tomcat10, tomcat11 and 4 more products — security advisory

{
  "id": "b2e5e35539b744df897f2a566c6db30c2a6f04d494d80da1a817a28cece1b568",
  "url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-68525",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "UBUNTU-CVE-2026-68525",
    "summary": "Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.",
    "evidence": "osv:UBUNTU-CVE-2026-68525",
    "products": [
      {
        "name": {
          "value": "tomcat6",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "6.0.37-1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "6.0.39-1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "6.0.39-1ubuntu0.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "6.0.39-1ubuntu0.1+esm1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "6.0.39-1ubuntu0.1+esm2",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "6.0.39-1ubuntu0.1+esm3",
            "evidence": "/affected/0/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat7",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "7.0.42-1",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.47-1",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.50-1",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.1",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.3",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.6",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.7",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.8",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.9",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.10",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.11",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.13",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.14",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.15",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.16",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.16+esm1",
            "evidence": "/affected/1/versions"
          },
          {
            "value": "7.0.52-1ubuntu0.16+esm2",
            "evidence": "/affected/1/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat8",
          "evidence": "/affected/2/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "8.0.26-1",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.28-1",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.30-1",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.1",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.2",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.3",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.4",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.5",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.6",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.7",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.8",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.9",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.10",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.11",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.13",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.13+esm1",
            "evidence": "/affected/2/versions"
          },
          {
            "value": "8.0.32-1ubuntu1.13+esm2",
            "evidence": "/affected/2/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat7",
          "evidence": "/affected/3/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "7.0.64-1",
            "evidence": "/affected/3/versions"
          },
          {
            "value": "7.0.68-1",
            "evidence": "/affected/3/versions"
          },
          {
            "value": "7.0.68-1ubuntu0.1",
            "evidence": "/affected/3/versions"
          },
          {
            "value": "7.0.68-1ubuntu0.3",
            "evidence": "/affected/3/versions"
          },
          {
            "value": "7.0.68-1ubuntu0.4",
            "evidence": "/affected/3/versions"
          },
          {
            "value": "7.0.68-1ubuntu0.4+esm1",
            "evidence": "/affected/3/versions"
          },
          {
            "value": "7.0.68-1ubuntu0.4+esm2",
            "evidence": "/affected/3/versions"
          },
          {
            "value": "7.0.68-1ubuntu0.4+esm3",
            "evidence": "/affected/3/versions"
          },
          {
            "value": "7.0.68-1ubuntu0.4+esm4",
            "evidence": "/affected/3/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat8",
          "evidence": "/affected/4/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "8.5.21-1ubuntu1",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.29-1",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.30-1",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.30-1ubuntu1",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.30-1ubuntu1.2",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.30-1ubuntu1.3",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.30-1ubuntu1.4",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.39-1ubuntu1~18.04.1",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.39-1ubuntu1~18.04.2",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.39-1ubuntu1~18.04.3",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.39-1ubuntu1~18.04.3+esm1",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.39-1ubuntu1~18.04.3+esm2",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.39-1ubuntu1~18.04.3+esm3",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.39-1ubuntu1~18.04.3+esm4",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.39-1ubuntu1~18.04.3+esm5",
