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:68677","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:69259","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622195-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1265145","tags":["report"]},{"url":"https://bugzilla.suse.com/1265162","tags":["report"]},{"url":"https://bugzilla.suse.com/1265163","tags":["report"]},{"url":"https://bugzilla.suse.com/1265165","tags":["report"]},{"url":"https://bugzilla.suse.com/1265166","tags":["report"]},{"url":"https://bugzilla.suse.com/1265167","tags":["report"]},{"url":"https://bugzilla.suse.com/1265168","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43515","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622196-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622197-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262299-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262374-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262377-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262675-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-43513","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8383-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8417-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-43513","title":"Apache Tomcat: LockOutRealm treats user names as case-sensitive","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T15:26:25.599Z","modified":"2026-05-14T19:53:30.781Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T13:37:25.103021Z"}],"euvd":[{"id":"EUVD-2026-29517","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T15:26:25Z","modified":"2026-05-14T19:53:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:04:30.595644Z"}],"ghsa":[{"id":"GHSA-5mp6-jrq3-r938","title":"Apache Tomcat: LockOutRealm treats user names as case-sensitive","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T18:30:38Z","modified":"2026-05-18T20:31:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T14:40:12.430932Z"}],"nvd":[{"id":"CVE-2026-43513","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T16:16:18.177Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T14:12:18.613259Z"}],"osv":[{"id":"CVE-2026-43513","title":"Apache Tomcat: LockOutRealm treats user names as case-sensitive","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T15:26:25.599Z","modified":"2026-10-28T02:30:39.45162076Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T15:45:04.479642Z"},{"id":"DEBIAN-CVE-2026-43513","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.  This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected.  Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T16:16:18.177Z","modified":"2026-10-27T09:47:39.519628125Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-5mp6-jrq3-r938","title":"Apache Tomcat: LockOutRealm treats user names as case-sensitive","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T18:30:38Z","modified":"2026-09-11T08:25:26.202863452Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-178"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"OESA-2026-2296","title":"tomcat security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nAllocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117.\nOlder, unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.(CVE-2026-41284)\n\nImproper Input Validation vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 10.0.0-M1 through 10.0.27.\nOlder, end of support versions may also be affected.\n\nUsers are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.(CVE-2026-41293)\n\nExposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.2 through 9.0.117, from 8.5.24 through 8.5.100, from 7.0.83 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118, which fix the issue.(CVE-2026-42498)\n\nDEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0.\nOlder unsupported versions any also be affect\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.(CVE-2026-43512)\n\nImproper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.(CVE-2026-43513)\n\nObservable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.(CVE-2026-43514)\n\nImproper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.(CVE-2026-43515)","status":"published","published":"2026-05-15T11:11:16Z","modified":"2026-08-18T01:19:53.405745121Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"RHSA-2026:39188","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.0 security release","status":"published","published":"2026-07-18T10:11:26Z","modified":"2026-10-17T10:13:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:43401","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.4 release and security update","status":"published","published":"2026-07-23T10:14:25Z","modified":"2026-10-17T10:14:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:44426","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-12T10:14:40Z","modified":"2026-10-06T10:31:27.879150772Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:44427","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-12T10:14:41Z","modified":"2026-10-06T10:31:35.712441733Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:67163","title":"Red Hat Security Advisory: tomcat9 security update","status":"published","published":"2026-09-14T10:10:22Z","modified":"2026-10-17T10:18:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67164","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2026-09-14T10:10:22Z","modified":"2026-10-17T10:18:05Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68651","title":"Red Hat Security Advisory: tomcat9 security update","status":"published","published":"2026-09-19T10:14:10Z","modified":"2026-10-17T10:18:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68659","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2026-09-18T10:15:27Z","modified":"2026-10-17T10:18:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68660","title":"Red Hat Security Advisory: tomcat security, bug fix, and enhancement update","status":"published","published":"2026-09-18T10:15:28Z","modified":"2026-10-17T10:18:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68677","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2026-09-18T10:15:29Z","modified":"2026-10-17T10:18:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68678","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2026-09-18T10:15:29Z","modified":"2026-10-17T10:18:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68679","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2026-09-18T10:15:30Z","modified":"2026-10-17T10:18:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:68680","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2026-09-18T10:15:31Z","modified":"2026-10-17T10:18:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69259","title":"Red Hat Security Advisory: tomcat update","status":"published","published":"2026-09-22T10:19:51Z","modified":"2026-10-17T10:18:50Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:68651","title":"Moderate: tomcat9 security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.