From da82edf6ec5bbd73789540e3d2859243f6b3fb53 Mon Sep 17 00:00:00 2001 From: art Date: Tue, 22 Sep 2026 11:59:37 +0900 Subject: [PATCH] =?UTF-8?q?docs(security):=20=EC=B5=9C=EC=8B=A0=20?= =?UTF-8?q?=EC=9D=98=EC=A1=B4=EC=84=B1=20=EA=B6=8C=EA=B3=A0=EC=99=80=20NVD?= =?UTF-8?q?=20=EC=8B=A4=EC=8B=9C=EA=B0=84=20=EB=8C=80=EC=A1=B0=20=EA=B2=B0?= =?UTF-8?q?=EA=B3=BC=20=EA=B8=B0=EB=A1=9D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit WAR 43개 JAR의 81개 좌표 조회와 NVD 28 CVE 대조. 실제 악용 조건과 영향 버전을 구분하고 캐시 0건을 출시 근거에서 제외. Co-Authored-By: Codex --- .../artifacts/dependency-list.txt | 80 + .../artifacts/latest-nvd-targeted.json | 4928 ++++++++++++++ .../artifacts/latest-osv-advisories.json | 5661 +++++++++++++++++ .../artifacts/latest-osv-results.json | 624 ++ .../artifacts/nvd-bulk-first-attempt.log | 503 ++ .../artifacts/nvd-bulk-trusted-attempt.log | 99 + .../artifacts/war-inventory.json | 218 + .atp/work-session/20260922-114058/report.md | 29 +- ...026-09-22-current-dependency-advisories.md | 66 + docs/analysis/2026-09-22-release-readiness.md | 2 + docs/analysis/index.md | 2 + docs/security/owasp-dependency-check-guide.md | 4 +- 12 files changed, 12214 insertions(+), 2 deletions(-) create mode 100644 .atp/work-session/20260922-114058/artifacts/dependency-list.txt create mode 100644 .atp/work-session/20260922-114058/artifacts/latest-nvd-targeted.json create mode 100644 .atp/work-session/20260922-114058/artifacts/latest-osv-advisories.json create mode 100644 .atp/work-session/20260922-114058/artifacts/latest-osv-results.json create mode 100644 .atp/work-session/20260922-114058/artifacts/nvd-bulk-first-attempt.log create mode 100644 .atp/work-session/20260922-114058/artifacts/nvd-bulk-trusted-attempt.log create mode 100644 .atp/work-session/20260922-114058/artifacts/war-inventory.json create mode 100644 docs/analysis/2026-09-22-current-dependency-advisories.md diff --git a/.atp/work-session/20260922-114058/artifacts/dependency-list.txt b/.atp/work-session/20260922-114058/artifacts/dependency-list.txt new file mode 100644 index 0000000..119aa3d --- /dev/null +++ b/.atp/work-session/20260922-114058/artifacts/dependency-list.txt @@ -0,0 +1,80 @@ + +The following files have been resolved: + org.springframework.boot:spring-boot-starter-web:jar:3.5.16:compile -- module spring.boot.starter.web [auto] + org.springframework.boot:spring-boot-starter:jar:3.5.16:compile -- module spring.boot.starter [auto] + org.springframework.boot:spring-boot:jar:3.5.16:compile -- module spring.boot [auto] + org.springframework.boot:spring-boot-autoconfigure:jar:3.5.16:compile -- module spring.boot.autoconfigure [auto] + org.springframework.boot:spring-boot-starter-logging:jar:3.5.16:compile -- module spring.boot.starter.logging [auto] + ch.qos.logback:logback-classic:jar:1.5.34:compile -- module ch.qos.logback.classic + ch.qos.logback:logback-core:jar:1.5.34:compile -- module ch.qos.logback.core + org.apache.logging.log4j:log4j-to-slf4j:jar:2.24.3:compile -- module org.apache.logging.log4j.to.slf4j + org.apache.logging.log4j:log4j-api:jar:2.24.3:compile -- module org.apache.logging.log4j + org.slf4j:jul-to-slf4j:jar:2.0.18:compile -- module jul.to.slf4j + org.yaml:snakeyaml:jar:2.4:compile -- module org.yaml.snakeyaml + org.springframework.boot:spring-boot-starter-json:jar:3.5.16:compile -- module spring.boot.starter.json [auto] + com.fasterxml.jackson.core:jackson-databind:jar:2.21.4:compile -- module com.fasterxml.jackson.databind + com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile -- module com.fasterxml.jackson.annotation + com.fasterxml.jackson.core:jackson-core:jar:2.21.4:compile -- module com.fasterxml.jackson.core + com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.21.4:compile -- module com.fasterxml.jackson.datatype.jdk8 + com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.21.4:compile -- module com.fasterxml.jackson.datatype.jsr310 + com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.21.4:compile -- module com.fasterxml.jackson.module.paramnames + org.springframework:spring-web:jar:6.2.19:compile -- module spring.web [auto] + org.springframework:spring-beans:jar:6.2.19:compile -- module spring.beans [auto] + io.micrometer:micrometer-observation:jar:1.15.12:compile -- module micrometer.observation [auto] + io.micrometer:micrometer-commons:jar:1.15.12:compile -- module micrometer.commons [auto] + org.springframework:spring-webmvc:jar:6.2.19:compile -- module spring.webmvc [auto] + org.springframework:spring-aop:jar:6.2.19:compile -- module spring.aop [auto] + org.springframework:spring-context:jar:6.2.19:compile -- module spring.context [auto] + org.springframework:spring-expression:jar:6.2.19:compile -- module spring.expression [auto] + org.mybatis.spring.boot:mybatis-spring-boot-starter:jar:3.0.5:compile -- module org.mybatis.spring.boot.starter [auto] + org.springframework.boot:spring-boot-starter-jdbc:jar:3.5.16:compile -- module spring.boot.starter.jdbc [auto] + com.zaxxer:HikariCP:jar:6.3.3:compile -- module com.zaxxer.hikari + org.springframework:spring-jdbc:jar:6.2.19:compile -- module spring.jdbc [auto] + org.springframework:spring-tx:jar:6.2.19:compile -- module spring.tx [auto] + org.mybatis.spring.boot:mybatis-spring-boot-autoconfigure:jar:3.0.5:compile -- module org.mybatis.spring.boot.autoconfigure [auto] + org.mybatis:mybatis:jar:3.5.19:compile -- module org.mybatis [auto] + org.mybatis:mybatis-spring:jar:3.0.5:compile -- module org.mybatis.spring [auto] + org.postgresql:postgresql:jar:42.7.11:runtime -- module org.postgresql.jdbc [auto] + org.apache.tomcat.embed:tomcat-embed-jasper:jar:10.1.55:compile -- module org.apache.tomcat.embed.jasper + org.apache.tomcat.embed:tomcat-embed-core:jar:10.1.55:compile -- module org.apache.tomcat.embed.core + org.apache.tomcat:tomcat-annotations-api:jar:10.1.55:compile -- module jakarta.annotation + org.apache.tomcat.embed:tomcat-embed-el:jar:10.1.55:compile -- module org.apache.tomcat.embed.el + org.eclipse.jdt:ecj:jar:3.33.0:compile -- module org.eclipse.jdt.core.compiler.batch [auto] + org.projectlombok:lombok:jar:1.18.46:compile (optional) -- module lombok + org.springframework.boot:spring-boot-starter-tomcat:jar:3.5.16:provided -- module spring.boot.starter.tomcat [auto] + jakarta.annotation:jakarta.annotation-api:jar:2.1.1:compile -- module jakarta.annotation + org.apache.tomcat.embed:tomcat-embed-websocket:jar:10.1.55:provided -- module org.apache.tomcat.embed.websocket + org.springframework.boot:spring-boot-starter-test:jar:3.5.16:test -- module spring.boot.starter.test [auto] + org.springframework.boot:spring-boot-test:jar:3.5.16:test -- module spring.boot.test [auto] + org.springframework.boot:spring-boot-test-autoconfigure:jar:3.5.16:test -- module spring.boot.test.autoconfigure [auto] + com.jayway.jsonpath:json-path:jar:2.9.0:test -- module json.path [auto] + org.slf4j:slf4j-api:jar:2.0.18:compile -- module org.slf4j + jakarta.xml.bind:jakarta.xml.bind-api:jar:4.0.5:test -- module jakarta.xml.bind + jakarta.activation:jakarta.activation-api:jar:2.1.4:test -- module jakarta.activation + net.minidev:json-smart:jar:2.5.2:test -- module json.smart (auto) + net.minidev:accessors-smart:jar:2.5.2:test -- module accessors.smart (auto) + org.ow2.asm:asm:jar:9.7.1:test -- module org.objectweb.asm + org.assertj:assertj-core:jar:3.27.7:test -- module org.assertj.core + net.bytebuddy:byte-buddy:jar:1.17.8:test -- module net.bytebuddy + org.awaitility:awaitility:jar:4.2.2:test -- module awaitility (auto) + org.hamcrest:hamcrest:jar:3.0:test -- module org.hamcrest [auto] + org.junit.jupiter:junit-jupiter:jar:5.12.2:test -- module org.junit.jupiter + org.junit.jupiter:junit-jupiter-api:jar:5.12.2:test -- module org.junit.jupiter.api + org.opentest4j:opentest4j:jar:1.3.0:test -- module org.opentest4j + org.junit.platform:junit-platform-commons:jar:1.12.2:test -- module org.junit.platform.commons + org.apiguardian:apiguardian-api:jar:1.1.2:test -- module org.apiguardian.api + org.junit.jupiter:junit-jupiter-params:jar:5.12.2:test -- module org.junit.jupiter.params + org.junit.jupiter:junit-jupiter-engine:jar:5.12.2:test -- module org.junit.jupiter.engine + org.junit.platform:junit-platform-engine:jar:1.12.2:test -- module org.junit.platform.engine + org.mockito:mockito-core:jar:5.17.0:test -- module org.mockito + net.bytebuddy:byte-buddy-agent:jar:1.17.8:test -- module net.bytebuddy.agent + org.objenesis:objenesis:jar:3.3:test -- module org.objenesis [auto] + org.mockito:mockito-junit-jupiter:jar:5.17.0:test -- module org.mockito.junit.jupiter + org.skyscreamer:jsonassert:jar:1.5.3:test -- module jsonassert (auto) + com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:test -- module android.json (auto) + org.springframework:spring-core:jar:6.2.19:compile -- module spring.core [auto] + org.springframework:spring-jcl:jar:6.2.19:compile -- module spring.jcl [auto] + org.springframework:spring-test:jar:6.2.19:test -- module spring.test [auto] + org.xmlunit:xmlunit-core:jar:2.10.4:test -- module org.xmlunit [auto] + org.commonmark:commonmark:jar:0.22.0:compile -- module org.commonmark + org.jsoup:jsoup:jar:1.17.2:compile -- module org.jsoup diff --git a/.atp/work-session/20260922-114058/artifacts/latest-nvd-targeted.json b/.atp/work-session/20260922-114058/artifacts/latest-nvd-targeted.json new file mode 100644 index 0000000..9bfc633 --- /dev/null +++ b/.atp/work-session/20260922-114058/artifacts/latest-nvd-targeted.json @@ -0,0 +1,4928 @@ +{ + "resultsPerPage": 28, + "startIndex": 0, + "totalResults": 28, + "format": "NVD_CVE", + "version": "2.0", + "timestamp": "2026-09-22T02:56:02.312", + "vulnerabilities": [ + { + "cve": { + "id": "CVE-2026-54515", + "sourceIdentifier": "security-advisories@github.com", + "published": "2026-06-23T21:17:02.597", + "lastModified": "2026-06-29T13:38:59.057", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map \u2014 restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4." + } + ], + "affected": [ + { + "source": "security-advisories@github.com", + "affectedData": [ + { + "vendor": "FasterXML", + "product": "jackson-databind", + "versions": [ + { + "version": ">= 2.8.0, < 2.18.9", + "status": "affected" + }, + { + "version": ">= 2.19.0, < 2.21.5", + "status": "affected" + }, + { + "version": ">= 3.1.0, < 3.1.4", + "status": "affected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security-advisories@github.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "baseScore": 5.3, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-06-24T12:21:39.803339Z", + "id": "CVE-2026-54515", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security-advisories@github.com", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-915" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*", + "versionStartIncluding": "2.8.0", + "versionEndExcluding": "2.18.9", + "matchCriteriaId": "A70ABD6F-255D-4445-BED6-B3D2BA9CC33C" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*", + "versionStartIncluding": "2.19.0", + "versionEndExcluding": "2.21.5", + "matchCriteriaId": "23684E89-ED14-4060-AD06-E70E32EC3C4D" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*", + "versionStartIncluding": "3.0.0", + "versionEndExcluding": "3.1.4", + "matchCriteriaId": "5C0F99DE-1DB7-4873-83F9-6CEF8E91F33C" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:fasterxml:jackson-databind:2.22.0:*:*:*:*:*:*:*", + "matchCriteriaId": "E32613B1-1FE9-427D-8D4C-A450874E4D0A" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa", + "source": "security-advisories@github.com", + "tags": [ + "Patch" + ] + }, + { + "url": "https://github.com/FasterXML/jackson-databind/issues/5962", + "source": "security-advisories@github.com", + "tags": [ + "Issue Tracking" + ] + }, + { + "url": "https://github.com/FasterXML/jackson-databind/issues/5964", + "source": "security-advisories@github.com", + "tags": [ + "Issue Tracking", + "Patch" + ] + }, + { + "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v", + "source": "security-advisories@github.com", + "tags": [ + "Third Party Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-50229", + "sourceIdentifier": "security@apache.org", + "published": "2026-06-29T21:16:44.413", + "lastModified": "2026-07-02T19:24:34.983", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.22", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.55", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.0.M1", + "lessThanOrEqual": "9.0.118", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.0", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "7.0.0", + "lessThanOrEqual": "7.0.109", + "versionType": "semver", + "status": "affected" + }, + { + "version": "0", + "lessThan": "7.0.0", + "versionType": "semver", + "status": "unknown" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "baseScore": 6.1, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 2.8, + "impactScore": 2.7 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-06-30T12:49:25.834984Z", + "id": "CVE-2026-50229", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "no" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-80" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionEndIncluding": "7.0.109", + "matchCriteriaId": "FBE1DD9D-848F-4FD6-94B8-3F3188A13239" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "8.5.0", + "versionEndIncluding": "8.5.100", + "matchCriteriaId": "FF43D0D7-FBF3-4D7A-84C4-47B65A75A524" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "9.0.0", + "versionEndExcluding": "9.0.119", + "matchCriteriaId": "EA5B1F1F-8593-47C6-B14E-8F60BE7E1199" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.56", + "matchCriteriaId": "4A8C20B4-DBE1-4890-AD5E-D5EABB6B739D" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.23", + "matchCriteriaId": "C43AD2A0-8785-4A37-AAAE-347B1E0463F1" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/06/29/20", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-53404", + "sourceIdentifier": "security@apache.org", + "published": "2026-06-29T21:16:44.527", + "lastModified": "2026-07-02T19:22:23.483", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.22", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.55", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.0.M1", + "lessThanOrEqual": "9.0.118", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.0", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "0", + "lessThan": "8.0.0", + "versionType": "semver", + "status": "unaffected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseScore": 