{"schema_version":"2","view":"grouped","data":[{"id":60355,"cve_ids":["CVE-2026-73581"],"payload":{"kind":"advisory","title":"Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore","summary":"Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.","evidence":"cve:CVE-2026-73581","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-73581","aliases":["CVE-2026-73581"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"moderate"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.25"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.59"},{"status":"affected","version":"9.0.0.M1","versionType":"semver","lessThanOrEqual":"9.0.121"},{"status":"affected","version":"8.5.0","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"unaffected","version":"0","lessThan":"8.5.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T14:53:50.292Z","provider":"cve","references":["https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-73581","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-23T15:19:35.322766Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-23T15:19:40.273Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/19"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-23T18:10:39.638Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-30T14:53:50.292Z"}}},"related_cves":[{"value":"CVE-2026-73581","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e012b90c-cf33-4d49-ab5e-4eb9a27a7a56","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-73581","metrics":[],"products":[{"name":{"value":"tomcat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.0.45","evidence":"/affected/0/ranges"},{"value":"10.1.60","evidence":"/affected/0/ranges"},{"value":"11.0.26","evidence":"/affected/0/ranges"},{"value":"9.0.122","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-tomcat-2026-73581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-73581","advisory_id":"e012b90c-cf33-4d49-ab5e-4eb9a27a7a56","event_types":["advisory"],"published_at":"2026-10-25T18:32:49.091666+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T11:08:53.212+00:00","detail_url":"/advisories/advisory%3Ae012b90c-cf33-4d49-ab5e-4eb9a27a7a56","group":{"id":"advisory:e012b90c-cf33-4d49-ab5e-4eb9a27a7a56","revision":1,"primary_event_id":59555,"change":"published","superseded_by":[],"changed":{"id":59555,"cve_ids":["CVE-2026-73581"],"payload":{"kind":"advisory","title":"Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore","summary":"Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.","evidence":"cve:CVE-2026-73581","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-73581","aliases":["CVE-2026-73581"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"moderate"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.25"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.59"},{"status":"affected","version":"9.0.0.M1","versionType":"semver","lessThanOrEqual":"9.0.121"},{"status":"affected","version":"8.5.0","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"unaffected","version":"0","lessThan":"8.5.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T14:53:50.292Z","provider":"cve","references":["https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-73581","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-23T15:19:35.322766Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-23T15:19:40.273Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/19"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-23T18:10:39.638Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-30T14:53:50.292Z"}}},"related_cves":[{"value":"CVE-2026-73581","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e012b90c-cf33-4d49-ab5e-4eb9a27a7a56","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-73581","metrics":[],"products":[{"name":{"value":"tomcat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.0.45","evidence":"/affected/0/ranges"},{"value":"10.1.60","evidence":"/affected/0/ranges"},{"value":"11.0.26","evidence":"/affected/0/ranges"},{"value":"9.0.122","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-tomcat-2026-73581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-73581","advisory_id":"e012b90c-cf33-4d49-ab5e-4eb9a27a7a56","event_types":["advisory"],"published_at":"2026-10-25T18:32:49.091666+00:00","technologies":["apache-tomcat","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T11:08:53.212+00:00","detail_url":"/events/59555"},"members":[{"id":59555,"cve_ids":["CVE-2026-73581"],"payload":{"kind":"advisory","title":"Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore","summary":"Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.","evidence":"cve:CVE-2026-73581","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-73581","aliases":["CVE-2026-73581"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"moderate"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.25"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.59"},{"status":"affected","version":"9.0.0.M1","versionType":"semver","lessThanOrEqual":"9.0.121"},{"status":"affected","version":"8.5.0","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"unaffected","version":"0","lessThan":"8.5.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T14:53:50.292Z","provider":"cve","references":["https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-73581","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-23T15:19:35.322766Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-23T15:19:40.273Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/19"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-23T18:10:39.638Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-30T14:53:50.292Z"}}},"related_cves":[{"value":"CVE-2026-73581","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e012b90c-cf33-4d49-ab5e-4eb9a27a7a56","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-73581","metrics":[],"products":[{"name":{"value":"tomcat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.0.45","evidence":"/affected/0/ranges"},{"value":"10.1.60","evidence":"/affected/0/ranges"},{"value":"11.0.26","evidence":"/affected/0/ranges"},{"value":"9.0.122","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-tomcat-2026-73581","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-73581","advisory_id":"e012b90c-cf33-4d49-ab5e-4eb9a27a7a56","event_types":["advisory"],"published_at":"2026-10-25T18:32:49.091666+00:00","technologies":["apache-tomcat","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T11:08:53.212+00:00","detail_url":"/events/59555"}]}},{"id":60347,"cve_ids":["CVE-2026-77762"],"payload":{"kind":"advisory","title":"Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request","summary":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.","evidence":"cve:CVE-2026-77762","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-77762","aliases":["CVE-2026-77762"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.25"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.59"},{"status":"affected","version":"9.0.39","versionType":"semver","lessThanOrEqual":"9.0.121"},{"status":"affected","version":"8.5.59","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"unaffected","version":"0","versionType":"semver","lessThanOrEqual":"7.0.109"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T14:50:02.042Z","provider":"cve","references":["https://lists.apache.org/thread/y5r9fvjo7ol24mkoyoc0st8bqrfyqcyn"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-77762","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-23T15:40:01.556894Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-23T15:40:13.579Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/23"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-23T18:10:43.790Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-30T14:50:02.042Z"}}},"related_cves":[{"value":"CVE-2026-77762","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:70b8fb8f-09ff-44c9-846c-97aea6661331","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-77762","metrics":[],"products":[{"name":{"value":"tomcat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.0.122","evidence":"/affected/0/ranges"},{"value":"10.1.60","evidence":"/affected/0/ranges"},{"value":"11.0.26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-tomcat-2026-77762","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77762","advisory_id":"70b8fb8f-09ff-44c9-846c-97aea6661331","event_types":["advisory"],"published_at":"2026-10-25T18:32:34.822406+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T11:19:28.37+00:00","detail_url":"/advisories/advisory%3A70b8fb8f-09ff-44c9-846c-97aea6661331","group":{"id":"advisory:70b8fb8f-09ff-44c9-846c-97aea6661331","revision":1,"primary_event_id":59547,"change":"published","superseded_by":[],"changed":{"id":59547,"cve_ids":["CVE-2026-77762"],"payload":{"kind":"advisory","title":"Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request","summary":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.","evidence":"cve:CVE-2026-77762","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-77762","aliases":["CVE-2026-77762"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.25"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.59"},{"status":"affected","version":"9.0.39","versionType":"semver","lessThanOrEqual":"9.0.121"},{"status":"affected","version":"8.5.59","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"unaffected","version":"0","versionType":"semver","lessThanOrEqual":"7.0.109"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T14:50:02.042Z","provider":"cve","references":["https://lists.apache.org/thread/y5r9fvjo7ol24mkoyoc0st8bqrfyqcyn"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-77762","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-23T15:40:01.556894Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-23T15:40:13.579Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/23"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-23T18:10:43.790Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-30T14:50:02.042Z"}}},"related_cves":[{"value":"CVE-2026-77762","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:70b8fb8f-09ff-44c9-846c-97aea6661331","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-77762","metrics":[],"products":[{"name":{"value":"tomcat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.0.122","evidence":"/affected/0/ranges"},{"value":"10.1.60","evidence":"/affected/0/ranges"},{"value":"11.0.26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-tomcat-2026-77762","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77762","advisory_id":"70b8fb8f-09ff-44c9-846c-97aea6661331","event_types":["advisory"],"published_at":"2026-10-25T18:32:34.822406+00:00","technologies":["apache-tomcat","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T11:19:28.37+00:00","detail_url":"/events/59547"},"members":[{"id":59547,"cve_ids":["CVE-2026-77762"],"payload":{"kind":"advisory","title":"Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request","summary":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue.","evidence":"cve:CVE-2026-77762","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-77762","aliases":["CVE-2026-77762"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.25"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.59"},{"status":"affected","version":"9.0.39","versionType":"semver","lessThanOrEqual":"9.0.121"},{"status":"affected","version":"8.5.59","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"unaffected","version":"0","versionType":"semver","lessThanOrEqual":"7.0.109"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T14:50:02.042Z","provider":"cve","references":["https://lists.apache.org/thread/y5r9fvjo7ol24mkoyoc0st8bqrfyqcyn"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-77762","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-23T15:40:01.556894Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-23T15:40:13.579Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/23"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-23T18:10:43.790Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-30T14:50:02.042Z"}}},"related_cves":[{"value":"CVE-2026-77762","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:70b8fb8f-09ff-44c9-846c-97aea6661331","priority":{"reasons":["linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-77762","metrics":[],"products":[{"name":{"value":"tomcat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.0.122","evidence":"/affected/0/ranges"},{"value":"10.1.60","evidence":"/affected/0/ranges"},{"value":"11.0.26","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-tomcat-2026-77762","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77762","advisory_id":"70b8fb8f-09ff-44c9-846c-97aea6661331","event_types":["advisory"],"published_at":"2026-10-25T18:32:34.822406+00:00","technologies":["apache-tomcat","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T11:19:28.37+00:00","detail_url":"/events/59547"}]}},{"id":60345,"cve_ids":["CVE-2026-76183"],"payload":{"kind":"advisory","title":"Apache Tomcat: Bypass of security constraints for WebSocket endpoints","summary":"Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.","evidence":"cve:CVE-2026-76183","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-76183","aliases":["CVE-2026-76183"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.25"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.59"},{"status":"affected","version":"9.0.0.M1","versionType":"semver","lessThanOrEqual":"9.0.121"},{"status":"affected","version":"8.5.0","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"affected","version":"7.0.43","versionType":"semver","lessThanOrEqual":"7.0.109"},{"status":"unaffected","version":"0","lessThan":"7.0.43","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T14:54:21.515Z","provider":"cve","references":["https://lists.apache.org/thread/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-76183","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-23T15:33:34.949308Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-23T15:37:17.161Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/21"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-23T18:10:41.803Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-30T14:54:21.515Z"}}},"related_cves":[{"value":"CVE-2026-76183","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:67c8e212-b685-4733-a65f-c1b0f665a9b2","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-76183","metrics":[],"products":[{"name":{"value":"tomcat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.0.45","evidence":"/affected/0/ranges"},{"value":"10.1.60","evidence":"/affected/0/ranges"},{"value":"11.0.26","evidence":"/affected/0/ranges"},{"value":"9.0.122","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-tomcat-2026-76183","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76183","advisory_id":"67c8e212-b685-4733-a65f-c1b0f665a9b2","event_types":["advisory"],"published_at":"2026-10-25T18:32:33.22326+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-23T11:16:09.907+00:00","detail_url":"/advisories/advisory%3A67c8e212-b685-4733-a65f-c1b0f665a9b2","group":{"id":"advisory:67c8e212-b685-4733-a65f-c1b0f665a9b2","revision":1,"primary_event_id":59545,"change":"published","superseded_by":[],"changed":{"id":59545,"cve_ids":["CVE-2026-76183"],"payload":{"kind":"advisory","title":"Apache Tomcat: Bypass of security constraints for WebSocket endpoints","summary":"Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.","evidence":"cve:CVE-2026-76183","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-76183","aliases":["CVE-2026-76183"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.25"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.59"},{"status":"affected","version":"9.0.0.M1","versionType":"semver","lessThanOrEqual":"9.0.121"},{"status":"affected","version":"8.5.0","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"affected","version":"7.0.43","versionType":"semver","lessThanOrEqual":"7.0.109"},{"status":"unaffected","version":"0","lessThan":"7.0.43","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T14:54:21.515Z","provider":"cve","references":["https://lists.apache.org/thread/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-76183","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-23T15:33:34.949308Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-23T15:37:17.161Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/21"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-23T18:10:41.803Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-30T14:54:21.515Z"}}},"related_cves":[{"value":"CVE-2026-76183","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:67c8e212-b685-4733-a65f-c1b0f665a9b2","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-76183","metrics":[],"products":[{"name":{"value":"tomcat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.0.45","evidence":"/affected/0/ranges"},{"value":"10.1.60","evidence":"/affected/0/ranges"},{"value":"11.0.26","evidence":"/affected/0/ranges"},{"value":"9.0.122","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-tomcat-2026-76183","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76183","advisory_id":"67c8e212-b685-4733-a65f-c1b0f665a9b2","event_types":["advisory"],"published_at":"2026-10-25T18:32:33.22326+00:00","technologies":["apache-tomcat","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T11:16:09.907+00:00","detail_url":"/events/59545"},"members":[{"id":59545,"cve_ids":["CVE-2026-76183"],"payload":{"kind":"advisory","title":"Apache Tomcat: Bypass of security constraints for WebSocket endpoints","summary":"Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.","evidence":"cve:CVE-2026-76183","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-76183","aliases":["CVE-2026-76183"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.25"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.59"},{"status":"affected","version":"9.0.0.M1","versionType":"semver","lessThanOrEqual":"9.0.121"},{"status":"affected","version":"8.5.0","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"affected","version":"7.0.43","versionType":"semver","lessThanOrEqual":"7.0.109"},{"status":"unaffected","version":"0","lessThan":"7.0.43","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-09-30T14:54:21.515Z","provider":"cve","references":["https://lists.apache.org/thread/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-76183","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-23T15:33:34.949308Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-23T15:37:17.161Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/21"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-09-23T18:10:41.803Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-09-30T14:54:21.515Z"}}},"related_cves":[{"value":"CVE-2026-76183","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:67c8e212-b685-4733-a65f-c1b0f665a9b2","priority":{"reasons":["linked_severity"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-76183","metrics":[],"products":[{"name":{"value":"tomcat","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"9.0.45","evidence":"/affected/0/ranges"},{"value":"10.1.60","evidence":"/affected/0/ranges"},{"value":"11.0.26","evidence":"/affected/0/ranges"},{"value":"9.0.122","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-tomcat-2026-76183","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-76183","advisory_id":"67c8e212-b685-4733-a65f-c1b0f665a9b2","event_types":["advisory"],"published_at":"2026-10-25T18:32:33.22326+00:00","technologies":["apache-tomcat","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-23T11:16:09.907+00:00","detail_url":"/events/59545"}]}},{"id":46163,"cve_ids":["CVE-2026-101296"],"payload":{"kind":"advisory","title":"Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms","summary":"A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","evidence":"cve:CVE-2026-101296","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-101296","aliases":["CVE-2026-101296"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.0.M1","versionType":"semver","lessThanOrEqual":"9.0.122"},{"status":"affected","version":"8.5.0","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"affected","version":"7.0.0","versionType":"semver","lessThanOrEqual":"7.0.109"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T06:31:55.233Z","provider":"cve","references":["https://lists.apache.org/thread.html/bl52b9go9ckoov8x4v3dt6rkm573cygd"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/26"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:09:50.320Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-101296","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-20T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T03:56:29.578Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-21T06:31:55.233Z"}}},"related_cves":[{"value":"CVE-2026-101296","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:50912474-e975-40b6-a414-c4ecb1eb021f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101296","advisory_id":"50912474-e975-40b6-a414-c4ecb1eb021f","event_types":["advisory"],"published_at":"2026-10-25T12:37:52.700999+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:45:39.959+00:00","detail_url":"/advisories/advisory%3A50912474-e975-40b6-a414-c4ecb1eb021f","group":{"id":"advisory:50912474-e975-40b6-a414-c4ecb1eb021f","revision":1,"primary_event_id":45717,"change":"published","superseded_by":[],"changed":{"id":45717,"cve_ids":["CVE-2026-101296"],"payload":{"kind":"advisory","title":"Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms","summary":"A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","evidence":"cve:CVE-2026-101296","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-101296","aliases":["CVE-2026-101296"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.0.M1","versionType":"semver","lessThanOrEqual":"9.0.122"},{"status":"affected","version":"8.5.0","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"affected","version":"7.0.0","versionType":"semver","lessThanOrEqual":"7.0.109"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T06:31:55.233Z","provider":"cve","references":["https://lists.apache.org/thread.html/bl52b9go9ckoov8x4v3dt6rkm573cygd"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/26"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:09:50.320Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-101296","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-20T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T03:56:29.578Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-21T06:31:55.233Z"}}},"related_cves":[{"value":"CVE-2026-101296","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:50912474-e975-40b6-a414-c4ecb1eb021f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101296","advisory_id":"50912474-e975-40b6-a414-c4ecb1eb021f","event_types":["advisory"],"published_at":"2026-10-25T12:37:52.700999+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:45:39.959+00:00","detail_url":"/events/45717"},"members":[{"id":45717,"cve_ids":["CVE-2026-101296"],"payload":{"kind":"advisory","title":"Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms","summary":"A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanism allowed attackers to authenticate without providing the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","evidence":"cve:CVE-2026-101296","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-101296","aliases":["CVE-2026-101296"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.0.M1","versionType":"semver","lessThanOrEqual":"9.0.122"},{"status":"affected","version":"8.5.0","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"affected","version":"7.0.0","versionType":"semver","lessThanOrEqual":"7.0.109"}],"defaultStatus":"unaffected"}],"modified":"2026-10-21T06:31:55.233Z","provider":"cve","references":["https://lists.apache.org/thread.html/bl52b9go9ckoov8x4v3dt6rkm573cygd"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/26"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:09:50.320Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-101296","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-20T00:00:00+00:00"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-21T03:56:29.578Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-21T06:31:55.233Z"}}},"related_cves":[{"value":"CVE-2026-101296","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:50912474-e975-40b6-a414-c4ecb1eb021f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101296","advisory_id":"50912474-e975-40b6-a414-c4ecb1eb021f","event_types":["advisory"],"published_at":"2026-10-25T12:37:52.700999+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:45:39.959+00:00","detail_url":"/events/45717"}]}},{"id":42890,"cve_ids":["CVE-2026-93446"],"payload":{"kind":"advisory","title":"Apache Tomcat: Possible TLS 1.3 connection failures","summary":"Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","evidence":"cve:CVE-2026-93446","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-93446","aliases":["CVE-2026-93446"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M21","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.25","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.90","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:10:09.969Z","provider":"cve","references":["https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/25"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:10:09.969Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:44:35.673Z"}}},"related_cves":[{"value":"CVE-2026-93446","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9ea1e0a4-0ef6-4d0e-8c43-605b34a5f3af","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93446","advisory_id":"9ea1e0a4-0ef6-4d0e-8c43-605b34a5f3af","event_types":["advisory"],"published_at":"2026-10-25T11:44:47.510743+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:44:35.673+00:00","detail_url":"/advisories/advisory%3A9ea1e0a4-0ef6-4d0e-8c43-605b34a5f3af","group":{"id":"advisory:9ea1e0a4-0ef6-4d0e-8c43-605b34a5f3af","revision":1,"primary_event_id":42495,"change":"published","superseded_by":[],"changed":{"id":42495,"cve_ids":["CVE-2026-93446"],"payload":{"kind":"advisory","title":"Apache Tomcat: Possible TLS 1.3 connection