\n\nSecurity Fix(es):\n\n* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n\n* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n\n* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n\n* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n\n* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n\n* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n\n* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n\n* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-19T12:09:22.893412Z","modified":"2026-09-19T12:30:02.57579679Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:68660","title":"Moderate: tomcat security, bug fix, and enhancement update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n\n* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n\n* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n\n* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n\n* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n\n* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n\n* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n\n* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\nBug Fix(es) and Enhancement(s):\n\n* Tomcat fails to respond to client connections when using Java 8 [rhel-9.8] (JIRA:Rocky Linux-257456)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-19T12:04:58.550496Z","modified":"2026-09-19T12:30:02.573355431Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:68677","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n\n* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n\n* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n\n* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n\n* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n\n* tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)\n\n* tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n\n* tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-19T06:01:33.521772Z","modified":"2026-09-19T06:30:02.60709599Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:69259","title":"Moderate: tomcat update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n\n* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n\n* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n\n* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498)\n\n* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n\n* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-22T12:08:07.529031Z","modified":"2026-09-22T12:30:02.644996484Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-43513","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-05-12T16:16:00Z","modified":"2026-07-15T19:46:01.302990351Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:22.075798Z"},{"id":"ALSA-2026:68651","title":"Moderate: tomcat9 security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.  \n\nSecurity Fix(es):  \n\n  * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n  * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n  * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n  * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n  * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n  * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n  * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n  * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-10-29T11:42:24.762833197Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:68660","title":"Moderate: tomcat security, bug fix, and enhancement update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n  * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n  * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n  * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n  * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n  * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n  * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n  * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Tomcat fails to respond to client connections when using Java 8 [almalinux-9.8] (JIRA:AlmaLinux-257456)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-10-29T11:42:26.054533103Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:68677","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n  * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n  * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication. (CVE-2026-42498)\n  * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n  * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n  * tomcat: Apache Tomcat: Authentication bypass via missing critical step in JNDIRealm GSSAPI configuration (CVE-2026-55957)\n  * tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)\n  * tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations (CVE-2026-59084)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-17T00:00:00Z","modified":"2026-10-29T11:12:09.199968453Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:69259","title":"Moderate: tomcat update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990)\n  * tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)\n  * tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)\n  * tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498)\n  * tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)\n  * tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-10-29T11:42:22.37381471Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"BIT-tomcat-2026-43513","title":"Apache Tomcat: LockOutRealm treats user names as case-sensitive","description":"Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0 through 11.0.21, from 10.1.0 through 10.1.54, from 9.0.0 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\nOlder unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.","status":"published","published":"2026-09-11T05:58:12.683Z","modified":"2026-09-11T08:25:26.202863452Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2026-1779366607","title":"tomcat: Fix of 4 CVEs","description":"- CVE-2026-43514: fix observable timing discrepancy when comparing AJP secret (Low)\n- CVE-2026-43512: fix authentication bypass in DIGEST authentication when password is null (Moderate)\n- CVE-2026-43515: fix improper authorization when multiple method constraints apply to the same extension pattern (Moderate)\n- CVE-2026-43513: fix LockOutRealm bypass via case-variant usernames against case-insensitive realms (Low)","status":"published","published":"2026-05-21T15:42:09Z","modified":"2026-10-26T09:43:50.886657883Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779374454","title":"Fix of 7 CVEs","description":"   * SECURITY UPDATE: multiple security fixes\n     - debian/patches/CVE-2026-41284.patch: add a configurable\n       maxRequestBodySize init-param to the WebDAV servlet to bound\n       LOCK/PROPFIND XML request bodies; reject oversized bodies with\n       413 Request Entity Too Long. Includes the upstream\n       BoundedByteArrayOutputStream helper and associated tests\n     - CVE-2026-41284\n     - debian/patches/CVE-2026-41293.patch: filter invalid HTTP/2 header\n       names in HpackDecoder / HPackHuffman / Stream / Http2Parser using\n       a new HttpParser.isToken-based check; folds upstream follow-up\n       (HttpParser i\u003e32 hex/decimal fix, additional LocalStrings keys,\n       HpackHuffman field-name branch simplification) and ships the new\n       TestHPackHuffman / TestHttp2Section_8_2 tests.