            "evidence": "/affected/4/versions"
          },
          {
            "value": "8.5.39-1ubuntu1~18.04.3+esm6",
            "evidence": "/affected/4/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat9",
          "evidence": "/affected/5/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "9.0.16-3~18.04.1",
            "evidence": "/affected/5/versions"
          },
          {
            "value": "9.0.16-3ubuntu0.18.04.1",
            "evidence": "/affected/5/versions"
          },
          {
            "value": "9.0.16-3ubuntu0.18.04.2",
            "evidence": "/affected/5/versions"
          },
          {
            "value": "9.0.16-3ubuntu0.18.04.2+esm1",
            "evidence": "/affected/5/versions"
          },
          {
            "value": "9.0.16-3ubuntu0.18.04.2+esm2",
            "evidence": "/affected/5/versions"
          },
          {
            "value": "9.0.16-3ubuntu0.18.04.2+esm3",
            "evidence": "/affected/5/versions"
          },
          {
            "value": "9.0.16-3ubuntu0.18.04.2+esm4",
            "evidence": "/affected/5/versions"
          },
          {
            "value": "9.0.16-3ubuntu0.18.04.2+esm5",
            "evidence": "/affected/5/versions"
          },
          {
            "value": "9.0.16-3ubuntu0.18.04.2+esm6",
            "evidence": "/affected/5/versions"
          },
          {
            "value": "9.0.16-3ubuntu0.18.04.2+esm7",
            "evidence": "/affected/5/versions"
          },
          {
            "value": "9.0.16-3ubuntu0.18.04.2+esm8",
            "evidence": "/affected/5/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat9",
          "evidence": "/affected/6/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "9.0.24-1",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.27-1",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.31-1",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.31-1ubuntu0.1",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.31-1ubuntu0.2",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.31-1ubuntu0.3",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.31-1ubuntu0.4",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.31-1ubuntu0.5",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.31-1ubuntu0.6",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.31-1ubuntu0.7",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.31-1ubuntu0.8",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.31-1ubuntu0.9",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.31-1ubuntu0.9+esm1",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.31-1ubuntu0.9+esm2",
            "evidence": "/affected/6/versions"
          },
          {
            "value": "9.0.31-1ubuntu0.9+esm3",
            "evidence": "/affected/6/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat9",
          "evidence": "/affected/7/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "9.0.43-3",
            "evidence": "/affected/7/versions"
          },
          {
            "value": "9.0.54-1",
            "evidence": "/affected/7/versions"
          },
          {
            "value": "9.0.55-1",
            "evidence": "/affected/7/versions"
          },
          {
            "value": "9.0.58-1",
            "evidence": "/affected/7/versions"
          },
          {
            "value": "9.0.58-1ubuntu0.1",
            "evidence": "/affected/7/versions"
          },
          {
            "value": "9.0.58-1ubuntu0.1+esm1",
            "evidence": "/affected/7/versions"
          },
          {
            "value": "9.0.58-1ubuntu0.1+esm2",
            "evidence": "/affected/7/versions"
          },
          {
            "value": "9.0.58-1ubuntu0.1+esm3",
            "evidence": "/affected/7/versions"
          },
          {
            "value": "9.0.58-1ubuntu0.1+esm4",
            "evidence": "/affected/7/versions"
          },
          {
            "value": "9.0.58-1ubuntu0.2",
            "evidence": "/affected/7/versions"
          },
          {
            "value": "9.0.58-1ubuntu0.2+esm1",
            "evidence": "/affected/7/versions"
          },
          {
            "value": "9.0.58-1ubuntu0.2+esm2",
            "evidence": "/affected/7/versions"
          },
          {
            "value": "9.0.58-1ubuntu0.2+esm3",
            "evidence": "/affected/7/versions"
          },
          {
            "value": "9.0.58-1ubuntu0.2+esm4",
            "evidence": "/affected/7/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat10",
          "evidence": "/affected/8/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "10.1.10-1",
            "evidence": "/affected/8/versions"