failures","summary":"Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","evidence":"cve:CVE-2026-93446","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-93446","aliases":["CVE-2026-93446"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M21","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.25","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.90","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:10:09.969Z","provider":"cve","references":["https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/25"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:10:09.969Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:44:35.673Z"}}},"related_cves":[{"value":"CVE-2026-93446","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9ea1e0a4-0ef6-4d0e-8c43-605b34a5f3af","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93446","advisory_id":"9ea1e0a4-0ef6-4d0e-8c43-605b34a5f3af","event_types":["advisory"],"published_at":"2026-10-25T11:44:47.510743+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:44:35.673+00:00","detail_url":"/events/42495"},"members":[{"id":42495,"cve_ids":["CVE-2026-93446"],"payload":{"kind":"advisory","title":"Apache Tomcat: Possible TLS 1.3 connection failures","summary":"Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","evidence":"cve:CVE-2026-93446","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-93446","aliases":["CVE-2026-93446"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M21","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.25","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.90","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:10:09.969Z","provider":"cve","references":["https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/25"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:10:09.969Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:44:35.673Z"}}},"related_cves":[{"value":"CVE-2026-93446","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9ea1e0a4-0ef6-4d0e-8c43-605b34a5f3af","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93446","advisory_id":"9ea1e0a4-0ef6-4d0e-8c43-605b34a5f3af","event_types":["advisory"],"published_at":"2026-10-25T11:44:47.510743+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:44:35.673+00:00","detail_url":"/events/42495"}]}},{"id":42884,"cve_ids":["CVE-2026-88041"],"payload":{"kind":"advisory","title":"Apache Tomcat: HTTP/2 trailer header cross-contamination","summary":"Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","evidence":"cve:CVE-2026-88041","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-88041","aliases":["CVE-2026-88041"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M23","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.27","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.92","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:10:05.285Z","provider":"cve","references":["https://lists.apache.org/thread.html/dnmm9l3byytg3l66nk1jrqfrl7jty7n1"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/24"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:10:05.285Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:43:28.681Z"}}},"related_cves":[{"value":"CVE-2026-88041","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0449a8d8-b662-4e2c-9429-7f053503267e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88041","advisory_id":"0449a8d8-b662-4e2c-9429-7f053503267e","event_types":["advisory"],"published_at":"2026-10-25T11:44:43.889072+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:43:28.681+00:00","detail_url":"/advisories/advisory%3A0449a8d8-b662-4e2c-9429-7f053503267e","group":{"id":"advisory:0449a8d8-b662-4e2c-9429-7f053503267e","revision":1,"primary_event_id":42489,"change":"published","superseded_by":[],"changed":{"id":42489,"cve_ids":["CVE-2026-88041"],"payload":{"kind":"advisory","title":"Apache Tomcat: HTTP/2 trailer header cross-contamination","summary":"Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","evidence":"cve:CVE-2026-88041","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-88041","aliases":["CVE-2026-88041"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M23","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.27","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.92","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:10:05.285Z","provider":"cve","references":["https://lists.apache.org/thread.html/dnmm9l3byytg3l66nk1jrqfrl7jty7n1"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/24"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:10:05.285Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:43:28.681Z"}}},"related_cves":[{"value":"CVE-2026-88041","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0449a8d8-b662-4e2c-9429-7f053503267e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88041","advisory_id":"0449a8d8-b662-4e2c-9429-7f053503267e","event_types":["advisory"],"published_at":"2026-10-25T11:44:43.889072+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:43:28.681+00:00","detail_url":"/events/42489"},"members":[{"id":42489,"cve_ids":["CVE-2026-88041"],"payload":{"kind":"advisory","title":"Apache Tomcat: HTTP/2 trailer header cross-contamination","summary":"Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","evidence":"cve:CVE-2026-88041","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-88041","aliases":["CVE-2026-88041"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M23","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.27","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.92","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:10:05.285Z","provider":"cve","references":["https://lists.apache.org/thread.html/dnmm9l3byytg3l66nk1jrqfrl7jty7n1"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/24"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:10:05.285Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:43:28.681Z"}}},"related_cves":[{"value":"CVE-2026-88041","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:0449a8d8-b662-4e2c-9429-7f053503267e","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-88041","advisory_id":"0449a8d8-b662-4e2c-9429-7f053503267e","event_types":["advisory"],"published_at":"2026-10-25T11:44:43.889072+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:43:28.681+00:00","detail_url":"/events/42489"}]}},{"id":42875,"cve_ids":["CVE-2026-74049"],"payload":{"kind":"advisory","title":"Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE)","summary":"Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.","evidence":"cve:CVE-2026-74049","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-74049","aliases":["CVE-2026-74049"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.0.M1","versionType":"semver","lessThanOrEqual":"9.0.122"},{"status":"affected","version":"8.5.0","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"affected","version":"7.0.0","versionType":"semver","lessThanOrEqual":"7.0.109"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:10:03.349Z","provider":"cve","references":["https://lists.apache.org/thread.html/lolc9wo4tzjog2tnwctv93hz9gjcdnc6"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/22"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:10:03.349Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:37:43.471Z"}}},"related_cves":[{"value":"CVE-2026-74049","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:84ca9e82-6c0b-407c-b130-a3095dc08977","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74049","advisory_id":"84ca9e82-6c0b-407c-b130-a3095dc08977","event_types":["advisory"],"published_at":"2026-10-25T11:44:38.008785+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:37:43.471+00:00","detail_url":"/advisories/advisory%3A84ca9e82-6c0b-407c-b130-a3095dc08977","group":{"id":"advisory:84ca9e82-6c0b-407c-b130-a3095dc08977","revision":1,"primary_event_id":42480,"change":"published","superseded_by":[],"changed":{"id":42480,"cve_ids":["CVE-2026-74049"],"payload":{"kind":"advisory","title":"Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE)","summary":"Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.","evidence":"cve:CVE-2026-74049","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-74049","aliases":["CVE-2026-74049"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.0.M1","versionType":"semver","lessThanOrEqual":"9.0.122"},{"status":"affected","version":"8.5.0","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"affected","version":"7.0.0","versionType":"semver","lessThanOrEqual":"7.0.109"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:10:03.349Z","provider":"cve","references":["https://lists.apache.org/thread.html/lolc9wo4tzjog2tnwctv93hz9gjcdnc6"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/22"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:10:03.349Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:37:43.471Z"}}},"related_cves":[{"value":"CVE-2026-74049","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:84ca9e82-6c0b-407c-b130-a3095dc08977","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74049","advisory_id":"84ca9e82-6c0b-407c-b130-a3095dc08977","event_types":["advisory"],"published_at":"2026-10-25T11:44:38.008785+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:37:43.471+00:00","detail_url":"/events/42480"},"members":[{"id":42480,"cve_ids":["CVE-2026-74049"],"payload":{"kind":"advisory","title":"Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE)","summary":"Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.27, 10.1.61, 9.0.123, which fixes the issue.","evidence":"cve:CVE-2026-74049","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-74049","aliases":["CVE-2026-74049"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M1","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.0-M1","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.0.M1","versionType":"semver","lessThanOrEqual":"9.0.122"},{"status":"affected","version":"8.5.0","versionType":"semver","lessThanOrEqual":"8.5.100"},{"status":"affected","version":"7.0.0","versionType":"semver","lessThanOrEqual":"7.0.109"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:10:03.349Z","provider":"cve","references":["https://lists.apache.org/thread.html/lolc9wo4tzjog2tnwctv93hz9gjcdnc6"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/22"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:10:03.349Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:37:43.471Z"}}},"related_cves":[{"value":"CVE-2026-74049","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:84ca9e82-6c0b-407c-b130-a3095dc08977","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74049","advisory_id":"84ca9e82-6c0b-407c-b130-a3095dc08977","event_types":["advisory"],"published_at":"2026-10-25T11:44:38.008785+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:37:43.471+00:00","detail_url":"/events/42480"}]}},{"id":42874,"cve_ids":["CVE-2026-74048"],"payload":{"kind":"advisory","title":"Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up","summary":"Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","evidence":"cve:CVE-2026-74048","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-74048","aliases":["CVE-2026-74048"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M14","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.22","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.92","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:10:02.410Z","provider":"cve","references":["https://lists.apache.org/thread.html/v5ry0sx1c7x1wr5mx4cddj3p3mv1ho6m"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/21"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:10:02.410Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:36:36.859Z"}}},"related_cves":[{"value":"CVE-2026-74048","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:500c2913-7312-456f-a8ef-28818158b589","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74048","advisory_id":"500c2913-7312-456f-a8ef-28818158b589","event_types":["advisory"],"published_at":"2026-10-25T11:44:37.315585+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:36:36.859+00:00","detail_url":"/advisories/advisory%3A500c2913-7312-456f-a8ef-28818158b589","group":{"id":"advisory:500c2913-7312-456f-a8ef-28818158b589","revision":1,"primary_event_id":42479,"change":"published","superseded_by":[],"changed":{"id":42479,"cve_ids":["CVE-2026-74048"],"payload":{"kind":"advisory","title":"Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up","summary":"Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","evidence":"cve:CVE-2026-74048","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-74048","aliases":["CVE-2026-74048"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M14","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.22","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.92","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:10:02.410Z","provider":"cve","references":["https://lists.apache.org/thread.html/v5ry0sx1c7x1wr5mx4cddj3p3mv1ho6m"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/21"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:10:02.410Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:36:36.859Z"}}},"related_cves":[{"value":"CVE-2026-74048","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:500c2913-7312-456f-a8ef-28818158b589","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74048","advisory_id":"500c2913-7312-456f-a8ef-28818158b589","event_types":["advisory"],"published_at":"2026-10-25T11:44:37.315585+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:36:36.859+00:00","detail_url":"/events/42479"},"members":[{"id":42479,"cve_ids":["CVE-2026-74048"],"payload":{"kind":"advisory","title":"Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up","summary":"Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","evidence":"cve:CVE-2026-74048","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-74048","aliases":["CVE-2026-74048"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M14","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.22","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.92","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:10:02.410Z","provider":"cve","references":["https://lists.apache.org/thread.html/v5ry0sx1c7x1wr5mx4cddj3p3mv1ho6m"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/21"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:10:02.410Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:36:36.859Z"}}},"related_cves":[{"value":"CVE-2026-74048","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:500c2913-7312-456f-a8ef-28818158b589","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-74048","advisory_id":"500c2913-7312-456f-a8ef-28818158b589","event_types":["advisory"],"published_at":"2026-10-25T11:44:37.315585+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:36:36.859+00:00","detail_url":"/events/42479"}]}},{"id":42833,"cve_ids":["CVE-2026-103119"],"payload":{"kind":"advisory","title":"Apache Tomcat: AJP response mix-up","summary":"Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26. Users are recommended to upgrade to version 11.0.27, which fixes the issue.","evidence":"cve:CVE-2026-103119","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-103119","aliases":["CVE-2026-103119"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M25","versionType":"semver","lessThanOrEqual":"11.0.26"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:09:52.183Z","provider":"cve","references":["https://lists.apache.org/thread.html/sk2cg4k077fwcqbm6tqz2n700nq06h80"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-103119","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T15:41:16.526893Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T15:44:52.330Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/28"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:09:52.183Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:54:13.558Z"}}},"related_cves":[{"value":"CVE-2026-103119","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7bfaa23-265d-4f87-8b6c-8fbc405b6181","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103119","advisory_id":"e7bfaa23-265d-4f87-8b6c-8fbc405b6181","event_types":["advisory"],"published_at":"2026-10-25T11:43:27.719224+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:54:13.558+00:00","detail_url":"/advisories/advisory%3Ae7bfaa23-265d-4f87-8b6c-8fbc405b6181","group":{"id":"advisory:e7bfaa23-265d-4f87-8b6c-8fbc405b6181","revision":1,"primary_event_id":42438,"change":"published","superseded_by":[],"changed":{"id":42438,"cve_ids":["CVE-2026-103119"],"payload":{"kind":"advisory","title":"Apache Tomcat: AJP response mix-up","summary":"Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26. Users are recommended to upgrade to version 11.0.27, which fixes the issue.","evidence":"cve:CVE-2026-103119","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-103119","aliases":["CVE-2026-103119"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M25","versionType":"semver","lessThanOrEqual":"11.0.26"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:09:52.183Z","provider":"cve","references":["https://lists.apache.org/thread.html/sk2cg4k077fwcqbm6tqz2n700nq06h80"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-103119","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T15:41:16.526893Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T15:44:52.330Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/28"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:09:52.183Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:54:13.558Z"}}},"related_cves":[{"value":"CVE-2026-103119","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7bfaa23-265d-4f87-8b6c-8fbc405b6181","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103119","advisory_id":"e7bfaa23-265d-4f87-8b6c-8fbc405b6181","event_types":["advisory"],"published_at":"2026-10-25T11:43:27.719224+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:54:13.558+00:00","detail_url":"/events/42438"},"members":[{"id":42438,"cve_ids":["CVE-2026-103119"],"payload":{"kind":"advisory","title":"Apache Tomcat: AJP response mix-up","summary":"Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second. This issue affects Apache Tomcat: from 11.0.0-M25 through 11.0.26. Users are recommended to upgrade to version 11.0.27, which fixes the issue.","evidence":"cve:CVE-2026-103119","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-103119","aliases":["CVE-2026-103119"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.0-M25","versionType":"semver","lessThanOrEqual":"11.0.26"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:09:52.183Z","provider":"cve","references":["https://lists.apache.org/thread.html/sk2cg4k077fwcqbm6tqz2n700nq06h80"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-103119","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T15:41:16.526893Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T15:44:52.330Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/28"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:09:52.183Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:54:13.558Z"}}},"related_cves":[{"value":"CVE-2026-103119","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e7bfaa23-265d-4f87-8b6c-8fbc405b6181","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-103119","advisory_id":"e7bfaa23-265d-4f87-8b6c-8fbc405b6181","event_types":["advisory"],"published_at":"2026-10-25T11:43:27.719224+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:54:13.558+00:00","detail_url":"/events/42438"}]}},{"id":42831,"cve_ids":["CVE-2026-101356"],"payload":{"kind":"advisory","title":"Apache Tomcat: HTTP/2 request/response mix-up after error during async processing","summary":"Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.","evidence":"cve:CVE-2026-101356","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-101356","aliases":["CVE-2026-101356"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.22","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.55","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.118","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:17:42.030Z","provider":"cve","references":["https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/27"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:09:51.253Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-101356","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T18:17:35.437643Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-362","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T18:17:42.030Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:46:50.842Z"}}},"related_cves":[{"value":"CVE-2026-101356","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b61a7ff4-449f-4882-b4d7-42516acb8bb3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101356","advisory_id":"b61a7ff4-449f-4882-b4d7-42516acb8bb3","event_types":["advisory"],"published_at":"2026-10-25T11:43:26.440477+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:46:50.842+00:00","detail_url":"/advisories/advisory%3Ab61a7ff4-449f-4882-b4d7-42516acb8bb3","group":{"id":"advisory:b61a7ff4-449f-4882-b4d7-42516acb8bb3","revision":1,"primary_event_id":42436,"change":"published","superseded_by":[],"changed":{"id":42436,"cve_ids":["CVE-2026-101356"],"payload":{"kind":"advisory","title":"Apache Tomcat: HTTP/2 request/response mix-up after error during async processing","summary":"Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.","evidence":"cve:CVE-2026-101356","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-101356","aliases":["CVE-2026-101356"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.22","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.55","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.118","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:17:42.030Z","provider":"cve","references":["https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/27"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:09:51.253Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-101356","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T18:17:35.437643Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-362","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T18:17:42.030Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:46:50.842Z"}}},"related_cves":[{"value":"CVE-2026-101356","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b61a7ff4-449f-4882-b4d7-42516acb8bb3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101356","advisory_id":"b61a7ff4-449f-4882-b4d7-42516acb8bb3","event_types":["advisory"],"published_at":"2026-10-25T11:43:26.440477+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:46:50.842+00:00","detail_url":"/events/42436"},"members":[{"id":42436,"cve_ids":["CVE-2026-101356"],"payload":{"kind":"advisory","title":"Apache Tomcat: HTTP/2 request/response mix-up after error during async processing","summary":"Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fixes the issue.","evidence":"cve:CVE-2026-101356","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-101356","aliases":["CVE-2026-101356"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"11.0.22","versionType":"semver","lessThanOrEqual":"11.0.26"},{"status":"affected","version":"10.1.55","versionType":"semver","lessThanOrEqual":"10.1.60"},{"status":"affected","version":"9.0.118","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T18:17:42.030Z","provider":"cve","references":["https://lists.apache.org/thread.html/d1xjt7bbjqw7y7n5mcb4fm815hpfgc27"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/27"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-10-20T18:09:51.253Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.1,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2026-101356","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-20T18:17:35.437643Z"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-362","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-20T18:17:42.030Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:46:50.842Z"}}},"related_cves":[{"value":"CVE-2026-101356","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b61a7ff4-449f-4882-b4d7-42516acb8bb3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101356","advisory_id":"b61a7ff4-449f-4882-b4d7-42516acb8bb3","event_types":["advisory"],"published_at":"2026-10-25T11:43:26.440477+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:46:50.842+00:00","detail_url":"/events/42436"}]}},{"id":42571,"cve_ids":["CVE-2026-80353"],"payload":{"kind":"advisory","title":"Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector","summary":"Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.","evidence":"cve:CVE-2026-80353","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-80353","aliases":["CVE-2026-80353"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.47","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T13:42:05.844Z","provider":"cve","references":["https://lists.apache.org/thread.html/tr0q87qwvs80p9hc53tkwpzvnx0ywftr"],"provider_metadata":{"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:42:05.844Z"}}},"related_cves":[{"value":"CVE-2026-80353","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3620fb1e-a06c-4158-b759-4f2616367ee1","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80353","advisory_id":"3620fb1e-a06c-4158-b759-4f2616367ee1","event_types":["advisory"],"published_at":"2026-10-25T11:40:01.301715+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:42:05.844+00:00","detail_url":"/advisories/advisory%3A3620fb1e-a06c-4158-b759-4f2616367ee1","group":{"id":"advisory:3620fb1e-a06c-4158-b759-4f2616367ee1","revision":1,"primary_event_id":42179,"change":"published","superseded_by":[],"changed":{"id":42179,"cve_ids":["CVE-2026-80353"],"payload":{"kind":"advisory","title":"Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector","summary":"Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.","evidence":"cve:CVE-2026-80353","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-80353","aliases":["CVE-2026-80353"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.47","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T13:42:05.844Z","provider":"cve","references":["https://lists.apache.org/thread.html/tr0q87qwvs80p9hc53tkwpzvnx0ywftr"],"provider_metadata":{"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:42:05.844Z"}}},"related_cves":[{"value":"CVE-2026-80353","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3620fb1e-a06c-4158-b759-4f2616367ee1","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80353","advisory_id":"3620fb1e-a06c-4158-b759-4f2616367ee1","event_types":["advisory"],"published_at":"2026-10-25T11:40:01.301715+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:42:05.844+00:00","detail_url":"/events/42179"},"members":[{"id":42179,"cve_ids":["CVE-2026-80353"],"payload":{"kind":"advisory","title":"Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector","summary":"Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.","evidence":"cve:CVE-2026-80353","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-80353","aliases":["CVE-2026-80353"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.47","versionType":"semver","lessThanOrEqual":"9.0.122"}],"defaultStatus":"unaffected"}],"modified":"2026-10-20T13:42:05.844Z","provider":"cve","references":["https://lists.apache.org/thread.html/tr0q87qwvs80p9hc53tkwpzvnx0ywftr"],"provider_metadata":{"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-10-20T13:42:05.844Z"}}},"related_cves":[{"value":"CVE-2026-80353","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3620fb1e-a06c-4158-b759-4f2616367ee1","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-80353","advisory_id":"3620fb1e-a06c-4158-b759-4f2616367ee1","event_types":["advisory"],"published_at":"2026-10-25T11:40:01.301715+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-20T13:42:05.844+00:00","detail_url":"/events/42179"}]}},{"id":30172,"cve_ids":["CVE-2018-8014"],"payload":{"kind":"advisory","title":"CVE-2018-8014","summary":"The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.","evidence":"cve:CVE-2018-8014","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-8014","aliases":["CVE-2018-8014"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.8"},{"status":"affected","version":"8.5.0 to 8.5.31"},{"status":"affected","version":"8.0.0.RC1 to 8.0.52"},{"status":"affected","version":"7.0.41 to 7.0.88"}]}],"modified":"2026-10-15T17:44:12.176Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2019:0451","https://access.redhat.com/errata/RHSA-2018:2469","https://usn.ubuntu.com/3665-1/","https://access.redhat.com/errata/RHSA-2018:2470","https://security.netapp.com/advisory/ntap-20181018-0002/","https://access.redhat.com/errata/RHSA-2019:0450","https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://access.redhat.com/errata/RHSA-2018:3768","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://access.redhat.com/errata/RHSA-2019:1529","https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E","https://access.redhat.com/errata/RHSA-2019:2205","https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","https://www.debian.org/security/2019/dsa-4596","https://seclists.org/bugtraq/2019/Dec/43","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://tomcat.apache.org/security-9.