\n     - debian/patches/CVE-2026-41293-tests.patch: adapt\n       TestHttp2Section_8_2 to the 9.0.31 readFrame(boolean) signature\n     - CVE-2026-41293\n     - debian/patches/CVE-2026-42498.patch: strip Authorization and\n       Proxy-Authorization headers from WebSocket client userProperties\n       after the proxy CONNECT, HTTP redirect, and successful upgrade\n       paths so credentials are not leaked to redirect or proxy targets\n     - CVE-2026-42498\n     - debian/patches/CVE-2026-43512.patch: fix DIGEST authentication\n       handling of unknown users and users with a null password so they\n       cannot authenticate; adds regression tests to\n       TestDigestAuthenticator\n     - CVE-2026-43512\n     - debian/patches/CVE-2026-43513.patch: add caseSensitive attribute\n       to LockOutRealm and route usernames through a null-safe\n       normalizeUsername helper so case-insensitive realms cannot be\n       brute-forced by varying the case of the username. Folds the\n       upstream Coverity NPE follow-up and adds the new TestLockoutRealm\n       JUnit tests\n     - CVE-2026-43513\n     - debian/patches/CVE-2026-43514.patch: switch the AJP secret\n       comparison in AjpProcessor to a constant-time comparison using\n       the new ConstantTime utility; includes the upstream\n       ByteChunk start-offset follow-up\n     - CVE-2026-43514\n     - debian/patches/CVE-2026-43515.patch: ensure RealmBase finds all\n       matching extension-based security constraints by moving the match\n       bookkeeping inside the inner extension-pattern loop; adds the\n       upstream TestRealmBase.testUncoveredMethods regression test and\n       a TesterRequest.getRequestPathMB() helper\n     - CVE-2026-43515","status":"published","published":"2026-05-21T14:41:06Z","modified":"2026-06-04T10:03:59.659545Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779893247","title":"Fix of 5 CVEs","description":"   * SECURITY UPDATE: add case sensitive attribute to LockOutRealm\n     - debian/patches/CVE-2026-43513.patch: add case sensitive attribute to LockOutRealm\n     - CVE-2026-43513\n   * SECURITY UPDATE: fix the handling of invalid users with DIGEST authentication\n     - debian/patches/CVE-2026-43512.patch: fix the handling of invalid users with DIGEST authentication\n     - CVE-2026-43512\n   * SECURITY UPDATE: switch AJP secret comparison to a constant time algorithm\n     - debian/patches/CVE-2026-43514.patch: switch AJP secret comparison to a constant time algorithm\n     - CVE-2026-43514\n   * SECURITY UPDATE: ensure RealmBase finds all matching extension based constraints\n     - debian/patches/CVE-2026-43515.patch: ensure RealmBase finds all matching extension based constraints\n     - CVE-2026-43515\n   * SECURITY UPDATE: add a configurable limit for WebDAV XML request bodies\n     - debian/patches/CVE-2026-41284.patch: add a configurable limit for WebDAV XML request bodies\n     - CVE-2026-41284","status":"published","published":"2026-05-27T14:47:32Z","modified":"2026-06-04T10:04:24.274977925Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779957268","title":"tomcat: Fix of 8 CVEs","description":"- CVE-2026-43512: fix the handling of invalid users with DIGEST authentication\n- CVE-2026-43513: add case sensitive attribute to LockOutRealm\n- CVE-2026-43514: switch AJP secret comparison to a constant time algorithm\n- CVE-2026-43515: ensure RealmBase finds all matching extension based constraints\n- CVE-2026-41284: add a configurable limit for WebDAV XML request bodies\n- CVE-2026-42498: fix WebSocket + proxy + DIGEST auth on proxy\n- CVE-2026-41293: HTTP/2 header filtering — validate decoded HPACK names/values\n  against RFC 7230 token/field-vchar/field-content rules","status":"published","published":"2026-06-01T10:19:02Z","modified":"2026-10-26T09:43:43.38665348Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1779968889","title":"Fix of 7 CVEs","description":"   * SECURITY UPDATE: Authentication Bypass in digest authentication\n     - debian/patches/CVE-2026-43512.patch: reject digest authentication\n       attempts for unknown users in getDigest()\n     - CVE-2026-43512\n   * SECURITY UPDATE: Account lockout bypass in LockOutRealm via case\n     variation of user names\n     - debian/patches/CVE-2026-43513.patch: add a caseSensitive attribute\n       to LockOutRealm and treat user names case-insensitively by default\n     - CVE-2026-43513\n   * SECURITY UPDATE: Observable timing discrepancy in AJP secret comparison\n     - debian/patches/CVE-2026-43514.patch: add ConstantTime helper and\n       switch the AJP secret comparison to a constant time algorithm\n     - CVE-2026-43514\n   * SECURITY UPDATE: Improper authorisation when multiple method\n     constraints define an HTTP method for the same extension\n     - debian/patches/CVE-2026-43515.patch: evaluate findMethod() against\n       every matching SecurityCollection rather than only the last one\n     - CVE-2026-43515\n   * SECURITY UPDATE: Exposure of HTTP authorisation header to unexpected\n     hosts during WebSocket authentication\n     - debian/patches/CVE-2026-42498.patch: drop the cached Authorization\n       header from userProperties before following a WebSocket upgrade\n       redirect so it is not sent to the host named in Location\n     - CVE-2026-42498\n   * SECURITY UPDATE: HTTP/2 header values were not validated for control\n     characters and other illegal bytes\n     - debian/patches/CVE-2026-41293.patch: validate field names and values\n       in HpackDecoder and HPackHuffman using the new HttpParser\n       isFieldVChar / isFieldContent tables\n     - CVE-2026-41293\n   * SECURITY UPDATE: Allocation of resources without limits in WebDAV\n     LOCK and PROPFIND request bodies\n     - debian/patches/CVE-2026-41284.patch: read PROPFIND and LOCK bodies\n       through a new BoundedByteArrayOutputStream limited by the new\n       maxRequestBodySize init parameter (default 4096 bytes)\n     - CVE-2026-41284","status":"published","published":"2026-05-28T14:02:01Z","modified":"2026-06-04T10:03:26.487800721Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780649787","title":"Fix of 7 CVEs","description":"   * SECURITY UPDATE: fix the handling of invalid users with DIGEST authentication\n     - debian/patches/CVE-2026-43512.patch: fix the handling of invalid users with DIGEST authentication\n     - CVE-2026-43512\n   * SECURITY UPDATE: add case sensitive attribute to LockOutRealm\n     - debian/patches/CVE-2026-43513.patch: add case sensitive attribute to LockOutRealm\n     - CVE-2026-43513\n   * SECURITY UPDATE: switch AJP secret comparison to a constant time algorithm\n     - debian/patches/CVE-2026-43514.patch: switch AJP secret comparison to a constant time algorithm\n     - CVE-2026-43514\n   * SECURITY UPDATE: ensure RealmBase finds all matching extension based constraints\n     - debian/patches/CVE-2026-43515.patch: ensure RealmBase finds all matching extension based constraints\n     - CVE-2026-43515\n   * SECURITY UPDATE: add a configurable limit for WebDAV XML request bodies\n     - debian/patches/CVE-2026-41284.patch: add a configurable limit for WebDAV XML request bodies\n     - CVE-2026-41284\n   * SECURITY UPDATE: fix WebSocket + proxy + DIGEST auth on proxy\n     - debian/patches/CVE-2026-42498.patch: fix WebSocket + proxy + DIGEST auth on proxy\n     - CVE-2026-42498\n   * SECURITY UPDATE: HTTP/2 header filtering - validate decoded HPACK names/values against RFC 7230 token/field-vchar/field-content rules\n     - debian/patches/CVE-2026-41293.patch: HTTP/2 header filtering - validate decoded HPACK names/values against RFC 7230 token/field-vchar/field-content rules\n     - CVE-2026-41293\n   * Build: refresh debian/test_certs/ test fixtures (CA + RSA/EC server\n     certs + client cert) — upstream localhost-rsa.jks is expired since\n     2025-02-16 and 8.5.x is no longer rotated; new fixtures are signed\n     by a fresh self-signed CA with 10-year validity, applied via the\n     existing TEST_CERTS_DIR overlay in debian/rules.","status":"published","published":"2026-06-05T08:56:53Z","modified":"2026-10-26T09:43:31.53210015Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1782900813","title":"Fix