7.3, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "LOW" + }, + "exploitabilityScore": 3.9, + "impactScore": 3.4 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-06-30T12:30:42.750259Z", + "id": "CVE-2026-53404", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-670" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "8.5.0", + "versionEndIncluding": "8.5.100", + "matchCriteriaId": "FF43D0D7-FBF3-4D7A-84C4-47B65A75A524" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "9.0.0", + "versionEndExcluding": "9.0.119", + "matchCriteriaId": "EA5B1F1F-8593-47C6-B14E-8F60BE7E1199" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.56", + "matchCriteriaId": "4A8C20B4-DBE1-4890-AD5E-D5EABB6B739D" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.23", + "matchCriteriaId": "C43AD2A0-8785-4A37-AAAE-347B1E0463F1" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/06/29/21", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-53434", + "sourceIdentifier": "security@apache.org", + "published": "2026-06-29T21:16:44.937", + "lastModified": "2026-07-02T19:06:09.643", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.22", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M7", + "lessThanOrEqual": "10.1.55", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.83", + "lessThanOrEqual": "9.0.118", + "versionType": "semver", + "status": "affected" + }, + { + "version": "0", + "lessThanOrEqual": "9.0.82", + "versionType": "semver", + "status": "unaffected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.2 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-06-30T12:28:14.286092Z", + "id": "CVE-2026-53434", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-390" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "9.0.83", + "versionEndExcluding": "9.0.119", + "matchCriteriaId": "C19FB4AD-3706-4F58-9E0D-C530561C058C" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.56", + "matchCriteriaId": "4A8C20B4-DBE1-4890-AD5E-D5EABB6B739D" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.23", + "matchCriteriaId": "C43AD2A0-8785-4A37-AAAE-347B1E0463F1" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/06/29/22", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-55276", + "sourceIdentifier": "security@apache.org", + "published": "2026-06-29T21:16:45.380", + "lastModified": "2026-07-02T19:05:18.260", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100.\u00a0Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.22", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.55", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.0.M1", + "lessThanOrEqual": "9.0.118", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.0", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "0", + "lessThan": "8.0.0", + "versionType": "semver", + "status": "unaffected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.2 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-06-30T13:59:26.729885Z", + "id": "CVE-2026-55276", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-670" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionEndExcluding": "9.0.119", + "matchCriteriaId": "5BB3B349-8AB6-4C07-B186-888CAFB1609E" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.56", + "matchCriteriaId": "4A8C20B4-DBE1-4890-AD5E-D5EABB6B739D" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.23", + "matchCriteriaId": "C43AD2A0-8785-4A37-AAAE-347B1E0463F1" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/06/29/23", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-55955", + "sourceIdentifier": "security@apache.org", + "published": "2026-06-29T21:16:45.490", + "lastModified": "2026-07-10T12:22:23.967", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.22", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.55", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.13", + "lessThanOrEqual": "9.0.118", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.38", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "7.0.100", + "lessThanOrEqual": "7.0.109", + "versionType": "semver", + "status": "affected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", + "baseScore": 6.5, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 3.9, + "impactScore": 2.5 