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0451","name":"RHSA-2019:0451","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2469","name":"RHSA-2018:2469","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securitytracker.com/id/1041888","name":"1041888","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://usn.ubuntu.com/3665-1/","name":"USN-3665-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://tomcat.apache.org/security-8.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2470","name":"RHSA-2018:2470","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20181018-0002/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0450","name":"RHSA-2019:0450","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.securityfocus.com/bid/104203","name":"104203","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securitytracker.com/id/1040998","name":"1040998","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3768","name":"RHSA-2018:3768","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1529","name":"RHSA-2019:1529","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E","name":"[activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars.","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2205","name":"RHSA-2019:2205","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","name":"[debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2019/dsa-4596","name":"DSA-4596","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://seclists.org/bugtraq/2019/Dec/43","name":"20191229 [SECURITY] [DSA 4596-1] tomcat8 security update","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T06:46:11.468Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-8014","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:43:39.226464Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:44:12.176Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-04-15T21:06:47.000Z"}}},"related_cves":[{"value":"CVE-2018-8014","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2f22da5f-72c3-4f12-a670-c8ad4ef39778","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-8014","advisory_id":"2f22da5f-72c3-4f12-a670-c8ad4ef39778","event_types":["advisory"],"published_at":"2026-10-25T08:07:36.162728+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-05-16T16:00:00+00:00","detail_url":"/advisories/advisory%3A2f22da5f-72c3-4f12-a670-c8ad4ef39778","group":{"id":"advisory:2f22da5f-72c3-4f12-a670-c8ad4ef39778","revision":1,"primary_event_id":29928,"change":"published","superseded_by":[],"changed":{"id":29928,"cve_ids":["CVE-2018-8014"],"payload":{"kind":"advisory","title":"CVE-2018-8014","summary":"The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.","evidence":"cve:CVE-2018-8014","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-8014","aliases":["CVE-2018-8014"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.8"},{"status":"affected","version":"8.5.0 to 8.5.31"},{"status":"affected","version":"8.0.0.RC1 to 8.0.52"},{"status":"affected","version":"7.0.41 to 7.0.88"}]}],"modified":"2026-10-15T17:44:12.176Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2019:0451","https://access.redhat.com/errata/RHSA-2018:2469","https://usn.ubuntu.com/3665-1/","https://access.redhat.com/errata/RHSA-2018:2470","https://security.netapp.com/advisory/ntap-20181018-0002/","https://access.redhat.com/errata/RHSA-2019:0450","https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://access.redhat.com/errata/RHSA-2018:3768","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://access.redhat.com/errata/RHSA-2019:1529","https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E","https://access.redhat.com/errata/RHSA-2019:2205","https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","https://www.debian.org/security/2019/dsa-4596","https://seclists.org/bugtraq/2019/Dec/43","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://tomcat.apache.org/security-9.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0451","name":"RHSA-2019:0451","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2469","name":"RHSA-2018:2469","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securitytracker.com/id/1041888","name":"1041888","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://usn.ubuntu.com/3665-1/","name":"USN-3665-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://tomcat.apache.org/security-8.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2470","name":"RHSA-2018:2470","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20181018-0002/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0450","name":"RHSA-2019:0450","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.securityfocus.com/bid/104203","name":"104203","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securitytracker.com/id/1040998","name":"1040998","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3768","name":"RHSA-2018:3768","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1529","name":"RHSA-2019:1529","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E","name":"[activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars.","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2205","name":"RHSA-2019:2205","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","name":"[debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2019/dsa-4596","name":"DSA-4596","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://seclists.org/bugtraq/2019/Dec/43","name":"20191229 [SECURITY] [DSA 4596-1] tomcat8 security update","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T06:46:11.468Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-8014","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:43:39.226464Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:44:12.176Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-04-15T21:06:47.000Z"}}},"related_cves":[{"value":"CVE-2018-8014","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2f22da5f-72c3-4f12-a670-c8ad4ef39778","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-8014","advisory_id":"2f22da5f-72c3-4f12-a670-c8ad4ef39778","event_types":["advisory"],"published_at":"2026-10-25T08:07:36.162728+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-05-16T16:00:00+00:00","detail_url":"/events/29928"},"members":[{"id":29928,"cve_ids":["CVE-2018-8014"],"payload":{"kind":"advisory","title":"CVE-2018-8014","summary":"The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.","evidence":"cve:CVE-2018-8014","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-8014","aliases":["CVE-2018-8014"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.8"},{"status":"affected","version":"8.5.0 to 8.5.31"},{"status":"affected","version":"8.0.0.RC1 to 8.0.52"},{"status":"affected","version":"7.0.41 to 7.0.88"}]}],"modified":"2026-10-15T17:44:12.176Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2019:0451","https://access.redhat.com/errata/RHSA-2018:2469","https://usn.ubuntu.com/3665-1/","https://access.redhat.com/errata/RHSA-2018:2470","https://security.netapp.com/advisory/ntap-20181018-0002/","https://access.redhat.com/errata/RHSA-2019:0450","https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://access.redhat.com/errata/RHSA-2018:3768","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://access.redhat.com/errata/RHSA-2019:1529","https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E","https://access.redhat.com/errata/RHSA-2019:2205","https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","https://www.debian.org/security/2019/dsa-4596","https://seclists.org/bugtraq/2019/Dec/43","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://tomcat.apache.org/security-9.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0451","name":"RHSA-2019:0451","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2469","name":"RHSA-2018:2469","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securitytracker.com/id/1041888","name":"1041888","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://usn.ubuntu.com/3665-1/","name":"USN-3665-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://tomcat.apache.org/security-8.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2470","name":"RHSA-2018:2470","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20181018-0002/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0450","name":"RHSA-2019:0450","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.securityfocus.com/bid/104203","name":"104203","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securitytracker.com/id/1040998","name":"1040998","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3768","name":"RHSA-2018:3768","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1529","name":"RHSA-2019:1529","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ac51944aef91dd5006b8510b0bef337adaccfe962fb90e7af9c22db4%40%3Cissues.activemq.apache.org%3E","name":"[activemq-issues] 20190723 [jira] [Created] (AMQ-7249) Security Vulnerabilities in the ActiveMQ dependent jars.","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2205","name":"RHSA-2019:2205","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html","name":"[debian-lts-announce] 20190813 [SECURITY] [DLA 1883-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2019/dsa-4596","name":"DSA-4596","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://seclists.org/bugtraq/2019/Dec/43","name":"20191229 [SECURITY] [DSA 4596-1] tomcat8 security update","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T06:46:11.468Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-8014","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:43:39.226464Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:44:12.176Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-04-15T21:06:47.000Z"}}},"related_cves":[{"value":"CVE-2018-8014","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2f22da5f-72c3-4f12-a670-c8ad4ef39778","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-8014","advisory_id":"2f22da5f-72c3-4f12-a670-c8ad4ef39778","event_types":["advisory"],"published_at":"2026-10-25T08:07:36.162728+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-05-16T16:00:00+00:00","detail_url":"/events/29928"}]}},{"id":30145,"cve_ids":["CVE-2018-1305"],"payload":{"kind":"advisory","title":"CVE-2018-1305","summary":"Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.","evidence":"cve:CVE-2018-1305","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-1305","aliases":["CVE-2018-1305"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84"}]}],"modified":"2026-10-15T17:32:20.933Z","provider":"cve","references":["https://security.netapp.com/advisory/ntap-20180706-0001/","https://www.debian.org/security/2018/dsa-4281","https://access.redhat.com/errata/RHSA-2018:2939","https://access.redhat.com/errata/RHSA-2018:0465","https://usn.ubuntu.com/3665-1/","https://access.redhat.com/errata/RHSA-2018:1320","https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","https://access.redhat.com/errata/RHSA-2018:0466","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://access.redhat.com/errata/RHSA-2019:2205","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.securityfocus.com/bid/103144","name":"103144","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180706-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4281","name":"DSA-4281","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2939","name":"RHSA-2018:2939","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","name":"RHSA-2018:0465","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://usn.ubuntu.com/3665-1/","name":"USN-3665-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1320","name":"RHSA-2018:1320","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","name":"[debian-lts-announce] 20180306 [SECURITY] [DLA 1301-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","name":"[debian-lts-announce] 20180729 [SECURITY] [DLA 1450-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","name":"RHSA-2018:0466","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.securitytracker.com/id/1040428","name":"1040428","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2205","name":"RHSA-2019:2205","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T03:59:38.832Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-1305","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:32:12.734149Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:32:20.933Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-04-15T21:06:46.000Z"}}},"related_cves":[{"value":"CVE-2018-1305","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1ec83b0c-7246-4b23-ab07-804bc664de10","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-1305","advisory_id":"1ec83b0c-7246-4b23-ab07-804bc664de10","event_types":["advisory"],"published_at":"2026-10-25T08:06:42.885245+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-02-23T23:00:00+00:00","detail_url":"/advisories/advisory%3A1ec83b0c-7246-4b23-ab07-804bc664de10","group":{"id":"advisory:1ec83b0c-7246-4b23-ab07-804bc664de10","revision":1,"primary_event_id":29901,"change":"published","superseded_by":[],"changed":{"id":29901,"cve_ids":["CVE-2018-1305"],"payload":{"kind":"advisory","title":"CVE-2018-1305","summary":"Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.","evidence":"cve:CVE-2018-1305","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-1305","aliases":["CVE-2018-1305"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84"}]}],"modified":"2026-10-15T17:32:20.933Z","provider":"cve","references":["https://security.netapp.com/advisory/ntap-20180706-0001/","https://www.debian.org/security/2018/dsa-4281","https://access.redhat.com/errata/RHSA-2018:2939","https://access.redhat.com/errata/RHSA-2018:0465","https://usn.ubuntu.com/3665-1/","https://access.redhat.com/errata/RHSA-2018:1320","https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","https://access.redhat.com/errata/RHSA-2018:0466","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://access.redhat.com/errata/RHSA-2019:2205","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.securityfocus.com/bid/103144","name":"103144","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180706-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4281","name":"DSA-4281","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2939","name":"RHSA-2018:2939","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","name":"RHSA-2018:0465","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://usn.ubuntu.com/3665-1/","name":"USN-3665-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1320","name":"RHSA-2018:1320","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","name":"[debian-lts-announce] 20180306 [SECURITY] [DLA 1301-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","name":"[debian-lts-announce] 20180729 [SECURITY] [DLA 1450-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","name":"RHSA-2018:0466","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.securitytracker.com/id/1040428","name":"1040428","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2205","name":"RHSA-2019:2205","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T03:59:38.832Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-1305","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:32:12.734149Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:32:20.933Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-04-15T21:06:46.000Z"}}},"related_cves":[{"value":"CVE-2018-1305","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1ec83b0c-7246-4b23-ab07-804bc664de10","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-1305","advisory_id":"1ec83b0c-7246-4b23-ab07-804bc664de10","event_types":["advisory"],"published_at":"2026-10-25T08:06:42.885245+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-02-23T23:00:00+00:00","detail_url":"/events/29901"},"members":[{"id":29901,"cve_ids":["CVE-2018-1305"],"payload":{"kind":"advisory","title":"CVE-2018-1305","summary":"Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.","evidence":"cve:CVE-2018-1305","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-1305","aliases":["CVE-2018-1305"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84"}]}],"modified":"2026-10-15T17:32:20.933Z","provider":"cve","references":["https://security.netapp.com/advisory/ntap-20180706-0001/","https://www.debian.org/security/2018/dsa-4281","https://access.redhat.com/errata/RHSA-2018:2939","https://access.redhat.com/errata/RHSA-2018:0465","https://usn.ubuntu.com/3665-1/","https://access.redhat.com/errata/RHSA-2018:1320","https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","https://access.redhat.com/errata/RHSA-2018:0466","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://access.redhat.com/errata/RHSA-2019:2205","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.securityfocus.com/bid/103144","name":"103144","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180706-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4281","name":"DSA-4281","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2939","name":"RHSA-2018:2939","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","name":"RHSA-2018:0465","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://usn.ubuntu.com/3665-1/","name":"USN-3665-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1320","name":"RHSA-2018:1320","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","name":"[debian-lts-announce] 20180306 [SECURITY] [DLA 1301-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/d3354bb0a4eda4acc0a66f3eb24a213fdb75d12c7d16060b23e65781%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","name":"[debian-lts-announce] 20180729 [SECURITY] [DLA 1450-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","name":"RHSA-2018:0466","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.securitytracker.com/id/1040428","name":"1040428","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2205","name":"RHSA-2019:2205","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T03:59:38.832Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-1305","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:32:12.734149Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:32:20.933Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-04-15T21:06:46.000Z"}}},"related_cves":[{"value":"CVE-2018-1305","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1ec83b0c-7246-4b23-ab07-804bc664de10","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-1305","advisory_id":"1ec83b0c-7246-4b23-ab07-804bc664de10","event_types":["advisory"],"published_at":"2026-10-25T08:06:42.885245+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-02-23T23:00:00+00:00","detail_url":"/events/29901"}]}},{"id":30143,"cve_ids":["CVE-2018-1304"],"payload":{"kind":"advisory","title":"CVE-2018-1304","summary":"The URL pattern of \"\" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.","evidence":"cve:CVE-2018-1304","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-1304","aliases":["CVE-2018-1304"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84"}]}],"modified":"2026-10-15T17:31:46.613Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2018:1448","https://security.netapp.com/advisory/ntap-20180706-0001/","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb%40%3Cannounce.tomcat.apache.org%3E","https://www.debian.org/security/2018/dsa-4281","https://access.redhat.com/errata/RHSA-2018:2939","https://access.redhat.com/errata/RHSA-2018:0465","https://usn.ubuntu.com/3665-1/","https://access.redhat.com/errata/RHSA-2018:1320","https://access.redhat.com/errata/RHSA-2018:1451","https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","https://access.redhat.com/errata/RHSA-2018:0466","https://access.redhat.com/errata/RHSA-2018:1447","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://access.redhat.com/errata/RHSA-2019:2205","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2018:1448","name":"RHSA-2018:1448","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180706-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/103170","name":"103170","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1449","name":"RHSA-2018:1449","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1450","name":"RHSA-2018:1450","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4281","name":"DSA-4281","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2939","name":"RHSA-2018:2939","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","name":"RHSA-2018:0465","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://usn.ubuntu.com/3665-1/","name":"USN-3665-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://www.securitytracker.com/id/1040427","name":"1040427","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1320","name":"RHSA-2018:1320","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1451","name":"RHSA-2018:1451","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","name":"[debian-lts-announce] 20180306 [SECURITY] [DLA 1301-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","name":"[debian-lts-announce] 20180729 [SECURITY] [DLA 1450-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","name":"RHSA-2018:0466","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1447","name":"RHSA-2018:1447","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2205","name":"RHSA-2019:2205","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T03:59:37.867Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-1304","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:31:35.831075Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:31:46.613Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-04-15T21:06:45.000Z"}}},"related_cves":[{"value":"CVE-2018-1304","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:98cf929e-c39f-412a-b1da-c23ef41568da","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-1304","advisory_id":"98cf929e-c39f-412a-b1da-c23ef41568da","event_types":["advisory"],"published_at":"2026-10-25T08:06:41.68214+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-02-28T20:00:00+00:00","detail_url":"/advisories/advisory%3A98cf929e-c39f-412a-b1da-c23ef41568da","group":{"id":"advisory:98cf929e-c39f-412a-b1da-c23ef41568da","revision":1,"primary_event_id":29899,"change":"published","superseded_by":[],"changed":{"id":29899,"cve_ids":["CVE-2018-1304"],"payload":{"kind":"advisory","title":"CVE-2018-1304","summary":"The URL pattern of \"\" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.","evidence":"cve:CVE-2018-1304","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-1304","aliases":["CVE-2018-1304"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84"}]}],"modified":"2026-10-15T17:31:46.613Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2018:1448","https://security.netapp.com/advisory/ntap-20180706-0001/","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb%40%3Cannounce.tomcat.apache.org%3E","https://www.debian.org/security/2018/dsa-4281","https://access.redhat.com/errata/RHSA-2018:2939","https://access.redhat.com/errata/RHSA-2018:0465","https://usn.ubuntu.com/3665-1/","https://access.redhat.com/errata/RHSA-2018:1320","https://access.redhat.com/errata/RHSA-2018:1451","https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","https://access.redhat.com/errata/RHSA-2018:0466","https://access.redhat.com/errata/RHSA-2018:1447","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://access.redhat.com/errata/RHSA-2019:2205","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2018:1448","name":"RHSA-2018:1448","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180706-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/103170","name":"103170","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1449","name":"RHSA-2018:1449","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1450","name":"RHSA-2018:1450","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4281","name":"DSA-4281","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2939","name":"RHSA-2018:2939","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","name":"RHSA-2018:0465","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://usn.ubuntu.com/3665-1/","name":"USN-3665-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://www.securitytracker.com/id/1040427","name":"1040427","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1320","name":"RHSA-2018:1320","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1451","name":"RHSA-2018:1451","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","name":"[debian-lts-announce] 