CVE(s): CVE-2026-43512, CVE-2026-43513, CVE-2026-43515","description":"   * SECURITY UPDATE: fix the handling of invalid users with DIGEST\n     authentication\n     - debian/patches/CVE-2026-43512.patch: short-cut the null password case\n       in RealmBase.getDigest()\n     - CVE-2026-43512\n   * SECURITY UPDATE: account lockout bypass via username case variation\n     - debian/patches/CVE-2026-43513.patch: add case sensitive attribute to\n       LockOutRealm and normalise usernames before tracking failures\n     - CVE-2026-43513\n   * SECURITY UPDATE: authorization bypass with extension-based method\n     constraints\n     - debian/patches/CVE-2026-43515.patch: ensure RealmBase finds all\n       matching extension based constraints\n     - CVE-2026-43515","status":"published","published":"2026-07-08T15:55:53Z","modified":"2026-10-26T09:31:46.800345649Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1788550289","title":"TuxCare security update for 3 packages (4 CVEs)","description":"TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 10.1.42-tuxcare.9.","status":"published","published":"2026-09-04T19:31:29Z","modified":"2026-11-02T19:46:08.259893838Z","updated_at":"2026-11-02T20:29:40.716173Z"},{"id":"CLSA-2026-1792765354","title":"TuxCare security update for 6 packages (6 CVEs)","description":"TuxCare rebuilt 6 packages to address 6 CVEs. Fixed in 10.1.50-tuxcare.2.","status":"published","published":"2026-10-23T14:22:34Z","modified":"2026-11-02T19:46:31.582485432Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793727391","title":"TuxCare security update for 5 packages (8 CVEs)","description":"TuxCare rebuilt 5 packages to address 8 CVEs. Fixed in 10.1.33-tuxcare.3.","status":"published","published":"2026-11-03T18:36:31Z","modified":"2026-11-04T02:30:02.665066571Z","updated_at":"2026-11-04T02:55:01.518827Z"},{"id":"CLSA-2026-1793730417","title":"TuxCare security update for 4 packages (3 CVEs)","description":"TuxCare rebuilt 4 packages to address 3 CVEs. Fixed in 10.1.18-tuxcare.10.","status":"published","published":"2026-11-03T19:26:58Z","modified":"2026-11-04T02:30:04.081339348Z","updated_at":"2026-11-04T02:55:01.518827Z"},{"id":"CLSA-2026-1793863300","title":"TuxCare security update for 5 packages (8 CVEs)","description":"TuxCare rebuilt 5 packages to address 8 CVEs. Fixed in 10.1.16-tuxcare.2.","status":"published","published":"2026-11-05T08:21:41Z","modified":"2026-11-05T13:15:03.279495267Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"MGASA-2026-0139","title":"Updated tomcat packages fix security vulnerability","description":"Unbounded read in WebDAV LOCK and PROPFIND handling. (CVE-2026-41284)\nHTTP/2 request headers not validated. (CVE-2026-41293)\nWebSocket authentication header exposure. (CVE-2026-42498)\nDigest authenticator will authenticate any unknown user.\n(CVE-2026-43512)\nLockOutRealm treats user names as case-sensitive. (CVE-2026-43513)\nAJP secret compared in non-constant time. (CVE-2026-43514)\nSecurity constraints not correctly applied. (CVE-2026-43515)\n","status":"published","published":"2026-05-15T06:17:07Z","modified":"2026-05-15T06:30:06.541303Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10925-1","title":"tomcat-9.0.118-1.1 on GA media","description":"These are all security issues fixed in the tomcat-9.0.118-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-01T00:00:00Z","modified":"2026-06-02T08:45:08.480762853Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:10926-1","title":"tomcat10-10.1.55-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.55-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-01T00:00:00Z","modified":"2026-06-02T08:45:08.412825881Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:10927-1","title":"tomcat11-11.0.22-1.1 on GA media","description":"These are all security issues fixed in the tomcat11-11.0.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-01T00:00:00Z","modified":"2026-06-02T08:45:08.570345426Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21117-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues\n\nUpdate to Tomcat 9.0.118:\n\n- CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).\n- CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).\n- CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).\n- CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).\n- CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).\n- CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).\n- CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).\n\nChanges:\n\n * Catalina\n + Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and\n OpenSSL version information (both APR and FFM implementations), along with\n version compatibility warnings and third-party library version\n information. (csutherl)\n + Code: Refactor generation of the remote user element in the access log to\n remove unnecessary code. (markt)\n + Fix: Fix a regression in the previous release that meant ?- could appear\n in the access log rather than ? when the query string was present but\n empty. (markt)\n + Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by\n Mahmoud Alarby. (remm)\n + Fix: Align the escaping in ExtendedAccessLogValve with the other\n AccessLogValve implementations. (markt)\n + Fix: 70000: fix duplication of special headers in the response after\n commit, following fix for 69967. (remm)\n + Fix: Correct the handling of URIs mapped to a security constraint that\n only specifies the special ** role for all authenticated users. Requests\n without authentication were receiving 403 responses rather than 401\n responses. (markt)\n + Fix: Fix a race condition in StandardContext.getServletContext() that\n could cause the jakarta.servlet.context.tempdir attribute to be lost\n during a context reload. Make the context field volatile and use locking\n to ensure only one ApplicationContext instance is created. (dsoumis)\n + Fix: Update the Windows authentication (kerberos) documentation to reflect\n that both Java and Windows are removing / have removed support for\n RC4-HMAC. The guide now uses AES256-SHA1. (markt)\n + Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize\n which limits the size of a WebDAV request body for LOCK and PROPFIND. The\n default value is 4096 bytes. (markt)\n + Add: Add a new caseSensitive attribute to the LockOutRealm that controls\n the manner in which user names are treated when making locking decisions.\n The default is false, meaning user names are treated in a case insensitive\n manner. (markt)\n + Fix: Correct the handling of invalid users with DIGEST authentication.\n (markt)\n + Fix: Ensure RealmBase finds all matching extension based security\n constraints. (markt)\n * Coyote\n + Fix: Avoid various edge cases if Content-Length is set via\n setHeader(String,String) or addHeader(String,String) with an invalid value\n by always clearing the previous value whether the new value is valid or\n not and ignoring any invalid new value. (markt)\n + Code: Refactor the calculation of the real index in the HPACK dynamic\n header table implementation to reduce code duplication. (markt)\n + Fix: Fix various minor issues with some HTTP/2 stream error messages for\n HTTP/2. (markt)\n + Fix: Consistently reject URIs containing NULL bytes when normalizing.