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-06-30T13:21:53.082121Z", + "id": "CVE-2026-55955", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "no" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-287" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionEndExcluding": "9.0.119", + "matchCriteriaId": "5BB3B349-8AB6-4C07-B186-888CAFB1609E" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.56", + "matchCriteriaId": "4A8C20B4-DBE1-4890-AD5E-D5EABB6B739D" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.23", + "matchCriteriaId": "C43AD2A0-8785-4A37-AAAE-347B1E0463F1" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106", + "source": "security@apache.org", + "tags": [ + "Mailing List", + "Vendor Advisory" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/06/29/24", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-55956", + "sourceIdentifier": "security@apache.org", + "published": "2026-06-29T21:16:45.597", + "lastModified": "2026-07-02T19:03:30.203", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.22", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.55", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.0.M1", + "lessThanOrEqual": "9.0.118", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.0", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "7.0.0", + "lessThanOrEqual": "7.0.109", + "versionType": "semver", + "status": "affected" + }, + { + "version": "0", + "lessThan": "7.0.0", + "versionType": "semver", + "status": "unknown" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", + "baseScore": 6.5, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 3.9, + "impactScore": 2.5 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-06-30T13:23:02.427983Z", + "id": "CVE-2026-55956", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-285" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionEndExcluding": "9.0.119", + "matchCriteriaId": "5BB3B349-8AB6-4C07-B186-888CAFB1609E" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.56", + "matchCriteriaId": "4A8C20B4-DBE1-4890-AD5E-D5EABB6B739D" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.23", + "matchCriteriaId": "C43AD2A0-8785-4A37-AAAE-347B1E0463F1" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/06/29/25", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-54291", + "sourceIdentifier": "security-advisories@github.com", + "published": "2026-07-06T19:17:08.407", + "lastModified": "2026-07-09T13:16:25.717", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12." + } + ], + "affected": [ + { + "source": "security-advisories@github.com", + "affectedData": [ + { + "vendor": "pgjdbc", + "product": "pgjdbc", + "versions": [ + { + "version": ">= 42.7.4, < 42.7.12", + "status": "affected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV40": [ + { + "source": "security-advisories@github.com", + "type": "Secondary", + "cvssData": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", + "baseScore": 8.2, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "attackRequirements": "PRESENT", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "HIGH", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "LOW", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "confidentialityRequirement": "NOT_DEFINED", + "integrityRequirement": "NOT_DEFINED", + "availabilityRequirement": "NOT_DEFINED", + "modifiedAttackVector": "NOT_DEFINED", + "modifiedAttackComplexity": "NOT_DEFINED", + "modifiedAttackRequirements": "NOT_DEFINED", + "modifiedPrivilegesRequired": "NOT_DEFINED", + "modifiedUserInteraction": "NOT_DEFINED", + "modifiedVulnConfidentialityImpact": "NOT_DEFINED", + "modifiedVulnIntegrityImpact": "NOT_DEFINED", + "modifiedVulnAvailabilityImpact": "NOT_DEFINED", + "modifiedSubConfidentialityImpact": "NOT_DEFINED", + "modifiedSubIntegrityImpact": "NOT_DEFINED", + "modifiedSubAvailabilityImpact": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED" + } + } + ], + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", + "baseScore": 5.9, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 2.2, + "impactScore": 3.6 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-07-06T19:47:12.248185Z", + "id": "CVE-2026-54291", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "no" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security-advisories@github.com", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-636" + }, + { + "lang": "en", + "value": "CWE-757" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*", + "versionStartIncluding": "42.7.4", + "versionEndExcluding": "42.7.12", + "matchCriteriaId": "A4316240-4F4D-4E4B-80A6-E6EACEFFF161" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://github.com/ongres/scram/releases/tag/3.3", + "source": "security-advisories@github.com", + "tags": [ + "Not Applicable" + ] + }, + { + "url": "https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99", + "source": "security-advisories@github.com", + "tags": [ + "Patch" + ] + }, + { + "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867", + "source": "security-advisories@github.com", + "tags": [ + "Patch", + "Vendor Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-49844", + "sourceIdentifier": "security@apache.org", + "published": "2026-07-10T22:16:42.540", + "lastModified": "2026-07-14T20:03:09.910", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.