20180306 [SECURITY] [DLA 1301-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","name":"[debian-lts-announce] 20180729 [SECURITY] [DLA 1450-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","name":"RHSA-2018:0466","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1447","name":"RHSA-2018:1447","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2205","name":"RHSA-2019:2205","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T03:59:37.867Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-1304","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:31:35.831075Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:31:46.613Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-04-15T21:06:45.000Z"}}},"related_cves":[{"value":"CVE-2018-1304","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:98cf929e-c39f-412a-b1da-c23ef41568da","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-1304","advisory_id":"98cf929e-c39f-412a-b1da-c23ef41568da","event_types":["advisory"],"published_at":"2026-10-25T08:06:41.68214+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-02-28T20:00:00+00:00","detail_url":"/events/29899"},"members":[{"id":29899,"cve_ids":["CVE-2018-1304"],"payload":{"kind":"advisory","title":"CVE-2018-1304","summary":"The URL pattern of \"\" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected.","evidence":"cve:CVE-2018-1304","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-1304","aliases":["CVE-2018-1304"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49, 7.0.0 to 7.0.84"}]}],"modified":"2026-10-15T17:31:46.613Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2018:1448","https://security.netapp.com/advisory/ntap-20180706-0001/","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb%40%3Cannounce.tomcat.apache.org%3E","https://www.debian.org/security/2018/dsa-4281","https://access.redhat.com/errata/RHSA-2018:2939","https://access.redhat.com/errata/RHSA-2018:0465","https://usn.ubuntu.com/3665-1/","https://access.redhat.com/errata/RHSA-2018:1320","https://access.redhat.com/errata/RHSA-2018:1451","https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","https://access.redhat.com/errata/RHSA-2018:0466","https://access.redhat.com/errata/RHSA-2018:1447","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://access.redhat.com/errata/RHSA-2019:2205","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2018:1448","name":"RHSA-2018:1448","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180706-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/103170","name":"103170","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1449","name":"RHSA-2018:1449","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1450","name":"RHSA-2018:1450","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.debian.org/security/2018/dsa-4281","name":"DSA-4281","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2939","name":"RHSA-2018:2939","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","name":"RHSA-2018:0465","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://usn.ubuntu.com/3665-1/","name":"USN-3665-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://www.securitytracker.com/id/1040427","name":"1040427","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1320","name":"RHSA-2018:1320","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1451","name":"RHSA-2018:1451","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00004.html","name":"[debian-lts-announce] 20180306 [SECURITY] [DLA 1301-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00044.html","name":"[debian-lts-announce] 20180729 [SECURITY] [DLA 1450-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","name":"RHSA-2018:0466","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1447","name":"RHSA-2018:1447","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2205","name":"RHSA-2019:2205","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T03:59:37.867Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-1304","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T17:31:35.831075Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:31:46.613Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-04-15T21:06:45.000Z"}}},"related_cves":[{"value":"CVE-2018-1304","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:98cf929e-c39f-412a-b1da-c23ef41568da","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-1304","advisory_id":"98cf929e-c39f-412a-b1da-c23ef41568da","event_types":["advisory"],"published_at":"2026-10-25T08:06:41.68214+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-02-28T20:00:00+00:00","detail_url":"/events/29899"}]}},{"id":30125,"cve_ids":["CVE-2018-11784"],"payload":{"kind":"advisory","title":"CVE-2018-11784","summary":"When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.","evidence":"cve:CVE-2018-11784","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-11784","aliases":["CVE-2018-11784"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.11"},{"status":"affected","version":"8.5.0 to 8.5.33"},{"status":"affected","version":"7.0.23 to 7.0.90"}]}],"modified":"2026-10-15T17:21:32.749Z","provider":"cve","references":["https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75%40%3Cannounce.tomcat.apache.org%3E","https://security.netapp.com/advisory/ntap-20181014-0002/","https://access.redhat.com/errata/RHSA-2019:0131","https://access.redhat.com/errata/RHSA-2019:0485","https://access.redhat.com/errata/RHSA-2019:0130","https://lists.debian.org/debian-lts-announce/2018/10/msg00005.html","https://usn.ubuntu.com/3787-1/","https://lists.debian.org/debian-lts-announce/2018/10/msg00006.html","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ4PX4B3QTKRM35VJAVIEOPZAF76RPBP/","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHSA-2019:1529","https://kc.mcafee.com/corporate/index?page=content&id=SB10284","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.debian.org/security/2019/dsa-4596","https://seclists.org/bugtraq/2019/Dec/43","https://www.oracle.com/security-alerts/cpujan2020.html","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75%40%3Cannounce.tomcat.apache.org%3E","name":"[announce] 20181003 [SECURITY] CVE-2018-11784 Apache Tomcat - Open Redirect","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20181014-0002/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/105524","name":"105524","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0131","name":"RHSA-2019:0131","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0485","name":"RHSA-2019:0485","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0130","name":"RHSA-2019:0130","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/10/msg00005.html","name":"[debian-lts-announce] 20181014 [SECURITY] [DLA 1544-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://usn.ubuntu.com/3787-1/","name":"USN-3787-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/10/msg00006.html","name":"[debian-lts-announce] 20181015 [SECURITY] [DLA 1545-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ4PX4B3QTKRM35VJAVIEOPZAF76RPBP/","name":"FEDORA-2018-b18f9dd65b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","name":"openSUSE-SU-2019:1547","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1529","name":"RHSA-2019:1529","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10284","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","name":"openSUSE-SU-2019:1814","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.debian.org/security/2019/dsa-4596","name":"DSA-4596","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://seclists.org/bugtraq/2019/Dec/43","name":"20191229 [SECURITY] [DSA 4596-1] tomcat8 security update","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T08:17:09.268Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-11784","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-06-04T14:25:28.780057Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:21:32.749Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2021-07-13T16:06:19.000Z"}}},"related_cves":[{"value":"CVE-2018-11784","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9a386a48-aa80-4055-bae6-fc4382a29844","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-11784","advisory_id":"9a386a48-aa80-4055-bae6-fc4382a29844","event_types":["advisory"],"published_at":"2026-10-25T08:06:28.579229+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-10-04T13:00:00+00:00","detail_url":"/advisories/advisory%3A9a386a48-aa80-4055-bae6-fc4382a29844","group":{"id":"advisory:9a386a48-aa80-4055-bae6-fc4382a29844","revision":1,"primary_event_id":29882,"change":"published","superseded_by":[],"changed":{"id":29882,"cve_ids":["CVE-2018-11784"],"payload":{"kind":"advisory","title":"CVE-2018-11784","summary":"When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.","evidence":"cve:CVE-2018-11784","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-11784","aliases":["CVE-2018-11784"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.11"},{"status":"affected","version":"8.5.0 to 8.5.33"},{"status":"affected","version":"7.0.23 to 7.0.90"}]}],"modified":"2026-10-15T17:21:32.749Z","provider":"cve","references":["https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75%40%3Cannounce.tomcat.apache.org%3E","https://security.netapp.com/advisory/ntap-20181014-0002/","https://access.redhat.com/errata/RHSA-2019:0131","https://access.redhat.com/errata/RHSA-2019:0485","https://access.redhat.com/errata/RHSA-2019:0130","https://lists.debian.org/debian-lts-announce/2018/10/msg00005.html","https://usn.ubuntu.com/3787-1/","https://lists.debian.org/debian-lts-announce/2018/10/msg00006.html","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ4PX4B3QTKRM35VJAVIEOPZAF76RPBP/","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHSA-2019:1529","https://kc.mcafee.com/corporate/index?page=content&id=SB10284","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.debian.org/security/2019/dsa-4596","https://seclists.org/bugtraq/2019/Dec/43","https://www.oracle.com/security-alerts/cpujan2020.html","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75%40%3Cannounce.tomcat.apache.org%3E","name":"[announce] 20181003 [SECURITY] CVE-2018-11784 Apache Tomcat - Open Redirect","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20181014-0002/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/105524","name":"105524","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0131","name":"RHSA-2019:0131","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0485","name":"RHSA-2019:0485","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0130","name":"RHSA-2019:0130","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/10/msg00005.html","name":"[debian-lts-announce] 20181014 [SECURITY] [DLA 1544-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://usn.ubuntu.com/3787-1/","name":"USN-3787-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/10/msg00006.html","name":"[debian-lts-announce] 20181015 [SECURITY] [DLA 1545-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ4PX4B3QTKRM35VJAVIEOPZAF76RPBP/","name":"FEDORA-2018-b18f9dd65b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","name":"openSUSE-SU-2019:1547","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1529","name":"RHSA-2019:1529","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10284","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","name":"openSUSE-SU-2019:1814","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.debian.org/security/2019/dsa-4596","name":"DSA-4596","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://seclists.org/bugtraq/2019/Dec/43","name":"20191229 [SECURITY] [DSA 4596-1] tomcat8 security update","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T08:17:09.268Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-11784","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-06-04T14:25:28.780057Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:21:32.749Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2021-07-13T16:06:19.000Z"}}},"related_cves":[{"value":"CVE-2018-11784","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9a386a48-aa80-4055-bae6-fc4382a29844","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-11784","advisory_id":"9a386a48-aa80-4055-bae6-fc4382a29844","event_types":["advisory"],"published_at":"2026-10-25T08:06:28.579229+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-10-04T13:00:00+00:00","detail_url":"/events/29882"},"members":[{"id":29882,"cve_ids":["CVE-2018-11784"],"payload":{"kind":"advisory","title":"CVE-2018-11784","summary":"When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.","evidence":"cve:CVE-2018-11784","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-11784","aliases":["CVE-2018-11784"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.11"},{"status":"affected","version":"8.5.0 to 8.5.33"},{"status":"affected","version":"7.0.23 to 7.0.90"}]}],"modified":"2026-10-15T17:21:32.749Z","provider":"cve","references":["https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75%40%3Cannounce.tomcat.apache.org%3E","https://security.netapp.com/advisory/ntap-20181014-0002/","https://access.redhat.com/errata/RHSA-2019:0131","https://access.redhat.com/errata/RHSA-2019:0485","https://access.redhat.com/errata/RHSA-2019:0130","https://lists.debian.org/debian-lts-announce/2018/10/msg00005.html","https://usn.ubuntu.com/3787-1/","https://lists.debian.org/debian-lts-announce/2018/10/msg00006.html","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ4PX4B3QTKRM35VJAVIEOPZAF76RPBP/","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHSA-2019:1529","https://kc.mcafee.com/corporate/index?page=content&id=SB10284","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.debian.org/security/2019/dsa-4596","https://seclists.org/bugtraq/2019/Dec/43","https://www.oracle.com/security-alerts/cpujan2020.html","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/23134c9b5a23892a205dc140cdd8c9c0add233600f76b313dda6bd75%40%3Cannounce.tomcat.apache.org%3E","name":"[announce] 20181003 [SECURITY] CVE-2018-11784 Apache Tomcat - Open Redirect","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20181014-0002/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/105524","name":"105524","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0131","name":"RHSA-2019:0131","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0485","name":"RHSA-2019:0485","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0130","name":"RHSA-2019:0130","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/10/msg00005.html","name":"[debian-lts-announce] 20181014 [SECURITY] [DLA 1544-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://usn.ubuntu.com/3787-1/","name":"USN-3787-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/10/msg00006.html","name":"[debian-lts-announce] 20181015 [SECURITY] [DLA 1545-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZ4PX4B3QTKRM35VJAVIEOPZAF76RPBP/","name":"FEDORA-2018-b18f9dd65b","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","name":"openSUSE-SU-2019:1547","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1529","name":"RHSA-2019:1529","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10284","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","name":"openSUSE-SU-2019:1814","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.debian.org/security/2019/dsa-4596","name":"DSA-4596","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://seclists.org/bugtraq/2019/Dec/43","name":"20191229 [SECURITY] [DSA 4596-1] tomcat8 security update","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://packetstormsecurity.com/files/163456/Apache-Tomcat-9.0.0M1-Open-Redirect.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T08:17:09.268Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2018-11784","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2025-06-04T14:25:28.780057Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T17:21:32.749Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2021-07-13T16:06:19.000Z"}}},"related_cves":[{"value":"CVE-2018-11784","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9a386a48-aa80-4055-bae6-fc4382a29844","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2018-11784","advisory_id":"9a386a48-aa80-4055-bae6-fc4382a29844","event_types":["advisory"],"published_at":"2026-10-25T08:06:28.579229+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2018-10-04T13:00:00+00:00","detail_url":"/events/29882"}]}},{"id":29427,"cve_ids":["CVE-2017-7674"],"payload":{"kind":"advisory","title":"CVE-2017-7674","summary":"The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.","evidence":"cve:CVE-2017-7674","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-7674","aliases":["CVE-2017-7674"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.0.M21"},{"status":"affected","version":"8.5.0 to 8.5.15"},{"status":"affected","version":"8.0.0.RC1 to 8.0.44"},{"status":"affected","version":"7.0.41 to 7.0.78"}]}],"modified":"2026-10-15T15:58:47.144Z","provider":"cve","references":["https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","https://access.redhat.com/errata/RHSA-2017:1801","https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f%40%3Cannounce.tomcat.apache.org%3E","https://security.netapp.com/advisory/ntap-20180614-0003/","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:3081","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1801","name":"RHSA-2017:1801","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f%40%3Cannounce.tomcat.apache.org%3E","name":"[announce] 20170810 [SECURITY] CVE-2017-7674 Apache Tomcat Cache Poisoning","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180614-0003/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/100280","name":"100280","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.debian.org/security/2017/dsa-3974","name":"DSA-3974","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1802","name":"RHSA-2017:1802","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3081","name":"RHSA-2017:3081","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20200131 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20200203 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20200204 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T16:12:27.949Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2017-7674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:58:37.150261Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:58:47.144Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-02-13T16:09:34.000Z"}}},"related_cves":[{"value":"CVE-2017-7674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ae201e38-f96b-4e72-aed3-9e312a848d71","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-7674","advisory_id":"ae201e38-f96b-4e72-aed3-9e312a848d71","event_types":["advisory"],"published_at":"2026-10-25T07:55:23.302095+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-08-11T02:00:00+00:00","detail_url":"/advisories/advisory%3Aae201e38-f96b-4e72-aed3-9e312a848d71","group":{"id":"advisory:ae201e38-f96b-4e72-aed3-9e312a848d71","revision":1,"primary_event_id":29194,"change":"published","superseded_by":[],"changed":{"id":29194,"cve_ids":["CVE-2017-7674"],"payload":{"kind":"advisory","title":"CVE-2017-7674","summary":"The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.","evidence":"cve:CVE-2017-7674","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-7674","aliases":["CVE-2017-7674"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.0.M21"},{"status":"affected","version":"8.5.0 to 8.5.15"},{"status":"affected","version":"8.0.0.RC1 to 8.0.44"},{"status":"affected","version":"7.0.41 to 7.0.78"}]}],"modified":"2026-10-15T15:58:47.144Z","provider":"cve","references":["https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","https://access.redhat.com/errata/RHSA-2017:1801","https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f%40%3Cannounce.tomcat.apache.org%3E","https://security.netapp.com/advisory/ntap-20180614-0003/","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:3081","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1801","name":"RHSA-2017:1801","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f%40%3Cannounce.tomcat.apache.org%3E","name":"[announce] 20170810 [SECURITY] CVE-2017-7674 Apache Tomcat Cache Poisoning","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180614-0003/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/100280","name":"100280","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.debian.org/security/2017/dsa-3974","name":"DSA-3974","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1802","name":"RHSA-2017:1802","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3081","name":"RHSA-2017:3081","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20200131 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20200203 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20200204 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T16:12:27.949Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2017-7674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:58:37.150261Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:58:47.144Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-02-13T16:09:34.000Z"}}},"related_cves":[{"value":"CVE-2017-7674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ae201e38-f96b-4e72-aed3-9e312a848d71","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-7674","advisory_id":"ae201e38-f96b-4e72-aed3-9e312a848d71","event_types":["advisory"],"published_at":"2026-10-25T07:55:23.302095+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-08-11T02:00:00+00:00","detail_url":"/events/29194"},"members":[{"id":29194,"cve_ids":["CVE-2017-7674"],"payload":{"kind":"advisory","title":"CVE-2017-7674","summary":"The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.","evidence":"cve:CVE-2017-7674","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-7674","aliases":["CVE-2017-7674"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.0.M21"},{"status":"affected","version":"8.5.0 to 8.5.15"},{"status":"affected","version":"8.0.0.RC1 to 8.0.44"},{"status":"affected","version":"7.0.41 to 7.0.78"}]}],"modified":"2026-10-15T15:58:47.144Z","provider":"cve","references":["https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","https://access.redhat.com/errata/RHSA-2017:1801","https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f%40%3Cannounce.tomcat.apache.org%3E","https://security.netapp.com/advisory/ntap-20180614-0003/","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:3081","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1801","name":"RHSA-2017:1801","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f%40%3Cannounce.tomcat.apache.org%3E","name":"[announce] 20170810 [SECURITY] CVE-2017-7674 Apache Tomcat Cache Poisoning","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180614-0003/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/100280","name":"100280","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.debian.org/security/2017/dsa-3974","name":"DSA-3974","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1802","name":"RHSA-2017:1802","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3081","name":"RHSA-2017:3081","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20200131 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r409efdf706c2077ae5c37018a87da725a3ca89570a9530342cdc53e4%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20200203 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r1c62634b7426bee5f553307063457b99c84af73b078ede4f2592b34e%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20200204 Re: 7.0.59 to 7.0.99 upgrade, CVE-2015-5174 fix prevents us from accessing resources outside context","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T16:12:27.949Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2017-7674","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:58:37.150261Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:58:47.144Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-02-13T16:09:34.000Z"}}},"related_cves":[{"value":"CVE-2017-7674","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ae201e38-f96b-4e72-aed3-9e312a848d71","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-7674","advisory_id":"ae201e38-f96b-4e72-aed3-9e312a848d71","event_types":["advisory"],"published_at":"2026-10-25T07:55:23.302095+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-08-11T02:00:00+00:00","detail_url":"/events/29194"}]}},{"id":29425,"cve_ids":["CVE-2017-5664"],"payload":{"kind":"advisory","title":"CVE-2017-5664","summary":"The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.","evidence":"cve:CVE-2017-5664","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-5664","aliases":["CVE-2017-5664"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.0.M20"},{"status":"affected","version":"8.5.0 to 8.5.14"},{"status":"affected","version":"8.0.0.RC1 to 8.0.43"},{"status":"affected","version":"7.0.0 to 7.0.77"}]}],"modified":"2026-10-15T15:58:14.391Z","provider":"cve","references":["https://security.netapp.com/advisory/ntap-20171019-0002/","https://access.redhat.com/errata/RHSA-2017:3080","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:2635","https://access.redhat.com/errata/RHSA-2017:2638","https://access.redhat.com/errata/RHSA-2017:2494","https://lists.apache.org/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066%40%3Cannounce.tomcat.apache.org%3E","https://access.redhat.com/errata/RHSA-2017:2636","https://access.redhat.com/errata/RHSA-2017:1809","https://access.redhat.com/errata/RHSA-2017:2637","https://access.redhat.com/errata/RHSA-2017:2633","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.debian.org/security/2017/dsa-3891","name":"DSA-3891","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20171019-0002/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/98888","name":"98888","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3080","name":"RHSA-2017:3080","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1801","name":"RHSA-2017:1801","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2635","name":"RHSA-2017:2635","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2638","name":"RHSA-2017:2638","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2494","name":"RHSA-2017:2494","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066%40%3Cannounce.tomcat.apache.org%3E","name":"[tomcat-users] 20170606 [SECURITY] CVE-2017-5664 Apache Tomcat Security Constraint