\n + Fix: Fix a few minor memory leaks on error paths reading TLS keys and\n certificates when using FFM. (markt)\n + Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC\n after a stream reset. (markt)\n + Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields\n not permitted in trailers. (markt)\n + Fix: Free private keys after use in FFM based connector configuration.\n + Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header\n decoding that could result in a valid header triggering an unexpected\n connection close. (markt)\n + Fix: Refactor HTTP/2 HPACK encoding so header field names are only\n converted to lower case once during the encoding process. (markt)\n + Fix: Refactor HTTP/2 header field validation so it occurs earlier. Extend\n validation to check for disallowed characters as well as upper case\n characters. (markt)\n + Fix: Add TLS 1.3 groups added in OpenSSL 4.0. (remm)\n + Fix: Add validation that the HTTP/2 :scheme pseudo-header is consistent\n with the use (or not) of TLS. (markt)\n + Fix: Correct the validation of pseudo headers and CONNECT requests to\n align Tomcat's behaviour with RFC 9113, section 8.5. (markt)\n + Fix: Fix a potential integer overflow when allocating capacity from a\n connection level window update to individual HTTP/2 streams. Based on #996\n by Mike Tingey Jr. (markt)\n + Fix: Switch AJP secret comparison to a constant time algorithm. (markt)\n * WebSocket\n + Fix: Fix the initial connection to a WebSocket end point where the\n connection is made via a proxy that requires DIGEST authentication.\n * Other\n + Fix: 69993: Update the URL to the CDDL 1.0 license. (markt)\n + Add: Add warning when OpenSSL binary is not found. (csutherl)\n + Add: Add check for Tomcat Native library, and log warning when it's not\n found to make it easier to see when it's not used by the suite. (csutherl)\n + Update: Update Byte Buddy to 1.18.8. (markt)\n + Update: Update Bouncy Castle to 1.84. (markt)\n + Update: Improvements to French translations. (remm)\n + Update: Improvements to Japanese translations provided by tak7iji. (markt)\n","status":"published","published":"2026-06-20T06:53:29Z","modified":"2026-06-30T18:24:42.697190848Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21121-1","title":"Security update for tomcat11","description":"This update for tomcat11 fixes the following issues\n\nUpdate to Tomcat 11.0.22:\n\n- CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).\n- CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).\n- CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).\n- CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).\n- CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).\n- CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).\n- CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).\n\nChanges:\n\n * Catalina\n + Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and\n OpenSSL version information (both APR and FFM implementations), along with\n version compatibility warnings and third-party library version\n information. (csutherl)\n + Code: Refactor generation of the remote user element in the access log to\n remove unnecessary code. (markt)\n + Fix: Fix a regression in the previous release that meant ?- could appear\n in the access log rather than ? when the query string was present but\n empty. (markt)\n + Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by\n Mahmoud Alarby. (remm)\n + Fix: Align the escaping in ExtendedAccessLogValve with the other\n AccessLogValve implementations. (markt)\n + Fix: 70000: fix duplication of special headers in the response after\n commit, following fix for 69967. (remm)\n + Fix: Correct the handling of URIs mapped to a security constraint that\n only specifies the special ** role for all authenticated users. Requests\n without authentication were receiving 403 responses rather than 401\n responses. (markt)\n + Fix: Fix a race condition in StandardContext.getServletContext() that\n could cause the jakarta.servlet.context.tempdir attribute to be lost\n during a context reload. Make the context field volatile and use locking\n to ensure only one ApplicationContext instance is created. (dsoumis)\n + Fix: Update the Windows authentication (kerberos) documentation to reflect\n that both Java and Windows are removing / have removed support for\n RC4-HMAC. The guide now uses AES256-SHA1. (markt)\n + Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize\n which limits the size of a WebDAV request body for LOCK and PROPFIND. The\n default value is 4096 bytes. (markt)\n + Add: Add a new caseSensitive attribute to the LockOutRealm that controls\n the manner in which user names are treated when making locking decisions.\n The default is false, meaning user names are treated in a case insensitive\n manner. (markt)\n + Fix: Correct the handling of invalid users with DIGEST authentication.\n (markt)\n + Fix: Ensure RealmBase finds all matching extension based security\n constraints. (markt)\n * Coyote\n + Fix: Avoid various edge cases if Content-Length is set via\n setHeader(String,String) or addHeader(String,String) with an invalid value\n by always clearing the previous value whether the new value is valid or\n not and ignoring any invalid new value. (markt)\n + Code: Refactor the calculation of the real index in the HPACK dynamic\n header table implementation to reduce code duplication. (markt)\n + Fix: Fix various minor issues with some HTTP/2 stream error messages for\n HTTP/2. (markt)\n + Fix: Consistently reject URIs containing NULL bytes when normalizing.\n + Fix: Fix a few minor memory leaks on error paths reading TLS keys and\n certificates when using FFM. (markt)\n + Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC\n after a stream reset. (markt)\n + Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields\n not permitted in trailers. (markt)\n + Fix: Free private keys after use in FFM based connector configuration.\n + Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header\n decoding that could result in a valid header triggering an unexpected\n connection close. (markt)\n + Fix: Refactor HTTP/2 HPACK encoding so header field names are only\n converted to lower case once during the encoding process. (markt)\n + Fix: Refactor HTTP/2 header field validation so it occurs earlier. Extend\n validation to check for disallowed characters as well as upper case\n characters. (markt)\n + Fix: Add TLS 1.3 groups added in OpenSSL 4.0. (remm)\n + Fix: Add validation that the HTTP/2 :scheme pseudo-header is consistent\n with the use (or not) of TLS. (markt)\n + Fix: Correct the validation of pseudo headers and CONNECT requests to\n align Tomcat's behaviour with RFC 9113, section 8.5. (markt)\n + Fix: Fix a potential integer overflow when allocating capacity from a\n connection level window update to individual HTTP/2 streams. Based on #996\n by Mike Tingey Jr. (markt)\n + Fix: Switch AJP secret comparison to a constant time algorithm. (markt)\n * WebSocket\n + Fix: Fix the initial connection to a WebSocket end point where the\n connection is made via a proxy that requires DIGEST authentication.\n * Other\n + Fix: 69993: Update the URL to the CDDL 1.0 license. (markt)\n + Add: Add warning when OpenSSL binary is not found. (csutherl)\n + Add: Add check for Tomcat Native library, and log warning when it's not\n found to make it easier to see when it's not used by the suite. (csutherl)\n + Update: Update Byte Buddy to 1.18.8. (markt)\n + Update: Update Bouncy Castle to 1.84. (markt)\n + Update: Improvements to French translations. (remm)\n + Update: Improvements to Japanese translations provided by tak7iji. (markt)\n","status":"published","published":"2026-06-20T06:53:29Z","modified":"2026-06-30T18:24:43.249188404Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21122-1","title":"Security update for tomcat10","description":"This update for tomcat10 fixes the following issues\n\nUpdate to Tomcat 10.1.55:\n\n- CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).