          },
          {
            "value": "10.1.14-1",
            "evidence": "/affected/8/versions"
          },
          {
            "value": "10.1.15-1",
            "evidence": "/affected/8/versions"
          },
          {
            "value": "10.1.16-1",
            "evidence": "/affected/8/versions"
          },
          {
            "value": "10.1.16-1ubuntu0.1~esm1",
            "evidence": "/affected/8/versions"
          },
          {
            "value": "10.1.16-1ubuntu0.1~esm2",
            "evidence": "/affected/8/versions"
          },
          {
            "value": "10.1.16-1ubuntu0.1~esm3",
            "evidence": "/affected/8/versions"
          },
          {
            "value": "10.1.16-1ubuntu0.1~esm4",
            "evidence": "/affected/8/versions"
          },
          {
            "value": "10.1.55-1ubuntu2~24.04.1",
            "evidence": "/affected/8/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat9",
          "evidence": "/affected/9/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "9.0.70-1ubuntu1",
            "evidence": "/affected/9/versions"
          },
          {
            "value": "9.0.70-2",
            "evidence": "/affected/9/versions"
          },
          {
            "value": "9.0.70-2ubuntu0.1",
            "evidence": "/affected/9/versions"
          },
          {
            "value": "9.0.70-2ubuntu0.1+esm1",
            "evidence": "/affected/9/versions"
          },
          {
            "value": "9.0.70-2ubuntu0.1+esm2",
            "evidence": "/affected/9/versions"
          },
          {
            "value": "9.0.70-2ubuntu0.1+esm3",
            "evidence": "/affected/9/versions"
          },
          {
            "value": "9.0.118-1~24.04.1",
            "evidence": "/affected/9/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat10",
          "evidence": "/affected/10/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "10.1.40-1ubuntu1",
            "evidence": "/affected/10/versions"
          },
          {
            "value": "10.1.54-1",
            "evidence": "/affected/10/versions"
          },
          {
            "value": "10.1.54-1ubuntu1",
            "evidence": "/affected/10/versions"
          },
          {
            "value": "10.1.54-1ubuntu2",
            "evidence": "/affected/10/versions"
          },
          {
            "value": "10.1.55-1ubuntu1",
            "evidence": "/affected/10/versions"
          },
          {
            "value": "10.1.55-1ubuntu2",
            "evidence": "/affected/10/versions"
          },
          {
            "value": "10.1.57~us1-0ubuntu1",
            "evidence": "/affected/10/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat11",
          "evidence": "/affected/11/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "11.0.18-1",
            "evidence": "/affected/11/versions"
          },
          {
            "value": "11.0.22-2",
            "evidence": "/affected/11/versions"
          },
          {
            "value": "11.0.22-2ubuntu1",
            "evidence": "/affected/11/versions"
          },
          {
            "value": "11.0.22-2ubuntu2",
            "evidence": "/affected/11/versions"
          },
          {
            "value": "11.0.24-1ubuntu1",
            "evidence": "/affected/11/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat9",
          "evidence": "/affected/12/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "9.0.115-1",
            "evidence": "/affected/12/versions"
          },
          {
            "value": "9.0.115-1ubuntu1",
            "evidence": "/affected/12/versions"
          },
          {
            "value": "9.0.118-1",
            "evidence": "/affected/12/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat10",
          "evidence": "/affected/13/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "10.1.40-1ubuntu1",
            "evidence": "/affected/13/versions"
          },
          {
            "value": "10.1.40-1ubuntu1.26.04.1",
            "evidence": "/affected/13/versions"
          },
          {
            "value": "10.1.55-1ubuntu2~26.04.1",
            "evidence": "/affected/13/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat9",
          "evidence": "/affected/14/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "9.0.95-1ubuntu1",
            "evidence": "/affected/14/versions"
          },
          {
            "value": "9.0.111-1",
            "evidence": "/affected/14/versions"
          },
          {
            "value": "9.0.115-1",
            "evidence": "/affected/14/versions"
          },
          {
            "value": "9.0.115-1ubuntu0.1",
            "evidence": "/affected/14/versions"
          },
          {
            "value": "9.0.118-1~26.04.1",
            "evidence": "/affected/14/versions"
          }
        ]
      },
      {
        "name": {
          "value": "tomcat11",
          "evidence": "/affected/15/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "11.0.6-1",
            "evidence": "/affected/15/versions"
          },
          {