Bypass","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2636","name":"RHSA-2017:2636","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1809","name":"RHSA-2017:1809","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2637","name":"RHSA-2017:2637","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securitytracker.com/id/1038641","name":"1038641","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.debian.org/security/2017/dsa-3892","name":"DSA-3892","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2633","name":"RHSA-2017:2633","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1802","name":"RHSA-2017:1802","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2493","name":"RHSA-2017:2493","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T15:11:48.039Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2017-5664","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:57:46.350067Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:58:14.391Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-02-13T16:09:07.000Z"}}},"related_cves":[{"value":"CVE-2017-5664","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4826aca2-9b7d-4d1c-9fba-16f42bc73e19","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-5664","advisory_id":"4826aca2-9b7d-4d1c-9fba-16f42bc73e19","event_types":["advisory"],"published_at":"2026-10-25T07:55:22.106726+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-06-06T14:00:00+00:00","detail_url":"/advisories/advisory%3A4826aca2-9b7d-4d1c-9fba-16f42bc73e19","group":{"id":"advisory:4826aca2-9b7d-4d1c-9fba-16f42bc73e19","revision":1,"primary_event_id":29192,"change":"published","superseded_by":[],"changed":{"id":29192,"cve_ids":["CVE-2017-5664"],"payload":{"kind":"advisory","title":"CVE-2017-5664","summary":"The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.","evidence":"cve:CVE-2017-5664","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-5664","aliases":["CVE-2017-5664"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.0.M20"},{"status":"affected","version":"8.5.0 to 8.5.14"},{"status":"affected","version":"8.0.0.RC1 to 8.0.43"},{"status":"affected","version":"7.0.0 to 7.0.77"}]}],"modified":"2026-10-15T15:58:14.391Z","provider":"cve","references":["https://security.netapp.com/advisory/ntap-20171019-0002/","https://access.redhat.com/errata/RHSA-2017:3080","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:2635","https://access.redhat.com/errata/RHSA-2017:2638","https://access.redhat.com/errata/RHSA-2017:2494","https://lists.apache.org/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066%40%3Cannounce.tomcat.apache.org%3E","https://access.redhat.com/errata/RHSA-2017:2636","https://access.redhat.com/errata/RHSA-2017:1809","https://access.redhat.com/errata/RHSA-2017:2637","https://access.redhat.com/errata/RHSA-2017:2633","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.debian.org/security/2017/dsa-3891","name":"DSA-3891","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20171019-0002/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/98888","name":"98888","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3080","name":"RHSA-2017:3080","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1801","name":"RHSA-2017:1801","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2635","name":"RHSA-2017:2635","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2638","name":"RHSA-2017:2638","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2494","name":"RHSA-2017:2494","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066%40%3Cannounce.tomcat.apache.org%3E","name":"[tomcat-users] 20170606 [SECURITY] CVE-2017-5664 Apache Tomcat Security Constraint Bypass","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2636","name":"RHSA-2017:2636","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1809","name":"RHSA-2017:1809","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2637","name":"RHSA-2017:2637","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securitytracker.com/id/1038641","name":"1038641","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.debian.org/security/2017/dsa-3892","name":"DSA-3892","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2633","name":"RHSA-2017:2633","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1802","name":"RHSA-2017:1802","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2493","name":"RHSA-2017:2493","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T15:11:48.039Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2017-5664","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:57:46.350067Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:58:14.391Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-02-13T16:09:07.000Z"}}},"related_cves":[{"value":"CVE-2017-5664","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4826aca2-9b7d-4d1c-9fba-16f42bc73e19","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-5664","advisory_id":"4826aca2-9b7d-4d1c-9fba-16f42bc73e19","event_types":["advisory"],"published_at":"2026-10-25T07:55:22.106726+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-06-06T14:00:00+00:00","detail_url":"/events/29192"},"members":[{"id":29192,"cve_ids":["CVE-2017-5664"],"payload":{"kind":"advisory","title":"CVE-2017-5664","summary":"The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.","evidence":"cve:CVE-2017-5664","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-5664","aliases":["CVE-2017-5664"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.0.M20"},{"status":"affected","version":"8.5.0 to 8.5.14"},{"status":"affected","version":"8.0.0.RC1 to 8.0.43"},{"status":"affected","version":"7.0.0 to 7.0.77"}]}],"modified":"2026-10-15T15:58:14.391Z","provider":"cve","references":["https://security.netapp.com/advisory/ntap-20171019-0002/","https://access.redhat.com/errata/RHSA-2017:3080","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:2635","https://access.redhat.com/errata/RHSA-2017:2638","https://access.redhat.com/errata/RHSA-2017:2494","https://lists.apache.org/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066%40%3Cannounce.tomcat.apache.org%3E","https://access.redhat.com/errata/RHSA-2017:2636","https://access.redhat.com/errata/RHSA-2017:1809","https://access.redhat.com/errata/RHSA-2017:2637","https://access.redhat.com/errata/RHSA-2017:2633","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.debian.org/security/2017/dsa-3891","name":"DSA-3891","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20171019-0002/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/98888","name":"98888","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:3080","name":"RHSA-2017:3080","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1801","name":"RHSA-2017:1801","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2635","name":"RHSA-2017:2635","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2638","name":"RHSA-2017:2638","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2494","name":"RHSA-2017:2494","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/a42c48e37398d76334e17089e43ccab945238b8b7896538478d76066%40%3Cannounce.tomcat.apache.org%3E","name":"[tomcat-users] 20170606 [SECURITY] CVE-2017-5664 Apache Tomcat Security Constraint Bypass","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2636","name":"RHSA-2017:2636","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1809","name":"RHSA-2017:1809","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2637","name":"RHSA-2017:2637","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securitytracker.com/id/1038641","name":"1038641","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.debian.org/security/2017/dsa-3892","name":"DSA-3892","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2633","name":"RHSA-2017:2633","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1802","name":"RHSA-2017:1802","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2493","name":"RHSA-2017:2493","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T15:11:48.039Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2017-5664","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:57:46.350067Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:58:14.391Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-02-13T16:09:07.000Z"}}},"related_cves":[{"value":"CVE-2017-5664","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:4826aca2-9b7d-4d1c-9fba-16f42bc73e19","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-5664","advisory_id":"4826aca2-9b7d-4d1c-9fba-16f42bc73e19","event_types":["advisory"],"published_at":"2026-10-25T07:55:22.106726+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-06-06T14:00:00+00:00","detail_url":"/events/29192"}]}},{"id":29424,"cve_ids":["CVE-2017-5648"],"payload":{"kind":"advisory","title":"CVE-2017-5648","summary":"While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.","evidence":"cve:CVE-2017-5648","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-5648","aliases":["CVE-2017-5648"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.0.M17"},{"status":"affected","version":"8.5.0 to 8.5.11"},{"status":"affected","version":"8.0.0.RC1 to 8.0.41"},{"status":"affected","version":"7.0.0 to 7.0.75"}]}],"modified":"2026-10-15T15:56:30.787Z","provider":"cve","references":["https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180614-0001/","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1809","https://access.redhat.com/errata/RHSA-2017:1802","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E","name":"[users] 20170410 [SECURITY] CVE-2017-5648 Apache Tomcat Information Disclosure","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201705-09","name":"GLSA-201705-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180614-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/97530","name":"97530","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1801","name":"RHSA-2017:1801","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.debian.org/security/2017/dsa-3843","name":"DSA-3843","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.securitytracker.com/id/1038220","name":"1038220","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.debian.org/security/2017/dsa-3842","name":"DSA-3842","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1809","name":"RHSA-2017:1809","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1802","name":"RHSA-2017:1802","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2020/07/20/8","name":"[oss-security] 20200720 CVE-2020-13932 Apache ActiveMQ Artemis - Remote XSS in Web console Diagram Plugin","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T15:11:48.389Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2017-5648","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:56:15.465946Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:56:30.787Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-07-20T20:06:24.000Z"}}},"related_cves":[{"value":"CVE-2017-5648","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ce0d032e-711f-436a-a12d-c9f474e9679b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-5648","advisory_id":"ce0d032e-711f-436a-a12d-c9f474e9679b","event_types":["advisory"],"published_at":"2026-10-25T07:55:21.495576+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-04-17T16:00:00+00:00","detail_url":"/advisories/advisory%3Ace0d032e-711f-436a-a12d-c9f474e9679b","group":{"id":"advisory:ce0d032e-711f-436a-a12d-c9f474e9679b","revision":1,"primary_event_id":29191,"change":"published","superseded_by":[],"changed":{"id":29191,"cve_ids":["CVE-2017-5648"],"payload":{"kind":"advisory","title":"CVE-2017-5648","summary":"While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.","evidence":"cve:CVE-2017-5648","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-5648","aliases":["CVE-2017-5648"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.0.M17"},{"status":"affected","version":"8.5.0 to 8.5.11"},{"status":"affected","version":"8.0.0.RC1 to 8.0.41"},{"status":"affected","version":"7.0.0 to 7.0.75"}]}],"modified":"2026-10-15T15:56:30.787Z","provider":"cve","references":["https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180614-0001/","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1809","https://access.redhat.com/errata/RHSA-2017:1802","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E","name":"[users] 20170410 [SECURITY] CVE-2017-5648 Apache Tomcat Information Disclosure","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201705-09","name":"GLSA-201705-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180614-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/97530","name":"97530","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1801","name":"RHSA-2017:1801","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.debian.org/security/2017/dsa-3843","name":"DSA-3843","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.securitytracker.com/id/1038220","name":"1038220","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.debian.org/security/2017/dsa-3842","name":"DSA-3842","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1809","name":"RHSA-2017:1809","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1802","name":"RHSA-2017:1802","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2020/07/20/8","name":"[oss-security] 20200720 CVE-2020-13932 Apache ActiveMQ Artemis - Remote XSS in Web console Diagram Plugin","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T15:11:48.389Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2017-5648","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:56:15.465946Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:56:30.787Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-07-20T20:06:24.000Z"}}},"related_cves":[{"value":"CVE-2017-5648","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ce0d032e-711f-436a-a12d-c9f474e9679b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-5648","advisory_id":"ce0d032e-711f-436a-a12d-c9f474e9679b","event_types":["advisory"],"published_at":"2026-10-25T07:55:21.495576+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-04-17T16:00:00+00:00","detail_url":"/events/29191"},"members":[{"id":29191,"cve_ids":["CVE-2017-5648"],"payload":{"kind":"advisory","title":"CVE-2017-5648","summary":"While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.","evidence":"cve:CVE-2017-5648","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-5648","aliases":["CVE-2017-5648"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.0.M17"},{"status":"affected","version":"8.5.0 to 8.5.11"},{"status":"affected","version":"8.0.0.RC1 to 8.0.41"},{"status":"affected","version":"7.0.0 to 7.0.75"}]}],"modified":"2026-10-15T15:56:30.787Z","provider":"cve","references":["https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180614-0001/","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1809","https://access.redhat.com/errata/RHSA-2017:1802","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a6829133092f349b2882bf6860397368a52600%40%3Cannounce.tomcat.apache.org%3E","name":"[users] 20170410 [SECURITY] CVE-2017-5648 Apache Tomcat Information Disclosure","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201705-09","name":"GLSA-201705-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180614-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/97530","name":"97530","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1801","name":"RHSA-2017:1801","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.debian.org/security/2017/dsa-3843","name":"DSA-3843","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.securitytracker.com/id/1038220","name":"1038220","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.debian.org/security/2017/dsa-3842","name":"DSA-3842","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1809","name":"RHSA-2017:1809","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1802","name":"RHSA-2017:1802","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2020/07/20/8","name":"[oss-security] 20200720 CVE-2020-13932 Apache ActiveMQ Artemis - Remote XSS in Web console Diagram Plugin","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T15:11:48.389Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2017-5648","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:56:15.465946Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:56:30.787Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-07-20T20:06:24.000Z"}}},"related_cves":[{"value":"CVE-2017-5648","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ce0d032e-711f-436a-a12d-c9f474e9679b","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-5648","advisory_id":"ce0d032e-711f-436a-a12d-c9f474e9679b","event_types":["advisory"],"published_at":"2026-10-25T07:55:21.495576+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-04-17T16:00:00+00:00","detail_url":"/events/29191"}]}},{"id":29281,"cve_ids":["CVE-2017-12616"],"payload":{"kind":"advisory","title":"CVE-2017-12616","summary":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.","evidence":"cve:CVE-2017-12616","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-12616","aliases":["CVE-2017-12616"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"7.0.0 to 7.0.80"}]}],"modified":"2026-10-15T15:52:29.095Z","provider":"cve","references":["https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","https://www.synology.com/support/security/Synology_SA_17_54_Tomcat","https://access.redhat.com/errata/RHSA-2018:0465","https://usn.ubuntu.com/3665-1/","https://access.redhat.com/errata/RHSA-2018:0466","https://security.netapp.com/advisory/ntap-20171018-0001/","https://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.securitytracker.com/id/1039393","name":"1039393","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.synology.com/support/security/Synology_SA_17_54_Tomcat","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","name":"RHSA-2018:0465","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://usn.ubuntu.com/3665-1/","name":"USN-3665-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://www.securityfocus.com/bid/100897","name":"100897","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","name":"RHSA-2018:0466","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20171018-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6%40%3Cannounce.tomcat.apache.org%3E","name":"[announce] 20170919 [SECURITY] CVE-2017-12616 Apache Tomcat Information Disclosure","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T18:43:56.057Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2017-12616","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:52:18.470177Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:52:29.095Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-02-13T16:06:15.000Z"}}},"related_cves":[{"value":"CVE-2017-12616","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d1142a39-f357-4206-8e4d-32164a24e2b6","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-12616","advisory_id":"d1142a39-f357-4206-8e4d-32164a24e2b6","event_types":["advisory"],"published_at":"2026-10-25T07:52:08.332971+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-09-19T13:00:00+00:00","detail_url":"/advisories/advisory%3Ad1142a39-f357-4206-8e4d-32164a24e2b6","group":{"id":"advisory:d1142a39-f357-4206-8e4d-32164a24e2b6","revision":1,"primary_event_id":29050,"change":"published","superseded_by":[],"changed":{"id":29050,"cve_ids":["CVE-2017-12616"],"payload":{"kind":"advisory","title":"CVE-2017-12616","summary":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.","evidence":"cve:CVE-2017-12616","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-12616","aliases":["CVE-2017-12616"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"7.0.0 to 7.0.80"}]}],"modified":"2026-10-15T15:52:29.095Z","provider":"cve","references":["https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","https://www.synology.com/support/security/Synology_SA_17_54_Tomcat","https://access.redhat.com/errata/RHSA-2018:0465","https://usn.ubuntu.com/3665-1/","https://access.redhat.com/errata/RHSA-2018:0466","https://security.netapp.com/advisory/ntap-20171018-0001/","https://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.securitytracker.com/id/1039393","name":"1039393","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.synology.com/support/security/Synology_SA_17_54_Tomcat","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","name":"RHSA-2018:0465","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://usn.ubuntu.com/3665-1/","name":"USN-3665-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://www.securityfocus.com/bid/100897","name":"100897","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","name":"RHSA-2018:0466","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20171018-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6%40%3Cannounce.tomcat.apache.org%3E","name":"[announce] 20170919 [SECURITY] CVE-2017-12616 Apache Tomcat Information Disclosure","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T18:43:56.057Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2017-12616","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:52:18.470177Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:52:29.095Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-02-13T16:06:15.000Z"}}},"related_cves":[{"value":"CVE-2017-12616","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d1142a39-f357-4206-8e4d-32164a24e2b6","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-12616","advisory_id":"d1142a39-f357-4206-8e4d-32164a24e2b6","event_types":["advisory"],"published_at":"2026-10-25T07:52:08.332971+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-09-19T13:00:00+00:00","detail_url":"/events/29050"},"members":[{"id":29050,"cve_ids":["CVE-2017-12616"],"payload":{"kind":"advisory","title":"CVE-2017-12616","summary":"When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.","evidence":"cve:CVE-2017-12616","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-12616","aliases":["CVE-2017-12616"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"7.0.0 to 7.0.80"}]}],"modified":"2026-10-15T15:52:29.095Z","provider":"cve","references":["https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","https://www.synology.com/support/security/Synology_SA_17_54_Tomcat","https://access.redhat.com/errata/RHSA-2018:0465","https://usn.ubuntu.com/3665-1/","https://access.redhat.com/errata/RHSA-2018:0466","https://security.netapp.com/advisory/ntap-20171018-0001/","https://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.securitytracker.com/id/1039393","name":"1039393","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.synology.com/support/security/Synology_SA_17_54_Tomcat","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0465","name":"RHSA-2018:0465","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://usn.ubuntu.com/3665-1/","name":"USN-3665-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://www.securityfocus.com/bid/100897","name":"100897","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0466","name":"RHSA-2018:0466","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20171018-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6%40%3Cannounce.tomcat.apache.org%3E","name":"[announce] 20170919 [SECURITY] CVE-2017-12616 Apache Tomcat Information Disclosure","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html","name":"[debian-lts-announce] 20180627 [SECURITY] [DLA 1400-1] tomcat7 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-05T18:43:56.057Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2017-12616","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:52:18.470177Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:52:29.095Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2020-02-13T16:06:15.000Z"}}},"related_cves":[{"value":"CVE-2017-12616","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d1142a39-f357-4206-8e4d-32164a24e2b6","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2017-12616","advisory_id":"d1142a39-f357-4206-8e4d-32164a24e2b6","event_types":["advisory"],"published_at":"2026-10-25T07:52:08.332971+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-09-19T13:00:00+00:00","detail_url":"/events/29050"}]}},{"id":29276,"cve_ids":["CVE-2016-6794"],"payload":{"kind":"advisory","title":"CVE-2016-6794","summary":"When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.","evidence":"cve:CVE-2016-6794","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2016-6794","aliases":["CVE-2016-6794"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.0.M9"},{"status":"affected","version":"8.5.0 to 8.5.4"},{"status":"affected","version":"8.0.0.RC1 to 8.0.36"},{"status":"affected","version":"7.0.0 to 7.0.70"},{"status":"affected","version":"6.0.0 to 6.0.45"}]}],"modified":"2026-10-15T15:49:19.934Z","provider":"cve","references":["https://lists.apache.org/thread.html/09d2f2c65ac4ff5da42f15dc2b0f78b655e50f1a42e8a9784134a9eb%40%3Cannounce.tomcat.apache.org%3E","https://access.redhat.com/errata/RHSA-2017:2247","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://usn.ubuntu.com/4557-1/","https://security.netapp.com/advisory/ntap-20180605-0001/","https://www.oracle.com/security-alerts/cpuoct2021.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/09d2f2c65ac4ff5da42f15dc2b0f78b655e50f1a42e8a9784134a9eb%40%3Cannounce.tomcat.apache.org%3E","name":"[announce] 20161027 [SECURITY] CVE-2016-6794 Apache Tomcat Security System Property Disclosure","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2247","name":"RHSA-2017:2247","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0457.html","name":"RHSA-2017:0457","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0455","name":"RHSA-2017:0455","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securitytracker.com/id/1037143","name":"1037143","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.debian.org/security/2016/dsa-3720","name":"DSA-3720","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.securityfocus.com/bid/93943","name":"93943","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0456","name":"RHSA-2017:0456","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://usn.ubuntu.com/4557-1/","name":"USN-4557-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180605-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-06T01:43:37.900Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2016-6794","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:49:03.918879Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:49:19.934Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2021-10-20T10:37:50.000Z"}}},"related_cves":[{"value":"CVE-2016-6794","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5a8d3fef-57d3-41b7-ae9f-5563c13e0f59","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2016-6794","advisory_id":"5a8d3fef-57d3-41b7-ae9f-5563c13e0f59","event_types":["advisory"],"published_at":"2026-10-25T07:52:05.334619+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-08-10T16:00:00+00:00","detail_url":"/advisories/advisory%3A5a8d3fef-57d3-41b7-ae9f-5563c13e0f59","group":{"id":"advisory:5a8d3fef-57d3-41b7-ae9f-5563c13e0f59","revision":1,"primary_event_id":29045,"change":"published","superseded_by":[],"changed":{"id":29045,"cve_ids":["CVE-2016-6794"],"payload":{"kind":"advisory","title":"CVE-2016-6794","summary":"When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.","evidence":"cve:CVE-2016-6794","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2016-6794","aliases":["CVE-2016-6794"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.0.M9"},{"status":"affected","version":"8.5.0 to 8.5.4"},{"status":"affected","version":"8.0.0.RC1 to 8.0.36"},{"status":"affected","version":"7.0.0 to 7.0.70"},{"status":"affected","version":"6.0.0 to 6.0.45"}]}],"modified":"2026-10-15T15:49:19.934Z","provider":"cve","references":["https://lists.apache.org/thread.html/09d2f2c65ac4ff5da42f15dc2b0f78b655e50f1a42e8a9784134a9eb%40%3Cannounce.tomcat.apache.org%3E","https://access.redhat.com/errata/RHSA-2017:2247","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://usn.ubuntu.com/4557-1/","https://security.netapp.com/advisory/ntap-20180605-0001/","https://www.oracle.com/security-alerts/cpuoct2021.