\n\nThe fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.\n\nThe defect is reachable only when both of the following conditions hold:\n\n * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{\"JSON\"}).\n * The application logs a MapMessage that contains an attacker-controlled floating-point value.\n\n\nAn attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.\n\nUsers are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Log4j API", + "defaultStatus": "unaffected", + "collectionURL": "https://repo.maven.apache.org/maven2", + "packageName": "org.apache.logging.log4j:log4j-api", + "cpes": [ + "cpe:2.3:a:apache:log4j_api:*:*:*:*:*:*:*:*" + ], + "packageURL": "pkg:maven/org.apache.logging.log4j/log4j-api", + "versions": [ + { + "version": "2.13.1", + "lessThan": "2.25.5", + "versionType": "maven", + "status": "affected" + }, + { + "version": "2.26.0", + "lessThan": "2.26.1", + "versionType": "maven", + "status": "affected" + }, + { + "version": "3.0.0-alpha1", + "lessThanOrEqual": "3.0.0-beta2", + "versionType": "maven", + "status": "affected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV40": [ + { + "source": "security@apache.org", + "type": "Secondary", + "cvssData": { + "version": "4.0", + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", + "baseScore": 6.3, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "attackRequirements": "PRESENT", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "vulnConfidentialityImpact": "NONE", + "vulnIntegrityImpact": "NONE", + "vulnAvailabilityImpact": "NONE", + "subConfidentialityImpact": "NONE", + "subIntegrityImpact": "LOW", + "subAvailabilityImpact": "NONE", + "exploitMaturity": "NOT_DEFINED", + "confidentialityRequirement": "NOT_DEFINED", + "integrityRequirement": "NOT_DEFINED", + "availabilityRequirement": "NOT_DEFINED", + "modifiedAttackVector": "NOT_DEFINED", + "modifiedAttackComplexity": "NOT_DEFINED", + "modifiedAttackRequirements": "NOT_DEFINED", + "modifiedPrivilegesRequired": "NOT_DEFINED", + "modifiedUserInteraction": "NOT_DEFINED", + "modifiedVulnConfidentialityImpact": "NOT_DEFINED", + "modifiedVulnIntegrityImpact": "NOT_DEFINED", + "modifiedVulnAvailabilityImpact": "NOT_DEFINED", + "modifiedSubConfidentialityImpact": "NOT_DEFINED", + "modifiedSubIntegrityImpact": "NOT_DEFINED", + "modifiedSubAvailabilityImpact": "NOT_DEFINED", + "Safety": "NOT_DEFINED", + "Automatable": "NOT_DEFINED", + "Recovery": "NOT_DEFINED", + "valueDensity": "NOT_DEFINED", + "vulnerabilityResponseEffort": "NOT_DEFINED", + "providerUrgency": "NOT_DEFINED" + } + } + ], + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", + "baseScore": 5.9, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 2.2, + "impactScore": 3.6 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-07-14T13:56:31.652710Z", + "id": "CVE-2026-49844", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "no" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-116" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*", + "versionStartIncluding": "2.13.1", + "versionEndExcluding": "2.25.5", + "matchCriteriaId": "12E4C571-03B3-4E5D-9DC8-6384F942F8F0" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:log4j:2.26.0:*:*:*:*:*:*:*", + "matchCriteriaId": "B90905D1-1381-4057-8AE1-726CF445974A" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*", + "matchCriteriaId": "5EE518C3-2F43-40FF-B754-C340B7003FC7" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*", + "matchCriteriaId": "6D2A01C1-D56C-4198-8ADB-11739F791E2B" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*", + "matchCriteriaId": "D6F8BD61-DD30-4D64-842C-850E5B117036" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*", + "matchCriteriaId": "ED00C38D-27EA-489C-9A2B-3594ACA8A3C5" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*", + "matchCriteriaId": "8794D719-1D90-4378-B48B-698EA40FBFB2" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://github.com/apache/logging-log4j2/pull/4163", + "source": "security@apache.org", + "tags": [ + "Issue Tracking", + "Patch" + ] + }, + { + "url": "https://logging.apache.org/cyclonedx/vdr.xml", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory" + ] + }, + { + "url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message", + "source": "security@apache.org", + "tags": [ + "Product" + ] + }, + { + "url": "https://logging.apache.org/security.html#CVE-2026-49844", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-59083", + "sourceIdentifier": "security@apache.org", + "published": "2026-07-14T09:16:41.483", + "lastModified": "2026-07-14T16:57:31.103", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100.