            "value": "11.0.11-1",
            "evidence": "/affected/15/versions"
          },
          {
            "value": "11.0.15-1",
            "evidence": "/affected/15/versions"
          },
          {
            "value": "11.0.18-1",
            "evidence": "/affected/15/versions"
          },
          {
            "value": "11.0.18-1ubuntu0.1~esm1",
            "evidence": "/affected/15/versions"
          },
          {
            "value": "11.0.22-2ubuntu2~26.04.1",
            "evidence": "/affected/15/versions"
          }
        ]
      }
    ],
    "severity": "critical",
    "structured": {
      "id": "UBUNTU-CVE-2026-68525",
      "aliases": [
        "UBUNTU-CVE-2026-68525"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        },
        {
          "type": "Ubuntu",
          "score": "medium"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat6",
            "purl": "pkg:deb/ubuntu/tomcat6?arch=source&distro=esm-infra-legacy%2Ftrusty",
            "ecosystem": "Ubuntu:Pro:14.04:LTS"
          },
          "versions": [
            "6.0.37-1",
            "6.0.39-1",
            "6.0.39-1ubuntu0.1",
            "6.0.39-1ubuntu0.1+esm1",
            "6.0.39-1ubuntu0.1+esm2",
            "6.0.39-1ubuntu0.1+esm3"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libservlet2.4-java",
                "binary_version": "6.0.39-1ubuntu0.1+esm3"
              },
              {
                "binary_name": "libservlet2.5-java",
                "binary_version": "6.0.39-1ubuntu0.1+esm3"
              },
              {
                "binary_name": "libtomcat6-java",
                "binary_version": "6.0.39-1ubuntu0.1+esm3"
              },
              {
                "binary_name": "tomcat6",
                "binary_version": "6.0.39-1ubuntu0.1+esm3"
              },
              {
                "binary_name": "tomcat6-admin",
                "binary_version": "6.0.39-1ubuntu0.1+esm3"
              },
              {
                "binary_name": "tomcat6-common",
                "binary_version": "6.0.39-1ubuntu0.1+esm3"
              },
              {
                "binary_name": "tomcat6-docs",
                "binary_version": "6.0.39-1ubuntu0.1+esm3"
              },
              {
                "binary_name": "tomcat6-examples",
                "binary_version": "6.0.39-1ubuntu0.1+esm3"
              },
              {
                "binary_name": "tomcat6-extras",
                "binary_version": "6.0.39-1ubuntu0.1+esm3"
              },
              {
                "binary_name": "tomcat6-user",
                "binary_version": "6.0.39-1ubuntu0.1+esm3"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat7",
            "purl": "pkg:deb/ubuntu/tomcat7?arch=source&distro=esm-infra-legacy%2Ftrusty",
            "ecosystem": "Ubuntu:Pro:14.04:LTS"
          },
          "versions": [
            "7.0.42-1",
            "7.0.47-1",
            "7.0.50-1",
            "7.0.52-1",
            "7.0.52-1ubuntu0.1",
            "7.0.52-1ubuntu0.3",
            "7.0.52-1ubuntu0.6",
            "7.0.52-1ubuntu0.7",
            "7.0.52-1ubuntu0.8",
            "7.0.52-1ubuntu0.9",
            "7.0.52-1ubuntu0.10",
            "7.0.52-1ubuntu0.11",
            "7.0.52-1ubuntu0.13",
            "7.0.52-1ubuntu0.14",
            "7.0.52-1ubuntu0.15",
            "7.0.52-1ubuntu0.16",
            "7.0.52-1ubuntu0.16+esm1",
            "7.0.52-1ubuntu0.16+esm2"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libservlet3.0-java",
                "binary_version": "7.0.52-1ubuntu0.16+esm2"
              },
              {
                "binary_name": "libtomcat7-java",
                "binary_version": "7.0.52-1ubuntu0.16+esm2"
              },
              {
                "binary_name": "tomcat7",
                "binary_version": "7.0.52-1ubuntu0.16+esm2"
              },
              {
                "binary_name": "tomcat7-admin",
                "binary_version": "7.0.52-1ubuntu0.16+esm2"
              },
              {
                "binary_name": "tomcat7-common",
                "binary_version": "7.0.52-1ubuntu0.16+esm2"
              },
              {
                "binary_name": "tomcat7-docs",
                "binary_version": "7.0.52-1ubuntu0.16+esm2"
              },
              {
                "binary_name": "tomcat7-examples",
                "binary_version": "7.0.52-1ubuntu0.16+esm2"
              },
              {
                "binary_name": "tomcat7-user",
                "binary_version": "7.0.52-1ubuntu0.16+esm2"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat8",
            "purl": "pkg:deb/ubuntu/tomcat8?arch=source&distro=esm-infra-legacy%2Fxenial",
            "ecosystem": "Ubuntu:Pro:16.04:LTS"
          },
          "versions": [
            "8.0.26-1",
            "8.0.28-1",
            "8.0.30-1",
            "8.0.32-1",
            "8.0.32-1ubuntu1",
            "8.0.32-1ubuntu1.1",
            "8.0.32-1ubuntu1.2",
            "8.0.32-1ubuntu1.3",
            "8.0.32-1ubuntu1.4",
            "8.0.32-1ubuntu1.5",
            "8.0.32-1ubuntu1.6",