\n- CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).\n- CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).\n- CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).\n- CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).\n- CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).\n- CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).\n\nChanges:\n\n * Catalina\n + Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and\n OpenSSL version information (both APR and FFM implementations), along with\n version compatibility warnings and third-party library version\n information. (csutherl)\n + Code: Refactor generation of the remote user element in the access log to\n remove unnecessary code. (markt)\n + Fix: Fix a regression in the previous release that meant ?- could appear\n in the access log rather than ? when the query string was present but\n empty. (markt)\n + Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by\n Mahmoud Alarby. (remm)\n + Fix: Align the escaping in ExtendedAccessLogValve with the other\n AccessLogValve implementations. (markt)\n + Fix: 70000: fix duplication of special headers in the response after\n commit, following fix for 69967. (remm)\n + Fix: Correct the handling of URIs mapped to a security constraint that\n only specifies the special ** role for all authenticated users. Requests\n without authentication were receiving 403 responses rather than 401\n responses. (markt)\n + Fix: Fix a race condition in StandardContext.getServletContext() that\n could cause the jakarta.servlet.context.tempdir attribute to be lost\n during a context reload. Make the context field volatile and use locking\n to ensure only one ApplicationContext instance is created. (dsoumis)\n + Fix: Update the Windows authentication (kerberos) documentation to reflect\n that both Java and Windows are removing / have removed support for\n RC4-HMAC. The guide now uses AES256-SHA1. (markt)\n + Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize\n which limits the size of a WebDAV request body for LOCK and PROPFIND. The\n default value is 4096 bytes. (markt)\n + Add: Add a new caseSensitive attribute to the LockOutRealm that controls\n the manner in which user names are treated when making locking decisions.\n The default is false, meaning user names are treated in a case insensitive\n manner. (markt)\n + Fix: Correct the handling of invalid users with DIGEST authentication.\n (markt)\n + Fix: Ensure RealmBase finds all matching extension based security\n constraints. (markt)\n * Coyote\n + Fix: Avoid various edge cases if Content-Length is set via\n setHeader(String,String) or addHeader(String,String) with an invalid value\n by always clearing the previous value whether the new value is valid or\n not and ignoring any invalid new value. (markt)\n + Code: Refactor the calculation of the real index in the HPACK dynamic\n header table implementation to reduce code duplication. (markt)\n + Fix: Fix various minor issues with some HTTP/2 stream error messages for\n HTTP/2. (markt)\n + Fix: Consistently reject URIs containing NULL bytes when normalizing.\n + Fix: Fix a few minor memory leaks on error paths reading TLS keys and\n certificates when using FFM. (markt)\n + Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC\n after a stream reset. (markt)\n + Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields\n not permitted in trailers. (markt)\n + Fix: Free private keys after use in FFM based connector configuration.\n + Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header\n decoding that could result in a valid header triggering an unexpected\n connection close. (markt)\n + Fix: Refactor HTTP/2 HPACK encoding so header field names are only\n converted to lower case once during the encoding process. (markt)\n + Fix: Refactor HTTP/2 header field validation so it occurs earlier. Extend\n validation to check for disallowed characters as well as upper case\n characters. (markt)\n + Fix: Add TLS 1.3 groups added in OpenSSL 4.0. (remm)\n + Fix: Add validation that the HTTP/2 :scheme pseudo-header is consistent\n with the use (or not) of TLS. (markt)\n + Fix: Correct the validation of pseudo headers and CONNECT requests to\n align Tomcat's behaviour with RFC 9113, section 8.5. (markt)\n + Fix: Fix a potential integer overflow when allocating capacity from a\n connection level window update to individual HTTP/2 streams. Based on #996\n by Mike Tingey Jr. (markt)\n + Fix: Switch AJP secret comparison to a constant time algorithm. (markt)\n * WebSocket\n + Fix: Fix the initial connection to a WebSocket end point where the\n connection is made via a proxy that requires DIGEST authentication.\n * Other\n + Fix: 69993: Update the URL to the CDDL 1.0 license. (markt)\n + Add: Add warning when OpenSSL binary is not found. (csutherl)\n + Add: Add check for Tomcat Native library, and log warning when it's not\n found to make it easier to see when it's not used by the suite. (csutherl)\n + Update: Update Byte Buddy to 1.18.8. (markt)\n + Update: Update Bouncy Castle to 1.84. (markt)\n + Update: Improvements to French translations. (remm)\n + Update: Improvements to Japanese translations provided by tak7iji. (markt)\n","status":"published","published":"2026-06-20T06:53:29Z","modified":"2026-06-30T18:24:43.252096591Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22195-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues\n\nUpdate to Tomcat 9.0.118:\n\n- CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).\n- CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).\n- CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).\n- CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).\n- CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).\n- CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).\n- CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).\n\nChanges:\n\n * Catalina\n + Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and\n OpenSSL version information (both APR and FFM implementations), along with\n version compatibility warnings and third-party library version\n information. (csutherl)\n + Code: Refactor generation of the remote user element in the access log to\n remove unnecessary code. (markt)\n + Fix: Fix a regression in the previous release that meant ?- could appear\n in the access log rather than ? when the query string was present but\n empty. (markt)\n + Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by\n Mahmoud Alarby. (remm)\n + Fix: Align the escaping in ExtendedAccessLogValve with the other\n AccessLogValve implementations. (markt)\n + Fix: 70000: fix duplication of special headers in the response after\n commit, following fix for 69967. (remm)\n + Fix: Correct the handling of URIs mapped to a security constraint that\n only specifies the special ** role for all authenticated users. Requests\n without authentication were receiving 403 responses rather than 401\n responses. (markt)\n + Fix: Fix a race condition in StandardContext.getServletContext() that\n could cause the jakarta.servlet.context.tempdir attribute to be lost\n during a context reload. Make the context field volatile and use locking\n to ensure only one ApplicationContext instance is created. (dsoumis)\n + Fix: Update the Windows authentication (kerberos) documentation to reflect\n that both Java and Windows are removing / have removed support for\n RC4-HMAC. The guide now uses AES256-SHA1. (markt)\n + Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize\n which limits the size of a WebDAV request body for LOCK and PROPFIND. The\n default value is 4096 bytes. (markt)\n + Add: Add a new caseSensitive attribute to the LockOutRealm that controls\n the manner in which user names are treated when making locking decisions.