\u00a0Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.23", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.56", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.0.M1", + "lessThanOrEqual": "9.0.119", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.0", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "0", + "lessThan": "8.0.0", + "versionType": "semver", + "status": "unaffected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.2 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-07-14T12:19:49.962916Z", + "id": "CVE-2026-59083", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-177" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionEndIncluding": "8.0.0", + "matchCriteriaId": "6626CE25-E8F0-4F67-ACEB-363F6D2BDEEC" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "8.5.0", + "versionEndIncluding": "8.5.100", + "matchCriteriaId": "FF43D0D7-FBF3-4D7A-84C4-47B65A75A524" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "9.0.0", + "versionEndIncluding": "9.0.119", + "matchCriteriaId": "C8665E8D-D2A4-46FF-A126-75EDE95FCA35" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndIncluding": "10.1.56", + "matchCriteriaId": "1B3DEC2A-7E4A-4851-8466-AFCC4B249748" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndIncluding": "11.0.23", + "matchCriteriaId": "30943912-13A4-40D8-A9E3-9DE3C0008258" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq", + "source": "security@apache.org", + "tags": [ + "Mitigation", + "Vendor Advisory" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/07/14/7", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Mailing List", + "Third Party Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-59084", + "sourceIdentifier": "security@apache.org", + "published": "2026-07-14T09:16:41.607", + "lastModified": "2026-07-14T16:57:03.830", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.\u00a0Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.23", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.56", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.13", + "lessThanOrEqual": "9.0.119", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.38", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "7.0.100", + "lessThanOrEqual": "7.0.109", + "versionType": "semver", + "status": "affected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.2 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-07-14T13:51:48.818351Z", + "id": "CVE-2026-59084", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-1059" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "7.0.100", + "versionEndIncluding": "7.0.109", + "matchCriteriaId": "21FCAD61-9B9D-4780-9EE2-2F28B3F951F5" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "8.5.38", + "versionEndIncluding": "8.5.100", + "matchCriteriaId": "769FDDAB-B636-43A6-BB06-CCE9185D5EA6" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "9.0.13", + "versionEndIncluding": "9.0.119", + "matchCriteriaId": "A332E23F-9A0B-41C6-B00D-8E92BF206791" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndIncluding": "10.1.56", + "matchCriteriaId": "1B3DEC2A-7E4A-4851-8466-AFCC4B249748" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndIncluding": "11.0.23", + "matchCriteriaId": "30943912-13A4-40D8-A9E3-9DE3C0008258" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7", + "source": "security@apache.org", + "tags": [ + "Mitigation", + "Vendor Advisory" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/07/14/8", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Mailing List", + "Third Party Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-59889", + "sourceIdentifier": "security-advisories@github.com", + "published": "2026-07-14T21:17:06.160", + "lastModified": "2026-07-16T16:19:15.790", + "vulnStatus": "Awaiting Analysis", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1." + } + ], + "affected": [ + { + "source": "security-advisories@github.com", + "affectedData": [ + { + "vendor": "FasterXML", + "product": "jackson-databind", + "versions": [ + { + "version": ">= 2.18.0, < 2.18.9", + "status": "affected" + }, + { + "version": ">= 2.21.0, < 2.21.5", + "status": "affected" + }, + { + "version": ">= 2.22.0, < 2.22.1", + "status": "affected" + }, + { + "version": ">= 3.0.0, < 3.1.5", + "status": "affected" + }, + { + "version": ">= 3.2.0, < 3.2.1", + "status": "affected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security-advisories@github.