            "8.0.32-1ubuntu1.7",
            "8.0.32-1ubuntu1.8",
            "8.0.32-1ubuntu1.9",
            "8.0.32-1ubuntu1.10",
            "8.0.32-1ubuntu1.11",
            "8.0.32-1ubuntu1.13",
            "8.0.32-1ubuntu1.13+esm1",
            "8.0.32-1ubuntu1.13+esm2"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libservlet3.1-java",
                "binary_version": "8.0.32-1ubuntu1.13+esm2"
              },
              {
                "binary_name": "libtomcat8-java",
                "binary_version": "8.0.32-1ubuntu1.13+esm2"
              },
              {
                "binary_name": "tomcat8",
                "binary_version": "8.0.32-1ubuntu1.13+esm2"
              },
              {
                "binary_name": "tomcat8-admin",
                "binary_version": "8.0.32-1ubuntu1.13+esm2"
              },
              {
                "binary_name": "tomcat8-common",
                "binary_version": "8.0.32-1ubuntu1.13+esm2"
              },
              {
                "binary_name": "tomcat8-docs",
                "binary_version": "8.0.32-1ubuntu1.13+esm2"
              },
              {
                "binary_name": "tomcat8-examples",
                "binary_version": "8.0.32-1ubuntu1.13+esm2"
              },
              {
                "binary_name": "tomcat8-user",
                "binary_version": "8.0.32-1ubuntu1.13+esm2"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat7",
            "purl": "pkg:deb/ubuntu/tomcat7?arch=source&distro=esm-apps-legacy%2Fxenial",
            "ecosystem": "Ubuntu:Pro:16.04:LTS"
          },
          "versions": [
            "7.0.64-1",
            "7.0.68-1",
            "7.0.68-1ubuntu0.1",
            "7.0.68-1ubuntu0.3",
            "7.0.68-1ubuntu0.4",
            "7.0.68-1ubuntu0.4+esm1",
            "7.0.68-1ubuntu0.4+esm2",
            "7.0.68-1ubuntu0.4+esm3",
            "7.0.68-1ubuntu0.4+esm4"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libservlet3.0-java",
                "binary_version": "7.0.68-1ubuntu0.4+esm4"
              },
              {
                "binary_name": "libtomcat7-java",
                "binary_version": "7.0.68-1ubuntu0.4+esm4"
              },
              {
                "binary_name": "tomcat7",
                "binary_version": "7.0.68-1ubuntu0.4+esm4"
              },
              {
                "binary_name": "tomcat7-admin",
                "binary_version": "7.0.68-1ubuntu0.4+esm4"
              },
              {
                "binary_name": "tomcat7-common",
                "binary_version": "7.0.68-1ubuntu0.4+esm4"
              },
              {
                "binary_name": "tomcat7-docs",
                "binary_version": "7.0.68-1ubuntu0.4+esm4"
              },
              {
                "binary_name": "tomcat7-examples",
                "binary_version": "7.0.68-1ubuntu0.4+esm4"
              },
              {
                "binary_name": "tomcat7-user",
                "binary_version": "7.0.68-1ubuntu0.4+esm4"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat8",
            "purl": "pkg:deb/ubuntu/tomcat8?arch=source&distro=esm-apps%2Fbionic",
            "ecosystem": "Ubuntu:Pro:18.04:LTS"
          },
          "versions": [
            "8.5.21-1ubuntu1",
            "8.5.29-1",
            "8.5.30-1",
            "8.5.30-1ubuntu1",
            "8.5.30-1ubuntu1.2",
            "8.5.30-1ubuntu1.3",
            "8.5.30-1ubuntu1.4",
            "8.5.39-1ubuntu1~18.04.1",
            "8.5.39-1ubuntu1~18.04.2",
            "8.5.39-1ubuntu1~18.04.3",
            "8.5.39-1ubuntu1~18.04.3+esm1",
            "8.5.39-1ubuntu1~18.04.3+esm2",
            "8.5.39-1ubuntu1~18.04.3+esm3",
            "8.5.39-1ubuntu1~18.04.3+esm4",
            "8.5.39-1ubuntu1~18.04.3+esm5",
            "8.5.39-1ubuntu1~18.04.3+esm6"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libtomcat8-embed-java",
                "binary_version": "8.5.39-1ubuntu1~18.04.3+esm6"
              },
              {
                "binary_name": "libtomcat8-java",
                "binary_version": "8.5.39-1ubuntu1~18.04.3+esm6"
              },
              {
                "binary_name": "tomcat8",
                "binary_version": "8.5.39-1ubuntu1~18.04.3+esm6"
              },
              {
                "binary_name": "tomcat8-admin",
                "binary_version": "8.5.39-1ubuntu1~18.04.3+esm6"
              },
              {
                "binary_name": "tomcat8-common",
                "binary_version": "8.5.39-1ubuntu1~18.04.3+esm6"
              },
              {
                "binary_name": "tomcat8-docs",
                "binary_version": "8.5.39-1ubuntu1~18.04.3+esm6"
              },
              {
                "binary_name": "tomcat8-examples",
                "binary_version": "8.5.39-1ubuntu1~18.04.3+esm6"
              },
              {
                "binary_name": "tomcat8-user",
                "binary_version": "8.5.39-1ubuntu1~18.04.3+esm6"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat9",
            "purl": "pkg:deb/ubuntu/tomcat9?arch=source&distro=esm-apps%2Fbionic",