\n The default is false, meaning user names are treated in a case insensitive\n manner. (markt)\n + Fix: Correct the handling of invalid users with DIGEST authentication.\n (markt)\n + Fix: Ensure RealmBase finds all matching extension based security\n constraints. (markt)\n * Coyote\n + Fix: Avoid various edge cases if Content-Length is set via\n setHeader(String,String) or addHeader(String,String) with an invalid value\n by always clearing the previous value whether the new value is valid or\n not and ignoring any invalid new value. (markt)\n + Code: Refactor the calculation of the real index in the HPACK dynamic\n header table implementation to reduce code duplication. (markt)\n + Fix: Fix various minor issues with some HTTP/2 stream error messages for\n HTTP/2. (markt)\n + Fix: Consistently reject URIs containing NULL bytes when normalizing.\n + Fix: Fix a few minor memory leaks on error paths reading TLS keys and\n certificates when using FFM. (markt)\n + Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC\n after a stream reset. (markt)\n + Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields\n not permitted in trailers. (markt)\n + Fix: Free private keys after use in FFM based connector configuration.\n + Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header\n decoding that could result in a valid header triggering an unexpected\n connection close. (markt)\n + Fix: Refactor HTTP/2 HPACK encoding so header field names are only\n converted to lower case once during the encoding process. (markt)\n + Fix: Refactor HTTP/2 header field validation so it occurs earlier. Extend\n validation to check for disallowed characters as well as upper case\n characters. (markt)\n + Fix: Add TLS 1.3 groups added in OpenSSL 4.0. (remm)\n + Fix: Add validation that the HTTP/2 :scheme pseudo-header is consistent\n with the use (or not) of TLS. (markt)\n + Fix: Correct the validation of pseudo headers and CONNECT requests to\n align Tomcat's behaviour with RFC 9113, section 8.5. (markt)\n + Fix: Fix a potential integer overflow when allocating capacity from a\n connection level window update to individual HTTP/2 streams. Based on #996\n by Mike Tingey Jr. (markt)\n + Fix: Switch AJP secret comparison to a constant time algorithm. (markt)\n * WebSocket\n + Fix: Fix the initial connection to a WebSocket end point where the\n connection is made via a proxy that requires DIGEST authentication.\n * Other\n + Fix: 69993: Update the URL to the CDDL 1.0 license. (markt)\n + Add: Add warning when OpenSSL binary is not found. (csutherl)\n + Add: Add check for Tomcat Native library, and log warning when it's not\n found to make it easier to see when it's not used by the suite. (csutherl)\n + Update: Update Byte Buddy to 1.18.8. (markt)\n + Update: Update Bouncy Castle to 1.84. (markt)\n + Update: Improvements to French translations. (remm)\n + Update: Improvements to Japanese translations provided by tak7iji. (markt)\n","status":"published","published":"2026-06-20T06:56:16Z","modified":"2026-06-24T09:00:08.063232798Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22196-1","title":"Security update for tomcat11","description":"This update for tomcat11 fixes the following issues\n\nUpdate to Tomcat 11.0.22:\n\n- CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).\n- CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).\n- CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).\n- CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).\n- CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).\n- CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).\n- CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).\n\nChanges:\n\n * Catalina\n + Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and\n OpenSSL version information (both APR and FFM implementations), along with\n version compatibility warnings and third-party library version\n information. (csutherl)\n + Code: Refactor generation of the remote user element in the access log to\n remove unnecessary code. (markt)\n + Fix: Fix a regression in the previous release that meant ?- could appear\n in the access log rather than ? when the query string was present but\n empty. (markt)\n + Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by\n Mahmoud Alarby. (remm)\n + Fix: Align the escaping in ExtendedAccessLogValve with the other\n AccessLogValve implementations. (markt)\n + Fix: 70000: fix duplication of special headers in the response after\n commit, following fix for 69967. (remm)\n + Fix: Correct the handling of URIs mapped to a security constraint that\n only specifies the special ** role for all authenticated users. Requests\n without authentication were receiving 403 responses rather than 401\n responses. (markt)\n + Fix: Fix a race condition in StandardContext.getServletContext() that\n could cause the jakarta.servlet.context.tempdir attribute to be lost\n during a context reload. Make the context field volatile and use locking\n to ensure only one ApplicationContext instance is created. (dsoumis)\n + Fix: Update the Windows authentication (kerberos) documentation to reflect\n that both Java and Windows are removing / have removed support for\n RC4-HMAC. The guide now uses AES256-SHA1. (markt)\n + Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize\n which limits the size of a WebDAV request body for LOCK and PROPFIND. The\n default value is 4096 bytes. (markt)\n + Add: Add a new caseSensitive attribute to the LockOutRealm that controls\n the manner in which user names are treated when making locking decisions.\n The default is false, meaning user names are treated in a case insensitive\n manner. (markt)\n + Fix: Correct the handling of invalid users with DIGEST authentication.\n (markt)\n + Fix: Ensure RealmBase finds all matching extension based security\n constraints. (markt)\n * Coyote\n + Fix: Avoid various edge cases if Content-Length is set via\n setHeader(String,String) or addHeader(String,String) with an invalid value\n by always clearing the previous value whether the new value is valid or\n not and ignoring any invalid new value. (markt)\n + Code: Refactor the calculation of the real index in the HPACK dynamic\n header table implementation to reduce code duplication. (markt)\n + Fix: Fix various minor issues with some HTTP/2 stream error messages for\n HTTP/2. (markt)\n + Fix: Consistently reject URIs containing NULL bytes when normalizing.\n + Fix: Fix a few minor memory leaks on error paths reading TLS keys and\n certificates when using FFM. (markt)\n + Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC\n after a stream reset. (markt)\n + Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields\n not permitted in trailers. (markt)\n + Fix: Free private keys after use in FFM based connector configuration.