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/09d2f2c65ac4ff5da42f15dc2b0f78b655e50f1a42e8a9784134a9eb%40%3Cannounce.tomcat.apache.org%3E","name":"[announce] 20161027 [SECURITY] CVE-2016-6794 Apache Tomcat Security System Property Disclosure","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2247","name":"RHSA-2017:2247","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0457.html","name":"RHSA-2017:0457","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0455","name":"RHSA-2017:0455","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securitytracker.com/id/1037143","name":"1037143","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.debian.org/security/2016/dsa-3720","name":"DSA-3720","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.securityfocus.com/bid/93943","name":"93943","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0456","name":"RHSA-2017:0456","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://usn.ubuntu.com/4557-1/","name":"USN-4557-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180605-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-06T01:43:37.900Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2016-6794","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:49:03.918879Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:49:19.934Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2021-10-20T10:37:50.000Z"}}},"related_cves":[{"value":"CVE-2016-6794","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5a8d3fef-57d3-41b7-ae9f-5563c13e0f59","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2016-6794","advisory_id":"5a8d3fef-57d3-41b7-ae9f-5563c13e0f59","event_types":["advisory"],"published_at":"2026-10-25T07:52:05.334619+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-08-10T16:00:00+00:00","detail_url":"/events/29045"},"members":[{"id":29045,"cve_ids":["CVE-2016-6794"],"payload":{"kind":"advisory","title":"CVE-2016-6794","summary":"When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.","evidence":"cve:CVE-2016-6794","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2016-6794","aliases":["CVE-2016-6794"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.0.M1 to 9.0.0.M9"},{"status":"affected","version":"8.5.0 to 8.5.4"},{"status":"affected","version":"8.0.0.RC1 to 8.0.36"},{"status":"affected","version":"7.0.0 to 7.0.70"},{"status":"affected","version":"6.0.0 to 6.0.45"}]}],"modified":"2026-10-15T15:49:19.934Z","provider":"cve","references":["https://lists.apache.org/thread.html/09d2f2c65ac4ff5da42f15dc2b0f78b655e50f1a42e8a9784134a9eb%40%3Cannounce.tomcat.apache.org%3E","https://access.redhat.com/errata/RHSA-2017:2247","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://usn.ubuntu.com/4557-1/","https://security.netapp.com/advisory/ntap-20180605-0001/","https://www.oracle.com/security-alerts/cpuoct2021.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/09d2f2c65ac4ff5da42f15dc2b0f78b655e50f1a42e8a9784134a9eb%40%3Cannounce.tomcat.apache.org%3E","name":"[announce] 20161027 [SECURITY] CVE-2016-6794 Apache Tomcat Security System Property Disclosure","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2247","name":"RHSA-2017:2247","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0457.html","name":"RHSA-2017:0457","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0455","name":"RHSA-2017:0455","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securitytracker.com/id/1037143","name":"1037143","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.debian.org/security/2016/dsa-3720","name":"DSA-3720","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.securityfocus.com/bid/93943","name":"93943","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0456","name":"RHSA-2017:0456","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://usn.ubuntu.com/4557-1/","name":"USN-4557-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20180605-0001/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-06T01:43:37.900Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2016-6794","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T15:49:03.918879Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T15:49:19.934Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2021-10-20T10:37:50.000Z"}}},"related_cves":[{"value":"CVE-2016-6794","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5a8d3fef-57d3-41b7-ae9f-5563c13e0f59","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2016-6794","advisory_id":"5a8d3fef-57d3-41b7-ae9f-5563c13e0f59","event_types":["advisory"],"published_at":"2026-10-25T07:52:05.334619+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2017-08-10T16:00:00+00:00","detail_url":"/events/29045"}]}},{"id":16195,"cve_ids":["CVE-2023-42794"],"payload":{"kind":"advisory","title":"Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows","summary":"Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Other, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.","evidence":"cve:CVE-2023-42794","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2023-42794","aliases":["CVE-2023-42794"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.70","versionType":"semver","lessThanOrEqual":"9.0.80"},{"status":"affected","version":"8.5.85","versionType":"semver","lessThanOrEqual":"8.5.93"},{"status":"unknown","version":"10.0.0-M1","versionType":"semver","lessThanOrEqual":"10.0.27"}],"defaultStatus":"unaffected"}],"modified":"2026-10-08T21:13:49.714Z","provider":"cve","references":["https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82","tags":["vendor-advisory","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/8","tags":["x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T19:30:24.246Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-42794","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:05:28.646637Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:49.714Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2025-10-29T12:04:10.367Z"}}},"related_cves":[{"value":"CVE-2023-42794","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:79ff4fec-b3c6-4149-8605-6dde174af977","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2023-42794","advisory_id":"79ff4fec-b3c6-4149-8605-6dde174af977","event_types":["advisory"],"published_at":"2026-10-25T01:10:57.632664+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2023-10-10T17:17:01.378+00:00","detail_url":"/advisories/advisory%3A79ff4fec-b3c6-4149-8605-6dde174af977","group":{"id":"advisory:79ff4fec-b3c6-4149-8605-6dde174af977","revision":1,"primary_event_id":16098,"change":"published","superseded_by":[],"changed":{"id":16098,"cve_ids":["CVE-2023-42794"],"payload":{"kind":"advisory","title":"Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows","summary":"Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Other, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.","evidence":"cve:CVE-2023-42794","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2023-42794","aliases":["CVE-2023-42794"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.70","versionType":"semver","lessThanOrEqual":"9.0.80"},{"status":"affected","version":"8.5.85","versionType":"semver","lessThanOrEqual":"8.5.93"},{"status":"unknown","version":"10.0.0-M1","versionType":"semver","lessThanOrEqual":"10.0.27"}],"defaultStatus":"unaffected"}],"modified":"2026-10-08T21:13:49.714Z","provider":"cve","references":["https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82","tags":["vendor-advisory","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/8","tags":["x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T19:30:24.246Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-42794","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:05:28.646637Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:49.714Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2025-10-29T12:04:10.367Z"}}},"related_cves":[{"value":"CVE-2023-42794","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:79ff4fec-b3c6-4149-8605-6dde174af977","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2023-42794","advisory_id":"79ff4fec-b3c6-4149-8605-6dde174af977","event_types":["advisory"],"published_at":"2026-10-25T01:10:57.632664+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2023-10-10T17:17:01.378+00:00","detail_url":"/events/16098"},"members":[{"id":16098,"cve_ids":["CVE-2023-42794"],"payload":{"kind":"advisory","title":"Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows","summary":"Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service on Windows if a web application opened a stream for an uploaded file but failed to close the stream. The file would never be deleted from disk creating the possibility of an eventual denial of service due to the disk being full. Other, EOL versions may also be affected. Users are recommended to upgrade to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.","evidence":"cve:CVE-2023-42794","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2023-42794","aliases":["CVE-2023-42794"],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"low"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"9.0.70","versionType":"semver","lessThanOrEqual":"9.0.80"},{"status":"affected","version":"8.5.85","versionType":"semver","lessThanOrEqual":"8.5.93"},{"status":"unknown","version":"10.0.0-M1","versionType":"semver","lessThanOrEqual":"10.0.27"}],"defaultStatus":"unaffected"}],"modified":"2026-10-08T21:13:49.714Z","provider":"cve","references":["https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/vvbr2ms7lockj1hlhz5q3wmxb2mwcw82","tags":["vendor-advisory","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/8","tags":["x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T19:30:24.246Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-42794","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:05:28.646637Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:49.714Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2025-10-29T12:04:10.367Z"}}},"related_cves":[{"value":"CVE-2023-42794","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:79ff4fec-b3c6-4149-8605-6dde174af977","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2023-42794","advisory_id":"79ff4fec-b3c6-4149-8605-6dde174af977","event_types":["advisory"],"published_at":"2026-10-25T01:10:57.632664+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2023-10-10T17:17:01.378+00:00","detail_url":"/events/16098"}]}},{"id":16176,"cve_ids":["CVE-2022-34305"],"payload":{"kind":"advisory","title":"XSS in examples web application","summary":"In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.","evidence":"cve:CVE-2022-34305","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-34305","aliases":["CVE-2022-34305"],"metrics":[{"other":{"type":"unknown","content":{"other":"low"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 8.5 8.5.50 to 8.5.81"},{"status":"affected","version":"Apache Tomcat 9 9.0.30 to 9.0.64"},{"status":"affected","version":"Apache Tomcat 10.0 10.0.0-M1 to 10.0.22"},{"status":"affected","version":"Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M16"}]}],"modified":"2026-10-08T21:13:48.481Z","provider":"cve","references":["https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k","https://security.netapp.com/advisory/ntap-20220729-0006/","https://security.gentoo.org/glsa/202208-34"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2022/06/23/1","name":"[oss-security] 20220623 CVE-2022-34305: Apache Tomcat: XSS in examples web application","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220729-0006/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202208-34","name":"GLSA-202208-34","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T09:07:16.126Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-34305","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:04:51.567483Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:48.481Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2022-08-21T04:06:10.000Z"}}},"related_cves":[{"value":"CVE-2022-34305","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:470b4fd5-410d-4dc4-9bcb-10336bf853c0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-34305","advisory_id":"470b4fd5-410d-4dc4-9bcb-10336bf853c0","event_types":["advisory"],"published_at":"2026-10-25T01:10:47.636682+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-06-23T10:30:16+00:00","detail_url":"/advisories/advisory%3A470b4fd5-410d-4dc4-9bcb-10336bf853c0","group":{"id":"advisory:470b4fd5-410d-4dc4-9bcb-10336bf853c0","revision":1,"primary_event_id":16081,"change":"published","superseded_by":[],"changed":{"id":16081,"cve_ids":["CVE-2022-34305"],"payload":{"kind":"advisory","title":"XSS in examples web application","summary":"In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.","evidence":"cve:CVE-2022-34305","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-34305","aliases":["CVE-2022-34305"],"metrics":[{"other":{"type":"unknown","content":{"other":"low"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 8.5 8.5.50 to 8.5.81"},{"status":"affected","version":"Apache Tomcat 9 9.0.30 to 9.0.64"},{"status":"affected","version":"Apache Tomcat 10.0 10.0.0-M1 to 10.0.22"},{"status":"affected","version":"Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M16"}]}],"modified":"2026-10-08T21:13:48.481Z","provider":"cve","references":["https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k","https://security.netapp.com/advisory/ntap-20220729-0006/","https://security.gentoo.org/glsa/202208-34"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2022/06/23/1","name":"[oss-security] 20220623 CVE-2022-34305: Apache Tomcat: XSS in examples web application","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220729-0006/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202208-34","name":"GLSA-202208-34","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T09:07:16.126Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-34305","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:04:51.567483Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:48.481Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2022-08-21T04:06:10.000Z"}}},"related_cves":[{"value":"CVE-2022-34305","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:470b4fd5-410d-4dc4-9bcb-10336bf853c0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-34305","advisory_id":"470b4fd5-410d-4dc4-9bcb-10336bf853c0","event_types":["advisory"],"published_at":"2026-10-25T01:10:47.636682+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-06-23T10:30:16+00:00","detail_url":"/events/16081"},"members":[{"id":16081,"cve_ids":["CVE-2022-34305"],"payload":{"kind":"advisory","title":"XSS in examples web application","summary":"In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.","evidence":"cve:CVE-2022-34305","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-34305","aliases":["CVE-2022-34305"],"metrics":[{"other":{"type":"unknown","content":{"other":"low"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 8.5 8.5.50 to 8.5.81"},{"status":"affected","version":"Apache Tomcat 9 9.0.30 to 9.0.64"},{"status":"affected","version":"Apache Tomcat 10.0 10.0.0-M1 to 10.0.22"},{"status":"affected","version":"Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M16"}]}],"modified":"2026-10-08T21:13:48.481Z","provider":"cve","references":["https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k","https://security.netapp.com/advisory/ntap-20220729-0006/","https://security.gentoo.org/glsa/202208-34"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/k04zk0nq6w57m72w5gb0r6z9ryhmvr4k","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2022/06/23/1","name":"[oss-security] 20220623 CVE-2022-34305: Apache Tomcat: XSS in examples web application","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220729-0006/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202208-34","name":"GLSA-202208-34","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T09:07:16.126Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-34305","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:04:51.567483Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:48.481Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2022-08-21T04:06:10.000Z"}}},"related_cves":[{"value":"CVE-2022-34305","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:470b4fd5-410d-4dc4-9bcb-10336bf853c0","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-34305","advisory_id":"470b4fd5-410d-4dc4-9bcb-10336bf853c0","event_types":["advisory"],"published_at":"2026-10-25T01:10:47.636682+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-06-23T10:30:16+00:00","detail_url":"/events/16081"}]}},{"id":16173,"cve_ids":["CVE-2022-29885"],"payload":{"kind":"advisory","title":"EncryptInterceptor does not provide complete protection on insecure networks","summary":"The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.","evidence":"cve:CVE-2022-29885","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-29885","aliases":["CVE-2022-29885"],"metrics":[{"other":{"type":"unknown","content":{"other":"low"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14"},{"status":"affected","version":"Apache Tomcat 10 10.0.0-M1 to 10.0.20"},{"status":"affected","version":"Apache Tomcat 9 9.0.13 to 9.0.62"},{"status":"affected","version":"Apache Tomcat 8.5 8.5.38 to 8.5.78"}]}],"modified":"2026-10-08T21:13:48.611Z","provider":"cve","references":["https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.netapp.com/advisory/ntap-20220629-0002/","https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html","https://www.debian.org/security/2022/dsa-5265"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220629-0002/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html","name":"[debian-lts-announce] 20221026 [SECURITY] [DLA 3160-1] tomcat9 security update","tags":["mailing-list","x_transferred"]},{"url":"https://www.debian.org/security/2022/dsa-5265","name":"DSA-5265","tags":["vendor-advisory","x_transferred"]},{"url":"http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html","tags":["x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T06:33:42.950Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-29885","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:04:58.208798Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:48.611Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2023-04-06T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2022-29885","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9977f670-85ac-4a41-bd2f-343b79f754ec","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-29885","advisory_id":"9977f670-85ac-4a41-bd2f-343b79f754ec","event_types":["advisory"],"published_at":"2026-10-25T01:10:45.716888+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-05-12T00:00:00+00:00","detail_url":"/advisories/advisory%3A9977f670-85ac-4a41-bd2f-343b79f754ec","group":{"id":"advisory:9977f670-85ac-4a41-bd2f-343b79f754ec","revision":1,"primary_event_id":16078,"change":"published","superseded_by":[],"changed":{"id":16078,"cve_ids":["CVE-2022-29885"],"payload":{"kind":"advisory","title":"EncryptInterceptor does not provide complete protection on insecure networks","summary":"The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.","evidence":"cve:CVE-2022-29885","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-29885","aliases":["CVE-2022-29885"],"metrics":[{"other":{"type":"unknown","content":{"other":"low"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14"},{"status":"affected","version":"Apache Tomcat 10 10.0.0-M1 to 10.0.20"},{"status":"affected","version":"Apache Tomcat 9 9.0.13 to 9.0.62"},{"status":"affected","version":"Apache Tomcat 8.5 8.5.38 to 8.5.78"}]}],"modified":"2026-10-08T21:13:48.611Z","provider":"cve","references":["https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.netapp.com/advisory/ntap-20220629-0002/","https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html","https://www.debian.org/security/2022/dsa-5265"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220629-0002/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html","name":"[debian-lts-announce] 20221026 [SECURITY] [DLA 3160-1] tomcat9 security update","tags":["mailing-list","x_transferred"]},{"url":"https://www.debian.org/security/2022/dsa-5265","name":"DSA-5265","tags":["vendor-advisory","x_transferred"]},{"url":"http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html","tags":["x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T06:33:42.950Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-29885","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:04:58.208798Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:48.611Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2023-04-06T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2022-29885","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9977f670-85ac-4a41-bd2f-343b79f754ec","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-29885","advisory_id":"9977f670-85ac-4a41-bd2f-343b79f754ec","event_types":["advisory"],"published_at":"2026-10-25T01:10:45.716888+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-05-12T00:00:00+00:00","detail_url":"/events/16078"},"members":[{"id":16078,"cve_ids":["CVE-2022-29885"],"payload":{"kind":"advisory","title":"EncryptInterceptor does not provide complete protection on insecure networks","summary":"The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.","evidence":"cve:CVE-2022-29885","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-29885","aliases":["CVE-2022-29885"],"metrics":[{"other":{"type":"unknown","content":{"other":"low"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10.1 10.1.0-M1 to 10.1.0-M14"},{"status":"affected","version":"Apache Tomcat 10 10.0.0-M1 to 10.0.20"},{"status":"affected","version":"Apache Tomcat 9 9.0.13 to 9.0.62"},{"status":"affected","version":"Apache Tomcat 8.5 8.5.38 to 8.5.78"}]}],"modified":"2026-10-08T21:13:48.611Z","provider":"cve","references":["https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.netapp.com/advisory/ntap-20220629-0002/","https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html","https://www.debian.org/security/2022/dsa-5265"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/2b4qmhbcyqvc7dyfpjyx54c03x65vhcv","tags":["x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220629-0002/","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html","name":"[debian-lts-announce] 20221026 [SECURITY] [DLA 3160-1] tomcat9 security update","tags":["mailing-list","x_transferred"]},{"url":"https://www.debian.org/security/2022/dsa-5265","name":"DSA-5265","tags":["vendor-advisory","x_transferred"]},{"url":"http://packetstormsecurity.com/files/171728/Apache-Tomcat-10.1-Denial-Of-Service.html","tags":["x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T06:33:42.950Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-29885","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:04:58.208798Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:48.611Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2023-04-06T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2022-29885","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9977f670-85ac-4a41-bd2f-343b79f754ec","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-29885","advisory_id":"9977f670-85ac-4a41-bd2f-343b79f754ec","event_types":["advisory"],"published_at":"2026-10-25T01:10:45.716888+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-05-12T00:00:00+00:00","detail_url":"/events/16078"}]}},{"id":16166,"cve_ids":["CVE-2022-25762"],"payload":{"kind":"advisory","title":"Response mix-up with WebSocket concurrent send and close","summary":"If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.","evidence":"cve:CVE-2022-25762","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-25762","aliases":["CVE-2022-25762"],"metrics":[{"other":{"type":"unknown","content":{"other":"high"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 9 9.0.0.M1 to 9.0.20"},{"status":"affected","version":"Apache Tomcat 8.5 8.5.0 to 8.5.75"}]}],"modified":"2026-10-08T21:14:02.790Z","provider":"cve","references":["https://lists.apache.org/thread/6ckmjfb1k61dyzkto9vm2k5jvt4o7w7c","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.netapp.com/advisory/ntap-20220629-0003/"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/6ckmjfb1k61dyzkto9vm2k5jvt4o7w7c","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220629-0003/","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T04:49:43.478Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-25762","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:11:22.010909Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:14:02.790Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2022-07-25T16:53:20.000Z"}}},"related_cves":[{"value":"CVE-2022-25762","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:365ba6c5-b636-42bb-9946-f6371b4e7370","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-25762","advisory_id":"365ba6c5-b636-42bb-9946-f6371b4e7370","event_types":["advisory"],"published_at":"2026-10-25T01:10:41.081664+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-05-13T07:50:09+00:00","detail_url":"/advisories/advisory%3A365ba6c5-b636-42bb-9946-f6371b4e7370","group":{"id":"advisory:365ba6c5-b636-42bb-9946-f6371b4e7370","revision":1,"primary_event_id":16071,"change":"published","superseded_by":[],"changed":{"id":16071,"cve_ids":["CVE-2022-25762"],"payload":{"kind":"advisory","title":"Response