            "ecosystem": "Ubuntu:Pro:18.04:LTS"
          },
          "versions": [
            "9.0.16-3~18.04.1",
            "9.0.16-3ubuntu0.18.04.1",
            "9.0.16-3ubuntu0.18.04.2",
            "9.0.16-3ubuntu0.18.04.2+esm1",
            "9.0.16-3ubuntu0.18.04.2+esm2",
            "9.0.16-3ubuntu0.18.04.2+esm3",
            "9.0.16-3ubuntu0.18.04.2+esm4",
            "9.0.16-3ubuntu0.18.04.2+esm5",
            "9.0.16-3ubuntu0.18.04.2+esm6",
            "9.0.16-3ubuntu0.18.04.2+esm7",
            "9.0.16-3ubuntu0.18.04.2+esm8"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libtomcat9-embed-java",
                "binary_version": "9.0.16-3ubuntu0.18.04.2+esm8"
              },
              {
                "binary_name": "libtomcat9-java",
                "binary_version": "9.0.16-3ubuntu0.18.04.2+esm8"
              },
              {
                "binary_name": "tomcat9",
                "binary_version": "9.0.16-3ubuntu0.18.04.2+esm8"
              },
              {
                "binary_name": "tomcat9-admin",
                "binary_version": "9.0.16-3ubuntu0.18.04.2+esm8"
              },
              {
                "binary_name": "tomcat9-common",
                "binary_version": "9.0.16-3ubuntu0.18.04.2+esm8"
              },
              {
                "binary_name": "tomcat9-docs",
                "binary_version": "9.0.16-3ubuntu0.18.04.2+esm8"
              },
              {
                "binary_name": "tomcat9-examples",
                "binary_version": "9.0.16-3ubuntu0.18.04.2+esm8"
              },
              {
                "binary_name": "tomcat9-user",
                "binary_version": "9.0.16-3ubuntu0.18.04.2+esm8"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat9",
            "purl": "pkg:deb/ubuntu/tomcat9?arch=source&distro=esm-apps%2Ffocal",
            "ecosystem": "Ubuntu:Pro:20.04:LTS"
          },
          "versions": [
            "9.0.24-1",
            "9.0.27-1",
            "9.0.31-1",
            "9.0.31-1ubuntu0.1",
            "9.0.31-1ubuntu0.2",
            "9.0.31-1ubuntu0.3",
            "9.0.31-1ubuntu0.4",
            "9.0.31-1ubuntu0.5",
            "9.0.31-1ubuntu0.6",
            "9.0.31-1ubuntu0.7",
            "9.0.31-1ubuntu0.8",
            "9.0.31-1ubuntu0.9",
            "9.0.31-1ubuntu0.9+esm1",
            "9.0.31-1ubuntu0.9+esm2",
            "9.0.31-1ubuntu0.9+esm3"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libtomcat9-embed-java",
                "binary_version": "9.0.31-1ubuntu0.9+esm3"
              },
              {
                "binary_name": "libtomcat9-java",
                "binary_version": "9.0.31-1ubuntu0.9+esm3"
              },
              {
                "binary_name": "tomcat9",
                "binary_version": "9.0.31-1ubuntu0.9+esm3"
              },
              {
                "binary_name": "tomcat9-admin",
                "binary_version": "9.0.31-1ubuntu0.9+esm3"
              },
              {
                "binary_name": "tomcat9-common",
                "binary_version": "9.0.31-1ubuntu0.9+esm3"
              },
              {
                "binary_name": "tomcat9-docs",
                "binary_version": "9.0.31-1ubuntu0.9+esm3"
              },
              {
                "binary_name": "tomcat9-examples",
                "binary_version": "9.0.31-1ubuntu0.9+esm3"
              },
              {
                "binary_name": "tomcat9-user",
                "binary_version": "9.0.31-1ubuntu0.9+esm3"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat9",
            "purl": "pkg:deb/ubuntu/tomcat9?arch=source&distro=esm-apps%2Fjammy",
            "ecosystem": "Ubuntu:Pro:22.04:LTS"
          },
          "versions": [
            "9.0.43-3",
            "9.0.54-1",
            "9.0.55-1",
            "9.0.58-1",
            "9.0.58-1ubuntu0.1",
            "9.0.58-1ubuntu0.1+esm1",
            "9.0.58-1ubuntu0.1+esm2",
            "9.0.58-1ubuntu0.1+esm3",
            "9.0.58-1ubuntu0.1+esm4",
            "9.0.58-1ubuntu0.2",
            "9.0.58-1ubuntu0.2+esm1",
            "9.0.58-1ubuntu0.2+esm2",
            "9.0.58-1ubuntu0.2+esm3",
            "9.0.58-1ubuntu0.2+esm4"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libtomcat9-embed-java",
                "binary_version": "9.0.58-1ubuntu0.2+esm4"
              },
              {
                "binary_name": "libtomcat9-java",
                "binary_version": "9.0.58-1ubuntu0.2+esm4"
              },
              {
                "binary_name": "tomcat9",
                "binary_version": "9.0.58-1ubuntu0.2+esm4"
              },
              {
                "binary_name": "tomcat9-admin",
                "binary_version": "9.0.58-1ubuntu0.2+esm4"
              },
              {
                "binary_name": "tomcat9-common",
                "binary_version": "9.0.58-1ubuntu0.2+esm4"
              },
              {
                "binary_name": "tomcat9-docs",
                "binary_version": "9.0.58-1ubuntu0.2+esm4"
              },
              {
                "binary_name": "tomcat9-examples",