\n + Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header\n decoding that could result in a valid header triggering an unexpected\n connection close. (markt)\n + Fix: Refactor HTTP/2 HPACK encoding so header field names are only\n converted to lower case once during the encoding process. (markt)\n + Fix: Refactor HTTP/2 header field validation so it occurs earlier. Extend\n validation to check for disallowed characters as well as upper case\n characters. (markt)\n + Fix: Add TLS 1.3 groups added in OpenSSL 4.0. (remm)\n + Fix: Add validation that the HTTP/2 :scheme pseudo-header is consistent\n with the use (or not) of TLS. (markt)\n + Fix: Correct the validation of pseudo headers and CONNECT requests to\n align Tomcat's behaviour with RFC 9113, section 8.5. (markt)\n + Fix: Fix a potential integer overflow when allocating capacity from a\n connection level window update to individual HTTP/2 streams. Based on #996\n by Mike Tingey Jr. (markt)\n + Fix: Switch AJP secret comparison to a constant time algorithm. (markt)\n * WebSocket\n + Fix: Fix the initial connection to a WebSocket end point where the\n connection is made via a proxy that requires DIGEST authentication.\n * Other\n + Fix: 69993: Update the URL to the CDDL 1.0 license. (markt)\n + Add: Add warning when OpenSSL binary is not found. (csutherl)\n + Add: Add check for Tomcat Native library, and log warning when it's not\n found to make it easier to see when it's not used by the suite. (csutherl)\n + Update: Update Byte Buddy to 1.18.8. (markt)\n + Update: Update Bouncy Castle to 1.84. (markt)\n + Update: Improvements to French translations. (remm)\n + Update: Improvements to Japanese translations provided by tak7iji. (markt)\n","status":"published","published":"2026-06-20T06:54:57Z","modified":"2026-06-24T09:00:08.062834148Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22197-1","title":"Security update for tomcat10","description":"This update for tomcat10 fixes the following issues\n\nUpdate to Tomcat 10.1.55:\n\n- CVE-2026-41284: Unbounded read in WebDAV LOCK and PROPFIND handling (bsc#1265162).\n- CVE-2026-41293: HTTP/2 request headers not validated (bsc#1265163).\n- CVE-2026-42498: WebSocket authentication header exposure (bsc#1265165).\n- CVE-2026-43512: digest authenticator will authenticate any unknown user (bsc#1265145).\n- CVE-2026-43513: LockOutRealm treats user names as case-sensitive (bsc#1265166).\n- CVE-2026-43514: AJP secret compared in non-constant time (bsc#1265167).\n- CVE-2026-43515: Security constraints not correctly applied (bsc#1265168).\n\nChanges:\n\n * Catalina\n + Add: Enhance version.sh and version.bat to display APR, Tomcat Native, and\n OpenSSL version information (both APR and FFM implementations), along with\n version compatibility warnings and third-party library version\n information. (csutherl)\n + Code: Refactor generation of the remote user element in the access log to\n remove unnecessary code. (markt)\n + Fix: Fix a regression in the previous release that meant ?- could appear\n in the access log rather than ? when the query string was present but\n empty. (markt)\n + Fix: Failed precondition should make WebDAV DELETE fail. #982 submitted by\n Mahmoud Alarby. (remm)\n + Fix: Align the escaping in ExtendedAccessLogValve with the other\n AccessLogValve implementations. (markt)\n + Fix: 70000: fix duplication of special headers in the response after\n commit, following fix for 69967. (remm)\n + Fix: Correct the handling of URIs mapped to a security constraint that\n only specifies the special ** role for all authenticated users. Requests\n without authentication were receiving 403 responses rather than 401\n responses. (markt)\n + Fix: Fix a race condition in StandardContext.getServletContext() that\n could cause the jakarta.servlet.context.tempdir attribute to be lost\n during a context reload. Make the context field volatile and use locking\n to ensure only one ApplicationContext instance is created. (dsoumis)\n + Fix: Update the Windows authentication (kerberos) documentation to reflect\n that both Java and Windows are removing / have removed support for\n RC4-HMAC. The guide now uses AES256-SHA1. (markt)\n + Fix: Add a new initialisation parameter for WebDAV, maxRequestBodySize\n which limits the size of a WebDAV request body for LOCK and PROPFIND. The\n default value is 4096 bytes. (markt)\n + Add: Add a new caseSensitive attribute to the LockOutRealm that controls\n the manner in which user names are treated when making locking decisions.\n The default is false, meaning user names are treated in a case insensitive\n manner. (markt)\n + Fix: Correct the handling of invalid users with DIGEST authentication.\n (markt)\n + Fix: Ensure RealmBase finds all matching extension based security\n constraints. (markt)\n * Coyote\n + Fix: Avoid various edge cases if Content-Length is set via\n setHeader(String,String) or addHeader(String,String) with an invalid value\n by always clearing the previous value whether the new value is valid or\n not and ignoring any invalid new value. (markt)\n + Code: Refactor the calculation of the real index in the HPACK dynamic\n header table implementation to reduce code duplication. (markt)\n + Fix: Fix various minor issues with some HTTP/2 stream error messages for\n HTTP/2. (markt)\n + Fix: Consistently reject URIs containing NULL bytes when normalizing.\n + Fix: Fix a few minor memory leaks on error paths reading TLS keys and\n certificates when using FFM. (markt)\n + Fix: Refactor clean-up after HTTP/2 headers have been processed to aid GC\n after a stream reset. (markt)\n + Fix: Align HTTP/2 trailer fields with HTTP/1.1 and filter out any fields\n not permitted in trailers. (markt)\n + Fix: Free private keys after use in FFM based connector configuration.\n + Fix: Correct an unlikely edge-case parsing bug in the HTTP/2 HPACK header\n decoding that could result in a valid header triggering an unexpected\n connection close. (markt)\n + Fix: Refactor HTTP/2 HPACK encoding so header field names are only\n converted to lower case once during the encoding process. (markt)\n + Fix: Refactor HTTP/2 header field validation so it occurs earlier. Extend\n validation to check for disallowed characters as well as upper case\n characters. (markt)\n + Fix: Add TLS 1.3 groups added in OpenSSL 4.0. (remm)\n + Fix: Add validation that the HTTP/2 :scheme pseudo-header is consistent\n with the use (or not) of TLS. (markt)\n + Fix: Correct the validation of pseudo headers and CONNECT requests to\n align Tomcat's behaviour with RFC 9113, section 8.5. (markt)\n + Fix: Fix a potential integer overflow when allocating capacity from a\n connection level window update to individual HTTP/2 streams. Based on #996\n by Mike Tingey Jr. (markt)\n + Fix: Switch AJP secret comparison to a constant time algorithm. (markt)\n * WebSocket\n + Fix: Fix the initial connection to a WebSocket end point where the\n connection is made via a proxy that requires DIGEST authentication.\n * Other\n + Fix: 69993: Update the URL to the CDDL 1.0 license. (markt)\n + Add: Add warning when OpenSSL binary is not found. (csutherl)\n + Add: Add check for Tomcat Native library, and log warning when it's not\n found to make it easier to see when it's not used by the suite. (csutherl)\n + Update: Update Byte Buddy to 1.18.8. (markt)\n + Update: Update Bouncy Castle to 1.84. (markt)\n + Update: Improvements to French translations. (remm)\n + Update: Improvements to Japanese translations provided by tak7iji. (markt)\n","status":"published","published":"2026-06-20T06:56:16Z","modified":"2026-06-24T09:00:08.093930293Z","updated_at":"2026-11-02T15:54:02.654057Z"}]},"sources_more":{"osv":4}}