mix-up with WebSocket concurrent send and close","summary":"If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.","evidence":"cve:CVE-2022-25762","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-25762","aliases":["CVE-2022-25762"],"metrics":[{"other":{"type":"unknown","content":{"other":"high"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 9 9.0.0.M1 to 9.0.20"},{"status":"affected","version":"Apache Tomcat 8.5 8.5.0 to 8.5.75"}]}],"modified":"2026-10-08T21:14:02.790Z","provider":"cve","references":["https://lists.apache.org/thread/6ckmjfb1k61dyzkto9vm2k5jvt4o7w7c","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.netapp.com/advisory/ntap-20220629-0003/"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/6ckmjfb1k61dyzkto9vm2k5jvt4o7w7c","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220629-0003/","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T04:49:43.478Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-25762","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:11:22.010909Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:14:02.790Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2022-07-25T16:53:20.000Z"}}},"related_cves":[{"value":"CVE-2022-25762","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:365ba6c5-b636-42bb-9946-f6371b4e7370","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-25762","advisory_id":"365ba6c5-b636-42bb-9946-f6371b4e7370","event_types":["advisory"],"published_at":"2026-10-25T01:10:41.081664+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-05-13T07:50:09+00:00","detail_url":"/events/16071"},"members":[{"id":16071,"cve_ids":["CVE-2022-25762"],"payload":{"kind":"advisory","title":"Response mix-up with WebSocket concurrent send and close","summary":"If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.","evidence":"cve:CVE-2022-25762","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-25762","aliases":["CVE-2022-25762"],"metrics":[{"other":{"type":"unknown","content":{"other":"high"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 9 9.0.0.M1 to 9.0.20"},{"status":"affected","version":"Apache Tomcat 8.5 8.5.0 to 8.5.75"}]}],"modified":"2026-10-08T21:14:02.790Z","provider":"cve","references":["https://lists.apache.org/thread/6ckmjfb1k61dyzkto9vm2k5jvt4o7w7c","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.netapp.com/advisory/ntap-20220629-0003/"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread/6ckmjfb1k61dyzkto9vm2k5jvt4o7w7c","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220629-0003/","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T04:49:43.478Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-25762","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:11:22.010909Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:14:02.790Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2022-07-25T16:53:20.000Z"}}},"related_cves":[{"value":"CVE-2022-25762","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:365ba6c5-b636-42bb-9946-f6371b4e7370","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-25762","advisory_id":"365ba6c5-b636-42bb-9946-f6371b4e7370","event_types":["advisory"],"published_at":"2026-10-25T01:10:41.081664+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-05-13T07:50:09+00:00","detail_url":"/events/16071"}]}},{"id":16121,"cve_ids":["CVE-2021-41079"],"payload":{"kind":"advisory","title":"Apache Tomcat DoS with unexpected TLS packet","summary":"Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.","evidence":"cve:CVE-2021-41079","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-41079","aliases":["CVE-2021-41079"],"metrics":[{"other":{"type":"unknown","content":{"other":"high"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 8.5 8.5.0 to 8.5.63"},{"status":"affected","version":"Apache Tomcat 9 9.0.0-M1 to 9.0.43"},{"status":"affected","version":"Apache Tomcat 10 10.0.0-M1 to 10.0.2"}]}],"modified":"2026-10-08T21:13:52.220Z","provider":"cve","references":["https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html","https://security.netapp.com/advisory/ntap-20211008-0005/","https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a%40%3Cusers.tomcat.apache.org%3E","https://www.debian.org/security/2021/dsa-4986"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html","name":"[debian-lts-announce] 20210922 [SECURITY] [DLA 2764-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20211008-0005/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20211014 [SECURITY] CVE-2021-42340 Apache Tomcat DoS","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20211014 [SECURITY] CVE-2021-42340 Apache Tomcat DoS","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4986","name":"DSA-4986","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T02:59:31.226Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-41079","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:06:37.506200Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:52.220Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2021-10-15T14:06:10.000Z"}}},"related_cves":[{"value":"CVE-2021-41079","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b5f93dce-7a4d-4f9d-898a-d9d719f53a49","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-41079","advisory_id":"b5f93dce-7a4d-4f9d-898a-d9d719f53a49","event_types":["advisory"],"published_at":"2026-10-25T01:09:21.853033+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-09-16T14:40:25+00:00","detail_url":"/advisories/advisory%3Ab5f93dce-7a4d-4f9d-898a-d9d719f53a49","group":{"id":"advisory:b5f93dce-7a4d-4f9d-898a-d9d719f53a49","revision":1,"primary_event_id":16026,"change":"published","superseded_by":[],"changed":{"id":16026,"cve_ids":["CVE-2021-41079"],"payload":{"kind":"advisory","title":"Apache Tomcat DoS with unexpected TLS packet","summary":"Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.","evidence":"cve:CVE-2021-41079","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-41079","aliases":["CVE-2021-41079"],"metrics":[{"other":{"type":"unknown","content":{"other":"high"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 8.5 8.5.0 to 8.5.63"},{"status":"affected","version":"Apache Tomcat 9 9.0.0-M1 to 9.0.43"},{"status":"affected","version":"Apache Tomcat 10 10.0.0-M1 to 10.0.2"}]}],"modified":"2026-10-08T21:13:52.220Z","provider":"cve","references":["https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html","https://security.netapp.com/advisory/ntap-20211008-0005/","https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a%40%3Cusers.tomcat.apache.org%3E","https://www.debian.org/security/2021/dsa-4986"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html","name":"[debian-lts-announce] 20210922 [SECURITY] [DLA 2764-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20211008-0005/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20211014 [SECURITY] CVE-2021-42340 Apache Tomcat DoS","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20211014 [SECURITY] CVE-2021-42340 Apache Tomcat DoS","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4986","name":"DSA-4986","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T02:59:31.226Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-41079","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:06:37.506200Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:52.220Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2021-10-15T14:06:10.000Z"}}},"related_cves":[{"value":"CVE-2021-41079","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b5f93dce-7a4d-4f9d-898a-d9d719f53a49","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-41079","advisory_id":"b5f93dce-7a4d-4f9d-898a-d9d719f53a49","event_types":["advisory"],"published_at":"2026-10-25T01:09:21.853033+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-09-16T14:40:25+00:00","detail_url":"/events/16026"},"members":[{"id":16026,"cve_ids":["CVE-2021-41079"],"payload":{"kind":"advisory","title":"Apache Tomcat DoS with unexpected TLS packet","summary":"Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.","evidence":"cve:CVE-2021-41079","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-41079","aliases":["CVE-2021-41079"],"metrics":[{"other":{"type":"unknown","content":{"other":"high"}}}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 8.5 8.5.0 to 8.5.63"},{"status":"affected","version":"Apache Tomcat 9 9.0.0-M1 to 9.0.43"},{"status":"affected","version":"Apache Tomcat 10 10.0.0-M1 to 10.0.2"}]}],"modified":"2026-10-08T21:13:52.220Z","provider":"cve","references":["https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html","https://security.netapp.com/advisory/ntap-20211008-0005/","https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a%40%3Cusers.tomcat.apache.org%3E","https://www.debian.org/security/2021/dsa-4986"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/rccdef0349fdf4fb73a4e4403095446d7fe6264e0a58e2df5c6799434%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/09/msg00012.html","name":"[debian-lts-announce] 20210922 [SECURITY] [DLA 2764-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20211008-0005/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rb4de81ac647043541a32881099aa6eb5a23f1b7fd116f713f8ab9dbe%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20211014 [SECURITY] CVE-2021-42340 Apache Tomcat DoS","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r6b6b674e3f168dd010e67dbe6848b866e2acf26371452fdae313b98a%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20211014 [SECURITY] CVE-2021-42340 Apache Tomcat DoS","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4986","name":"DSA-4986","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T02:59:31.226Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-41079","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:06:37.506200Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:52.220Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2021-10-15T14:06:10.000Z"}}},"related_cves":[{"value":"CVE-2021-41079","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b5f93dce-7a4d-4f9d-898a-d9d719f53a49","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-41079","advisory_id":"b5f93dce-7a4d-4f9d-898a-d9d719f53a49","event_types":["advisory"],"published_at":"2026-10-25T01:09:21.853033+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-09-16T14:40:25+00:00","detail_url":"/events/16026"}]}},{"id":16110,"cve_ids":["CVE-2021-33037"],"payload":{"kind":"advisory","title":"Incorrect Transfer-Encoding handling with HTTP/1.0","summary":"Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.","evidence":"cve:CVE-2021-33037","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33037","aliases":["CVE-2021-33037"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10 10.0.0-M1 to 10.0.6"},{"status":"affected","version":"Apache Tomcat 9 9.0.0.M1 to 9.0.46"},{"status":"affected","version":"Apache Tomcat 8 8.5.0 to 8.5.66"}]}],"modified":"2026-10-08T21:13:49.981Z","provider":"cve","references":["https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html","https://www.debian.org/security/2021/dsa-4952","https://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20210827-0007/","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://security.gentoo.org/glsa/202208-34"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210728 [jira] [Created] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210728 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html","name":"[debian-lts-announce] 20210805 [SECURITY] [DLA 2733-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4952","name":"DSA-4952","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210830 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210913 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210914 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210916 [jira] [Resolved] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20210827-0007/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10366","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202208-34","name":"GLSA-202208-34","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T23:42:19.203Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-33037","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:05:35.913828Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:49.981Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2022-08-21T04:07:16.000Z"}}},"related_cves":[{"value":"CVE-2021-33037","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:44e65aab-16cd-4e14-9546-5745bff4c325","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-33037","advisory_id":"44e65aab-16cd-4e14-9546-5745bff4c325","event_types":["advisory"],"published_at":"2026-10-25T01:09:17.808435+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-07-12T14:55:15+00:00","detail_url":"/advisories/advisory%3A44e65aab-16cd-4e14-9546-5745bff4c325","group":{"id":"advisory:44e65aab-16cd-4e14-9546-5745bff4c325","revision":1,"primary_event_id":16015,"change":"published","superseded_by":[],"changed":{"id":16015,"cve_ids":["CVE-2021-33037"],"payload":{"kind":"advisory","title":"Incorrect Transfer-Encoding handling with HTTP/1.0","summary":"Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.","evidence":"cve:CVE-2021-33037","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33037","aliases":["CVE-2021-33037"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10 10.0.0-M1 to 10.0.6"},{"status":"affected","version":"Apache Tomcat 9 9.0.0.M1 to 9.0.46"},{"status":"affected","version":"Apache Tomcat 8 8.5.0 to 8.5.66"}]}],"modified":"2026-10-08T21:13:49.981Z","provider":"cve","references":["https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html","https://www.debian.org/security/2021/dsa-4952","https://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20210827-0007/","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://security.gentoo.org/glsa/202208-34"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210728 [jira] [Created] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210728 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html","name":"[debian-lts-announce] 20210805 [SECURITY] [DLA 2733-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4952","name":"DSA-4952","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210830 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210913 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210914 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210916 [jira] [Resolved] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20210827-0007/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10366","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202208-34","name":"GLSA-202208-34","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T23:42:19.203Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-33037","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:05:35.913828Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:49.981Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2022-08-21T04:07:16.000Z"}}},"related_cves":[{"value":"CVE-2021-33037","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:44e65aab-16cd-4e14-9546-5745bff4c325","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-33037","advisory_id":"44e65aab-16cd-4e14-9546-5745bff4c325","event_types":["advisory"],"published_at":"2026-10-25T01:09:17.808435+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-07-12T14:55:15+00:00","detail_url":"/events/16015"},"members":[{"id":16015,"cve_ids":["CVE-2021-33037"],"payload":{"kind":"advisory","title":"Incorrect Transfer-Encoding handling with HTTP/1.0","summary":"Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.","evidence":"cve:CVE-2021-33037","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-33037","aliases":["CVE-2021-33037"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10 10.0.0-M1 to 10.0.6"},{"status":"affected","version":"Apache Tomcat 9 9.0.0.M1 to 9.0.46"},{"status":"affected","version":"Apache Tomcat 8 8.5.0 to 8.5.66"}]}],"modified":"2026-10-08T21:13:49.981Z","provider":"cve","references":["https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html","https://www.debian.org/security/2021/dsa-4952","https://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20210827-0007/","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://security.gentoo.org/glsa/202208-34"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/r612a79269b0d5e5780c62dfd34286a8037232fec0bc6f1a7e60c9381%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r40f921575aee8d7d34e53182f862c45cbb8f3d898c9d4e865c2ec262%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210728 [jira] [Created] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/re01e7e93154e8bdf78a11a23f9686427bd3d51fc6e12c508645567b7%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210728 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00009.html","name":"[debian-lts-announce] 20210805 [SECURITY] [DLA 2733-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4952","name":"DSA-4952","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd0dfea39829bc0606c936a16f6fca338127c86c0a1083970b45ac8d2%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210830 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r290aee55b72811fd19e75ac80f6143716c079170c5671b96932ed44b%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210913 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rf1b54fd3f52f998ca4829159a88cc4c23d6cef5c6447d00948e75c97%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210914 [jira] [Commented] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rc6ef52453bb996a98cb45442871a1db56b7c349939e45d829bf9ae37%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210916 [jira] [Resolved] (TOMEE-3778) Update embedded Tomcat to 9.0.48 or later to address CVE-2021-33037","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20210827-0007/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10366","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202208-34","name":"GLSA-202208-34","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T23:42:19.203Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-33037","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:05:35.913828Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:49.981Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2022-08-21T04:07:16.000Z"}}},"related_cves":[{"value":"CVE-2021-33037","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:44e65aab-16cd-4e14-9546-5745bff4c325","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-33037","advisory_id":"44e65aab-16cd-4e14-9546-5745bff4c325","event_types":["advisory"],"published_at":"2026-10-25T01:09:17.808435+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-07-12T14:55:15+00:00","detail_url":"/events/16015"}]}},{"id":16104,"cve_ids":["CVE-2021-25122"],"payload":{"kind":"advisory","title":"Apache Tomcat h2c request mix-up","summary":"When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.","evidence":"cve:CVE-2021-25122","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-25122","aliases":["CVE-2021-25122"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10","lessThan":"10.0.2","versionType":"custom"},{"status":"affected","version":"Apache Tomcat 9","lessThan":"9.0.42","versionType":"custom"},{"status":"affected","version":"Apache Tomcat 8.5","lessThan":"8.5.62","versionType":"custom"}]}],"modified":"2026-10-08T21:13:48.044Z","provider":"cve","references":["https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947%40%3Cusers.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html","https://www.debian.org/security/2021/dsa-4891","https://www.oracle.com//security-alerts/cpujul2021.html","https://security.netapp.com/advisory/ntap-20210409-0002/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://security.gentoo.org/glsa/202208-34"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E","name":"[tomcat-announce] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.apache.org%3E","name":"[announce] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2021/03/01/1","name":"[oss-security] 20210301 CVE-2021-25122: Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20210305 RE: [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20210305 Re: [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html","name":"[debian-lts-announce] 20210316 [SECURITY] [DLA 2596-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4891","name":"DSA-4891","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20210409-0002/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202208-34","name":"GLSA-202208-34","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T19:56:10.384Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-25122","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:04:41.948705Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:48.044Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2024-08-03T19:56:19.000Z"}}},"related_cves":[{"value":"CVE-2021-25122","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7ad1994c-025b-4ac7-85a3-03b291d97af1","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-25122","advisory_id":"7ad1994c-025b-4ac7-85a3-03b291d97af1","event_types":["advisory"],"published_at":"2026-10-25T01:09:14.156803+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-03-01T12:00:20+00:00","detail_url":"/advisories/advisory%3A7ad1994c-025b-4ac7-85a3-03b291d97af1","group":{"id":"advisory:7ad1994c-025b-4ac7-85a3-03b291d97af1","revision":1,"primary_event_id":16009,"change":"published","superseded_by":[],"changed":{"id":16009,"cve_ids":["CVE-2021-25122"],"payload":{"kind":"advisory","title":"Apache Tomcat h2c request mix-up","summary":"When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.","evidence":"cve:CVE-2021-25122","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-25122","aliases":["CVE-2021-25122"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10","lessThan":"10.0.2","versionType":"custom"},{"status":"affected","version":"Apache Tomcat 9","lessThan":"9.0.42","versionType":"custom"},{"status":"affected","version":"Apache Tomcat 8.5","lessThan":"8.5.62","versionType":"custom"}]}],"modified":"2026-10-08T21:13:48.044Z","provider":"cve","references":["https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947%40%3Cusers.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html","https://www.debian.org/security/2021/dsa-4891","https://www.oracle.com//security-alerts/cpujul2021.html","https://security.netapp.com/advisory/ntap-20210409-0002/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://security.gentoo.org/glsa/202208-34"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E","name":"[tomcat-announce] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.apache.org%3E","name":"[announce] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2021/03/01/1","name":"[oss-security] 20210301 CVE-2021-25122: Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20210305 RE: [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20210305 Re: [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html","name":"[debian-lts-announce] 20210316 [SECURITY] [DLA 2596-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4891","name":"DSA-4891","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20210409-0002/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202208-34","name":"GLSA-202208-34","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T19:56:10.384Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-25122","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:04:41.948705Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:48.044Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2024-08-03T19:56:19.000Z"}}},"related_cves":[{"value":"CVE-2021-25122","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7ad1994c-025b-4ac7-85a3-03b291d97af1","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-25122","advisory_id":"7ad1994c-025b-4ac7-85a3-03b291d97af1","event_types":["advisory"],"published_at":"2026-10-25T01:09:14.156803+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-03-01T12:00:20+00:00","detail_url":"/events/16009"},"members":[{"id":16009,"cve_ids":["CVE-2021-25122"],"payload":{"kind":"advisory","title":"Apache Tomcat h2c request mix-up","summary":"When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.","evidence":"cve:CVE-2021-25122","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-25122","aliases":["CVE-2021-25122"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10","lessThan":"10.0.2","versionType":"custom"},{"status":"affected","version":"Apache Tomcat 9","lessThan":"9.0.42","versionType":"custom"},{"status":"affected","version":"Apache Tomcat 8.5","lessThan":"8.5.62","versionType":"custom"}]}],"modified":"2026-10-08T21:13:48.044Z","provider":"cve","references":["https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947%40%3Cusers.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html","https://www.debian.org/security/2021/dsa-4891","https://www.oracle.com//security-alerts/cpujul2021.html","https://security.netapp.com/advisory/ntap-20210409-0002/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://security.gentoo.org/glsa/202208-34"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E","name":"[tomcat-announce] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.apache.org%3E","name":"[announce] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2021/03/01/1","name":"[oss-security] 20210301 CVE-2021-25122: Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20210305 RE: [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20210305 Re: [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html","name":"[debian-lts-announce] 20210316 [SECURITY] [DLA 2596-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4891","name":"DSA-4891","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20210409-0002/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202208-34","name":"GLSA-202208-34","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-03T19:56:10.384Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-25122","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:04:41.948705Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:48.044Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2024-08-03T19:56:19.000Z"}}},"related_cves":[{"value":"CVE-2021-25122","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7ad1994c-025b-4ac7-85a3-03b291d97af1","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2021-25122","advisory_id":"7ad1994c-025b-4ac7-85a3-03b291d97af1","event_types":["advisory"],"published_at":"2026-10-25T01:09:14.156803+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-03-01T12:00:20+00:00","detail_url":"/events/16009"}]}},{"id":16064,"cve_ids":["CVE-2020-17527"],"payload":{"kind":"advisory","title":"Apache Tomcat: Request header mix-up between HTTP/2 streams","summary":"While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.","evidence":"cve:CVE-2020-17527","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-17527","aliases":["CVE-2020-17527"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10 10.0.0-M1 to 10.0.0-M9"},{"status":"affected","version":"Apache Tomcat 9 9.0.0-M1 to 9.0.39"},{"status":"affected","version":"Apache Tomcat 8.5 8.5.0 to 8.5.59"}]}],"modified":"2026-10-08T21:13:51.170Z","provider":"cve","references":["https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce%40%3Cissues.guacamole.apache.org%3E","https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee%40%3Cissues.guacamole.apache.org%3E","https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784%40%3Ccommits.tomee.