                "binary_version": "9.0.58-1ubuntu0.2+esm4"
              },
              {
                "binary_name": "tomcat9-user",
                "binary_version": "9.0.58-1ubuntu0.2+esm4"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat10",
            "purl": "pkg:deb/ubuntu/tomcat10?arch=source&distro=noble",
            "ecosystem": "Ubuntu:24.04:LTS"
          },
          "versions": [
            "10.1.10-1",
            "10.1.14-1",
            "10.1.15-1",
            "10.1.16-1",
            "10.1.16-1ubuntu0.1~esm1",
            "10.1.16-1ubuntu0.1~esm2",
            "10.1.16-1ubuntu0.1~esm3",
            "10.1.16-1ubuntu0.1~esm4",
            "10.1.55-1ubuntu2~24.04.1"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libtomcat10-embed-java",
                "binary_version": "10.1.55-1ubuntu2~24.04.1"
              },
              {
                "binary_name": "libtomcat10-java",
                "binary_version": "10.1.55-1ubuntu2~24.04.1"
              },
              {
                "binary_name": "tomcat10",
                "binary_version": "10.1.55-1ubuntu2~24.04.1"
              },
              {
                "binary_name": "tomcat10-admin",
                "binary_version": "10.1.55-1ubuntu2~24.04.1"
              },
              {
                "binary_name": "tomcat10-common",
                "binary_version": "10.1.55-1ubuntu2~24.04.1"
              },
              {
                "binary_name": "tomcat10-docs",
                "binary_version": "10.1.55-1ubuntu2~24.04.1"
              },
              {
                "binary_name": "tomcat10-examples",
                "binary_version": "10.1.55-1ubuntu2~24.04.1"
              },
              {
                "binary_name": "tomcat10-user",
                "binary_version": "10.1.55-1ubuntu2~24.04.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat9",
            "purl": "pkg:deb/ubuntu/tomcat9?arch=source&distro=noble",
            "ecosystem": "Ubuntu:24.04:LTS"
          },
          "versions": [
            "9.0.70-1ubuntu1",
            "9.0.70-2",
            "9.0.70-2ubuntu0.1",
            "9.0.70-2ubuntu0.1+esm1",
            "9.0.70-2ubuntu0.1+esm2",
            "9.0.70-2ubuntu0.1+esm3",
            "9.0.118-1~24.04.1"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libtomcat9-java",
                "binary_version": "9.0.118-1~24.04.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat10",
            "purl": "pkg:deb/ubuntu/tomcat10?arch=source&distro=stonking",
            "ecosystem": "Ubuntu:26.10"
          },
          "versions": [
            "10.1.40-1ubuntu1",
            "10.1.54-1",
            "10.1.54-1ubuntu1",
            "10.1.54-1ubuntu2",
            "10.1.55-1ubuntu1",
            "10.1.55-1ubuntu2",
            "10.1.57~us1-0ubuntu1"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libtomcat10-embed-java",
                "binary_version": "10.1.57~us1-0ubuntu1"
              },
              {
                "binary_name": "libtomcat10-java",
                "binary_version": "10.1.57~us1-0ubuntu1"
              },
              {
                "binary_name": "tomcat10",
                "binary_version": "10.1.57~us1-0ubuntu1"
              },
              {
                "binary_name": "tomcat10-admin",
                "binary_version": "10.1.57~us1-0ubuntu1"
              },
              {
                "binary_name": "tomcat10-common",
                "binary_version": "10.1.57~us1-0ubuntu1"
              },
              {
                "binary_name": "tomcat10-docs",
                "binary_version": "10.1.57~us1-0ubuntu1"
              },
              {
                "binary_name": "tomcat10-examples",
                "binary_version": "10.1.57~us1-0ubuntu1"
              },
              {
                "binary_name": "tomcat10-user",
                "binary_version": "10.1.57~us1-0ubuntu1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat11",
            "purl": "pkg:deb/ubuntu/tomcat11?arch=source&distro=stonking",
            "ecosystem": "Ubuntu:26.10"
          },
          "versions": [
            "11.0.18-1",
            "11.0.22-2",
            "11.0.22-2ubuntu1",
            "11.0.22-2ubuntu2",
            "11.0.24-1ubuntu1"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libtomcat11-embed-java",
                "binary_version": "11.0.24-1ubuntu1"
              },
              {
                "binary_name": "libtomcat11-java",
                "binary_version": "11.0.24-1ubuntu1"
              },
              {
                "binary_name": "tomcat11",
                "binary_version": "11.0.24-1ubuntu1"
              },
              {
                "binary_name": "tomcat11-admin",
                "binary_version": "11.0.24-1ubuntu1"
              },
              {
                "binary_name": "tomcat11-common",
                "binary_version": "11.0.24-1ubuntu1"
              },
              {
                "binary_name": "tomcat11-docs",
                "binary_version": "11.0.24-1ubuntu1"
              },
              {
                "binary_name": "tomcat11-examples",
                "binary_version": "11.0.24-1ubuntu1"
              },
              {
                "binary_name": "tomcat11-user",
                "binary_version": "11.0.24-1ubuntu1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat9",
            "purl": "pkg:deb/ubuntu/tomcat9?arch=source&distro=stonking",
            "ecosystem": "Ubuntu:26.10"
          },
          "versions": [
            "9.0.115-1",
            "9.0.115-1ubuntu1",
            "9.0.118-1"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libtomcat9-java",
                "binary_version": "9.0.118-1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat10",
            "purl": "pkg:deb/ubuntu/tomcat10?arch=source&distro=resolute",
            "ecosystem": "Ubuntu:26.04:LTS"
          },
          "versions": [
            "10.1.40-1ubuntu1",
            "10.1.40-1ubuntu1.26.04.1",
            "10.1.55-1ubuntu2~26.04.1"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libtomcat10-embed-java",
                "binary_version": "10.1.55-1ubuntu2~26.04.1"
              },
              {
                "binary_name": "libtomcat10-java",
                "binary_version": "10.1.55-1ubuntu2~26.04.1"
              },
              {
                "binary_name": "tomcat10",
                "binary_version": "10.1.55-1ubuntu2~26.04.1"
              },
              {
                "binary_name": "tomcat10-admin",
                "binary_version": "10.1.55-1ubuntu2~26.04.1"
              },
              {
                "binary_name": "tomcat10-common",
                "binary_version": "10.1.55-1ubuntu2~26.04.1"
              },
              {
                "binary_name": "tomcat10-docs",
                "binary_version": "10.1.55-1ubuntu2~26.04.1"
              },
              {
                "binary_name": "tomcat10-examples",
                "binary_version": "10.1.55-1ubuntu2~26.04.1"
              },
              {
                "binary_name": "tomcat10-user",
                "binary_version": "10.1.55-1ubuntu2~26.04.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat9",
            "purl": "pkg:deb/ubuntu/tomcat9?arch=source&distro=resolute",
            "ecosystem": "Ubuntu:26.04:LTS"
          },
          "versions": [
            "9.0.95-1ubuntu1",
            "9.0.111-1",
            "9.0.115-1",
            "9.0.115-1ubuntu0.1",
            "9.0.118-1~26.04.1"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libtomcat9-java",
                "binary_version": "9.0.118-1~26.04.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                }
              ]
            }
          ],
          "package": {
            "name": "tomcat11",
            "purl": "pkg:deb/ubuntu/tomcat11?arch=source&distro=resolute",
            "ecosystem": "Ubuntu:26.04:LTS"
          },
          "versions": [
            "11.0.6-1",
            "11.0.11-1",
            "11.0.15-1",
            "11.0.18-1",
            "11.0.18-1ubuntu0.1~esm1",
            "11.0.22-2ubuntu2~26.04.1"
          ],
          "database_specific": {
            "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-68525.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "binary_name": "libtomcat11-embed-java",
                "binary_version": "11.0.22-2ubuntu2~26.04.1"
              },
              {
                "binary_name": "libtomcat11-java",
                "binary_version": "11.0.22-2ubuntu2~26.04.1"
              },
              {
                "binary_name": "tomcat11",
                "binary_version": "11.0.22-2ubuntu2~26.04.1"
              },
              {
                "binary_name": "tomcat11-admin",
                "binary_version": "11.0.22-2ubuntu2~26.04.1"
              },
              {
                "binary_name": "tomcat11-common",
                "binary_version": "11.0.22-2ubuntu2~26.04.1"
              },
              {
                "binary_name": "tomcat11-docs",
                "binary_version": "11.0.22-2ubuntu2~26.04.1"
              },
              {
                "binary_name": "tomcat11-examples",
                "binary_version": "11.0.22-2ubuntu2~26.04.1"
              },
              {
                "binary_name": "tomcat11-user",
                "binary_version": "11.0.22-2ubuntu2~26.04.1"
              }
            ]
          }
        }
      ],
      "modified": "2026-10-17T13:00:41.885549597Z",
      "provider": "osv",
      "upstream": [
        "CVE-2026-68525"
      ],
      "references": [
        "https://ubuntu.com/security/CVE-2026-68525",
        "https://www.cve.org/CVERecord?id=CVE-2026-68525",
        "https://github.com/apache/tomcat/commit/10d048e16034ddf12055e0cede0da05b15c823b8",
        "https://github.com/apache/tomcat/commit/58123aa468a20e2a079b7e0c68a4009e2475c098",
        "https://github.com/apache/tomcat/commit/32f0c38526b4e655ff0c17cd97afedefc624fe43"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-68525",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 360784,
  "published_at": "2026-08-25T22:17:00+00:00"
}