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html","https://security.gentoo.org/glsa/202012-23","https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1%40%3Cusers.tomcat.apache.org%3E","https://www.debian.org/security/2021/dsa-4835","https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20%40%3Ccommits.tomee.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://security.netapp.com/advisory/ntap-20201210-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20201203 svn commit: r1884073 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.apache.org%3E","name":"[announce] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E","name":"[tomcat-announce] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2020/12/03/3","name":"[oss-security] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce%40%3Cissues.guacamole.apache.org%3E","name":"[guacamole-issues] 20201206 [jira] [Created] (GUACAMOLE-1229) Fix in Dockerhub for latest CVE-2020-17527","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee%40%3Cissues.guacamole.apache.org%3E","name":"[guacamole-issues] 20201206 [jira] [Commented] (GUACAMOLE-1229) Fix in Dockerhub for latest CVE-2020-17527","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20201207 [jira] [Created] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20201207 [jira] [Assigned] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html","name":"[debian-lts-announce] 20201216 [SECURITY] [DLA 2495-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202012-23","name":"GLSA-202012-23","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20210114 svn commit: r1885488 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.apache.org%3E","name":"[announce] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.tomcat.apache.org%3E","name":"[tomcat-announce] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4835","name":"DSA-4835","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210319 [jira] [Updated] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20201210-0003/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T14:00:48.652Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2020-17527","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:06:11.841517Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:51.170Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2024-08-04T14:01:40.000Z"}}},"related_cves":[{"value":"CVE-2020-17527","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:84636a1a-75b6-4cbc-8d08-6a332bcf53b3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-17527","advisory_id":"84636a1a-75b6-4cbc-8d08-6a332bcf53b3","event_types":["advisory"],"published_at":"2026-10-25T01:08:50.718462+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2020-12-03T18:30:14+00:00","detail_url":"/advisories/advisory%3A84636a1a-75b6-4cbc-8d08-6a332bcf53b3","group":{"id":"advisory:84636a1a-75b6-4cbc-8d08-6a332bcf53b3","revision":1,"primary_event_id":15970,"change":"published","superseded_by":[],"changed":{"id":15970,"cve_ids":["CVE-2020-17527"],"payload":{"kind":"advisory","title":"Apache Tomcat: Request header mix-up between HTTP/2 streams","summary":"While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.","evidence":"cve:CVE-2020-17527","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-17527","aliases":["CVE-2020-17527"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10 10.0.0-M1 to 10.0.0-M9"},{"status":"affected","version":"Apache Tomcat 9 9.0.0-M1 to 9.0.39"},{"status":"affected","version":"Apache Tomcat 8.5 8.5.0 to 8.5.59"}]}],"modified":"2026-10-08T21:13:51.170Z","provider":"cve","references":["https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce%40%3Cissues.guacamole.apache.org%3E","https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee%40%3Cissues.guacamole.apache.org%3E","https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784%40%3Ccommits.tomee.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html","https://security.gentoo.org/glsa/202012-23","https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1%40%3Cusers.tomcat.apache.org%3E","https://www.debian.org/security/2021/dsa-4835","https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20%40%3Ccommits.tomee.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://security.netapp.com/advisory/ntap-20201210-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20201203 svn commit: r1884073 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.apache.org%3E","name":"[announce] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E","name":"[tomcat-announce] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2020/12/03/3","name":"[oss-security] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce%40%3Cissues.guacamole.apache.org%3E","name":"[guacamole-issues] 20201206 [jira] [Created] (GUACAMOLE-1229) Fix in Dockerhub for latest CVE-2020-17527","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee%40%3Cissues.guacamole.apache.org%3E","name":"[guacamole-issues] 20201206 [jira] [Commented] (GUACAMOLE-1229) Fix in Dockerhub for latest CVE-2020-17527","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20201207 [jira] [Created] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20201207 [jira] [Assigned] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html","name":"[debian-lts-announce] 20201216 [SECURITY] [DLA 2495-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202012-23","name":"GLSA-202012-23","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20210114 svn commit: r1885488 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.apache.org%3E","name":"[announce] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.tomcat.apache.org%3E","name":"[tomcat-announce] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4835","name":"DSA-4835","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210319 [jira] [Updated] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20201210-0003/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T14:00:48.652Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2020-17527","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:06:11.841517Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:51.170Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2024-08-04T14:01:40.000Z"}}},"related_cves":[{"value":"CVE-2020-17527","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:84636a1a-75b6-4cbc-8d08-6a332bcf53b3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-17527","advisory_id":"84636a1a-75b6-4cbc-8d08-6a332bcf53b3","event_types":["advisory"],"published_at":"2026-10-25T01:08:50.718462+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2020-12-03T18:30:14+00:00","detail_url":"/events/15970"},"members":[{"id":15970,"cve_ids":["CVE-2020-17527"],"payload":{"kind":"advisory","title":"Apache Tomcat: Request header mix-up between HTTP/2 streams","summary":"While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.","evidence":"cve:CVE-2020-17527","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-17527","aliases":["CVE-2020-17527"],"metrics":[],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10 10.0.0-M1 to 10.0.0-M9"},{"status":"affected","version":"Apache Tomcat 9 9.0.0-M1 to 9.0.39"},{"status":"affected","version":"Apache Tomcat 8.5 8.5.0 to 8.5.59"}]}],"modified":"2026-10-08T21:13:51.170Z","provider":"cve","references":["https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce%40%3Cissues.guacamole.apache.org%3E","https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee%40%3Cissues.guacamole.apache.org%3E","https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784%40%3Ccommits.tomee.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html","https://security.gentoo.org/glsa/202012-23","https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1%40%3Cusers.tomcat.apache.org%3E","https://www.debian.org/security/2021/dsa-4835","https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20%40%3Ccommits.tomee.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://security.netapp.com/advisory/ntap-20201210-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r8a227ac6a755a6406c1cc47dd48800e973d4cf13fe7fe68ac59c679c%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/raa0e9ad388c1e6fd1e301b5e080f9439f64cb4178119a86a4801cc53%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20201203 svn commit: r1884073 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.apache.org%3E","name":"[announce] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rd5babd13d7a350b369b2f647b4dd32ce678af42f9aba5389df1ae6ca%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rce5ac9a40173651d540babce59f6f3825f12c6d4e886ba00823b11e5%40%3Cannounce.tomcat.apache.org%3E","name":"[tomcat-announce] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2020/12/03/3","name":"[oss-security] 20201203 [SECURITY] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rabbe6b3ae6a9795641d7a05c00d2378d5bbbe4240b7e20f09b092cce%40%3Cissues.guacamole.apache.org%3E","name":"[guacamole-issues] 20201206 [jira] [Created] (GUACAMOLE-1229) Fix in Dockerhub for latest CVE-2020-17527","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra35c8d617b17d59f400112cebadec43ad379f98198b4a9726190d7ee%40%3Cissues.guacamole.apache.org%3E","name":"[guacamole-issues] 20201206 [jira] [Commented] (GUACAMOLE-1229) Fix in Dockerhub for latest CVE-2020-17527","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r9fd47f1b03e9b41d16a5cf72659b533887267d3398d963c2fff3abfa%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20201207 [jira] [Created] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r26a2a66339087fc37db3caf201e446d3e83b5cce314371e235ff1784%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20201207 [jira] [Assigned] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/12/msg00022.html","name":"[debian-lts-announce] 20201216 [SECURITY] [DLA 2495-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://security.gentoo.org/glsa/202012-23","name":"GLSA-202012-23","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rca833c6d42b7b9ce1563488c0929f29fcc95947d86e5e740258c8937%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20210114 svn commit: r1885488 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xml","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.apache.org%3E","name":"[announce] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r5a285242737ddef4d338236328aaaf3237183e1465a5efafd16b99ed%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra9fcdb904dd2e2256ef90b3e4ced279cd464cb0ab63a6c64df5c010d%40%3Cannounce.tomcat.apache.org%3E","name":"[tomcat-announce] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rbba08c4dcef3603e36276d49adda8eedbe458c5104314b4038f697e1%40%3Cusers.tomcat.apache.org%3E","name":"[tomcat-users] 20210119 Re: [SECURITY][CORRECTION] CVE-2020-17527 Apache Tomcat HTTP/2 Request header mix-up","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4835","name":"DSA-4835","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r2d6e05c5ff96f8068a59dfdb3800e9ee8d4e36ce1971783c6e5f9b20%40%3Ccommits.tomee.apache.org%3E","name":"[tomee-commits] 20210319 [jira] [Updated] (TOMEE-2936) TomEE plus(7.0.9) is affected by CVE-2020-17527(BDSA-2020-3628) vulnerability.","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20201210-0003/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T14:00:48.652Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2020-17527","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:06:11.841517Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:51.170Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2024-08-04T14:01:40.000Z"}}},"related_cves":[{"value":"CVE-2020-17527","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:84636a1a-75b6-4cbc-8d08-6a332bcf53b3","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-17527","advisory_id":"84636a1a-75b6-4cbc-8d08-6a332bcf53b3","event_types":["advisory"],"published_at":"2026-10-25T01:08:50.718462+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2020-12-03T18:30:14+00:00","detail_url":"/events/15970"}]}},{"id":16061,"cve_ids":["CVE-2020-13943"],"payload":{"kind":"advisory","title":"CVE-2020-13943","summary":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","evidence":"cve:CVE-2020-13943","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-13943","aliases":["CVE-2020-13943"],"metrics":[],"affected":[{"vendor":"n/a","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57"}]}],"modified":"2026-10-08T21:13:52.499Z","provider":"cve","references":["https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html","https://www.debian.org/security/2021/dsa-4835","https://www.oracle.com/security-alerts/cpuApr2021.html","https://security.netapp.com/advisory/ntap-20201016-0007/"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html","name":"[debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html","name":"openSUSE-SU-2020:1799","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html","name":"openSUSE-SU-2020:1842","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4835","name":"DSA-4835","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20201016-0007/","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T12:32:14.470Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2020-13943","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:06:44.131648Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:52.499Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2021-06-14T17:20:16.000Z"}}},"related_cves":[{"value":"CVE-2020-13943","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9a4d19a1-85e5-43e7-a7fd-3d323c05d876","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-13943","advisory_id":"9a4d19a1-85e5-43e7-a7fd-3d323c05d876","event_types":["advisory"],"published_at":"2026-10-25T01:08:48.927331+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2020-10-12T13:46:47+00:00","detail_url":"/advisories/advisory%3A9a4d19a1-85e5-43e7-a7fd-3d323c05d876","group":{"id":"advisory:9a4d19a1-85e5-43e7-a7fd-3d323c05d876","revision":1,"primary_event_id":15967,"change":"published","superseded_by":[],"changed":{"id":15967,"cve_ids":["CVE-2020-13943"],"payload":{"kind":"advisory","title":"CVE-2020-13943","summary":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","evidence":"cve:CVE-2020-13943","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-13943","aliases":["CVE-2020-13943"],"metrics":[],"affected":[{"vendor":"n/a","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57"}]}],"modified":"2026-10-08T21:13:52.499Z","provider":"cve","references":["https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html","https://www.debian.org/security/2021/dsa-4835","https://www.oracle.com/security-alerts/cpuApr2021.html","https://security.netapp.com/advisory/ntap-20201016-0007/"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html","name":"[debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html","name":"openSUSE-SU-2020:1799","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html","name":"openSUSE-SU-2020:1842","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4835","name":"DSA-4835","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20201016-0007/","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T12:32:14.470Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2020-13943","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:06:44.131648Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:52.499Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2021-06-14T17:20:16.000Z"}}},"related_cves":[{"value":"CVE-2020-13943","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9a4d19a1-85e5-43e7-a7fd-3d323c05d876","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-13943","advisory_id":"9a4d19a1-85e5-43e7-a7fd-3d323c05d876","event_types":["advisory"],"published_at":"2026-10-25T01:08:48.927331+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2020-10-12T13:46:47+00:00","detail_url":"/events/15967"},"members":[{"id":15967,"cve_ids":["CVE-2020-13943"],"payload":{"kind":"advisory","title":"CVE-2020-13943","summary":"If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.","evidence":"cve:CVE-2020-13943","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-13943","aliases":["CVE-2020-13943"],"metrics":[],"affected":[{"vendor":"n/a","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57"}]}],"modified":"2026-10-08T21:13:52.499Z","provider":"cve","references":["https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html","https://www.debian.org/security/2021/dsa-4835","https://www.oracle.com/security-alerts/cpuApr2021.html","https://security.netapp.com/advisory/ntap-20201016-0007/"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00019.html","name":"[debian-lts-announce] 20201014 [SECURITY] [DLA 2407-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html","name":"openSUSE-SU-2020:1799","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html","name":"openSUSE-SU-2020:1842","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://www.debian.org/security/2021/dsa-4835","name":"DSA-4835","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20201016-0007/","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T12:32:14.470Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2020-13943","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:06:44.131648Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:52.499Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2021-06-14T17:20:16.000Z"}}},"related_cves":[{"value":"CVE-2020-13943","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:9a4d19a1-85e5-43e7-a7fd-3d323c05d876","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-13943","advisory_id":"9a4d19a1-85e5-43e7-a7fd-3d323c05d876","event_types":["advisory"],"published_at":"2026-10-25T01:08:48.927331+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2020-10-12T13:46:47+00:00","detail_url":"/events/15967"}]}},{"id":16060,"cve_ids":["CVE-2020-13934"],"payload":{"kind":"advisory","title":"CVE-2020-13934","summary":"An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.","evidence":"cve:CVE-2020-13934","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-13934","aliases":["CVE-2020-13934"],"metrics":[],"affected":[{"vendor":"n/a","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, 8.5.1 to 8.5.56"}]}],"modified":"2026-10-08T21:13:57.516Z","provider":"cve","references":["https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E","https://www.debian.org/security/2020/dsa-4727","https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html","https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://security.netapp.com/advisory/ntap-20200724-0003/","https://usn.ubuntu.com/4596-1/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.debian.org/security/2020/dsa-4727","name":"DSA-4727","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html","name":"[debian-lts-announce] 20200722 [SECURITY] [DLA 2286-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html","name":"openSUSE-SU-2020:1102","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html","name":"openSUSE-SU-2020:1111","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200818 [Bug 64671] HTTP/2 Stream.receivedData method throwing continuous NullPointerException in the logs","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20200724-0003/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://usn.ubuntu.com/4596-1/","name":"USN-4596-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T12:32:14.414Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2020-13934","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:09:22.018198Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:57.516Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2022-02-07T14:40:22.000Z"}}},"related_cves":[{"value":"CVE-2020-13934","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c63a0bfe-71c7-4201-96bf-381570bba78f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-13934","advisory_id":"c63a0bfe-71c7-4201-96bf-381570bba78f","event_types":["advisory"],"published_at":"2026-10-25T01:08:48.295636+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2020-07-14T14:59:11+00:00","detail_url":"/advisories/advisory%3Ac63a0bfe-71c7-4201-96bf-381570bba78f","group":{"id":"advisory:c63a0bfe-71c7-4201-96bf-381570bba78f","revision":1,"primary_event_id":15966,"change":"published","superseded_by":[],"changed":{"id":15966,"cve_ids":["CVE-2020-13934"],"payload":{"kind":"advisory","title":"CVE-2020-13934","summary":"An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.","evidence":"cve:CVE-2020-13934","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-13934","aliases":["CVE-2020-13934"],"metrics":[],"affected":[{"vendor":"n/a","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, 8.5.1 to 8.5.56"}]}],"modified":"2026-10-08T21:13:57.516Z","provider":"cve","references":["https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E","https://www.debian.org/security/2020/dsa-4727","https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html","https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://security.netapp.com/advisory/ntap-20200724-0003/","https://usn.ubuntu.com/4596-1/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.debian.org/security/2020/dsa-4727","name":"DSA-4727","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html","name":"[debian-lts-announce] 20200722 [SECURITY] [DLA 2286-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html","name":"openSUSE-SU-2020:1102","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html","name":"openSUSE-SU-2020:1111","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200818 [Bug 64671] HTTP/2 Stream.receivedData method throwing continuous NullPointerException in the logs","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20200724-0003/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://usn.ubuntu.com/4596-1/","name":"USN-4596-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T12:32:14.414Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2020-13934","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:09:22.018198Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:57.516Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2022-02-07T14:40:22.000Z"}}},"related_cves":[{"value":"CVE-2020-13934","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c63a0bfe-71c7-4201-96bf-381570bba78f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-13934","advisory_id":"c63a0bfe-71c7-4201-96bf-381570bba78f","event_types":["advisory"],"published_at":"2026-10-25T01:08:48.295636+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2020-07-14T14:59:11+00:00","detail_url":"/events/15966"},"members":[{"id":15966,"cve_ids":["CVE-2020-13934"],"payload":{"kind":"advisory","title":"CVE-2020-13934","summary":"An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.","evidence":"cve:CVE-2020-13934","products":[{"name":{"value":"Apache Tomcat","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-13934","aliases":["CVE-2020-13934"],"metrics":[],"affected":[{"vendor":"n/a","product":"Apache Tomcat","versions":[{"status":"affected","version":"Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36, 8.5.1 to 8.5.56"}]}],"modified":"2026-10-08T21:13:57.516Z","provider":"cve","references":["https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E","https://www.debian.org/security/2020/dsa-4727","https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html","https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8%40%3Cdev.tomcat.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://security.netapp.com/advisory/ntap-20200724-0003/","https://usn.ubuntu.com/4596-1/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://lists.apache.org/thread.html/r61f411cf82488d6ec213063fc15feeeb88e31b0ca9c29652ee4f962e%40%3Cannounce.tomcat.apache.org%3E","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.debian.org/security/2020/dsa-4727","name":"DSA-4727","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00017.html","name":"[debian-lts-announce] 20200722 [SECURITY] [DLA 2286-1] tomcat8 security update","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00084.html","name":"openSUSE-SU-2020:1102","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00088.html","name":"openSUSE-SU-2020:1111","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://lists.apache.org/thread.html/ra072b1f786e7d139e86f1d1145572e0ff71cef38a96d9c6f5362aac8%40%3Cdev.tomcat.apache.org%3E","name":"[tomcat-dev] 20200818 [Bug 64671] HTTP/2 Stream.receivedData method throwing continuous NullPointerException in the logs","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20200724-0003/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://usn.ubuntu.com/4596-1/","name":"USN-4596-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-04T12:32:14.414Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2020-13934","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-08T21:09:22.018198Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-08T21:13:57.516Z"}}],"cna":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2022-02-07T14:40:22.000Z"}}},"related_cves":[{"value":"CVE-2020-13934","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c63a0bfe-71c7-4201-96bf-381570bba78f","priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2020-13934","advisory_id":"c63a0bfe-71c7-4201-96bf-381570bba78f","event_types":["advisory"],"published_at":"2026-10-25T01:08:48.295636+00:00","technologies":["apache-tomcat","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2020-07-14T14:59:11+00:00","detail_url":"/events/15966"}]}}],"next_after":60355,"next_before":16060}