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", + "baseScore": 6.5, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-07-16T14:50:03.943048Z", + "id": "CVE-2026-59889", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "no" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security-advisories@github.com", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-863" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b", + "source": "security-advisories@github.com" + }, + { + "url": "https://github.com/FasterXML/jackson-databind/issues/6060", + "source": "security-advisories@github.com" + }, + { + "url": "https://github.com/FasterXML/jackson-databind/pull/6056", + "source": "security-advisories@github.com" + }, + { + "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh", + "source": "security-advisories@github.com" + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-66299", + "sourceIdentifier": "security@apache.org", + "published": "2026-07-28T15:17:50.210", + "lastModified": "2026-08-27T16:24:41.670", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.\n\nThis issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.\n\nUsers are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M20", + "lessThanOrEqual": "11.0.24", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.24", + "lessThanOrEqual": "10.1.57", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.89", + "lessThanOrEqual": "9.0.120", + "versionType": "semver", + "status": "affected" + }, + { + "version": "0", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "unaffected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", + "baseScore": 5.3, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "LOW" + }, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-07-28T17:39:48.240123Z", + "id": "CVE-2026-66299", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-400" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "9.0.89", + "versionEndExcluding": "9.0.121", + "matchCriteriaId": "4B8784DF-337E-4955-B7B4-B352E17A51D3" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.24", + "versionEndExcluding": "10.1.58", + "matchCriteriaId": "603322DF-B852-4112-A8E7-0447A122A894" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.1", + "versionEndExcluding": "11.0.25", + "matchCriteriaId": "DF30E912-1C80-4AEA-8C14-BB32B416EFEA" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*", + "matchCriteriaId": "77BA6600-0890-4BA1-B447-EC1746BAB4FD" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*", + "matchCriteriaId": "7914D26B-CBD6-4846-9BD3-403708D69319" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*", + "matchCriteriaId": "123C6285-03BE-49FC-B821-8BDB25D02863" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*", + "matchCriteriaId": "8A28C2E2-B7BC-46CE-94E4-AE3EF172AA47" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*", + "matchCriteriaId": "069B0D8E-8223-4C4E-A834-C6235D6C3450" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*", + "matchCriteriaId": "E6282085-5716-4874-B0B0-180ECDEE128F" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:*", + "matchCriteriaId": "899B6FF0-8701-47E7-8EDA-428A6D48786D" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/8owczcc1o8qw1rxmg9gvfk4w2jnh4l5k", + "source": "security@apache.org", + "tags": [ + "Mailing List", + "Vendor Advisory" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/07/28/25", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Mailing List", + "Third Party Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-71497", + "sourceIdentifier": "security-advisories@github.com", + "published": "2026-08-06T22:18:32.043", + "lastModified": "2026-09-10T20:41:33.140", + "vulnStatus": "Awaiting Analysis", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1." + } + ], + "affected": [ + { + "source": "security-advisories@github.com", + "affectedData": [ + { + "vendor": "jhy", + "product": "jsoup", + "versions": [ + { + "version": ">= 1.14.3, < 1.23.1", + "status": "affected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security-advisories@github.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", + "baseScore": 4.7, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 1.6, + "impactScore": 2.7 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-07T14:37:48.066416Z", + "id": "CVE-2026-71497", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "no" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security-advisories@github.com", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-79" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70", + "source": "security-advisories@github.com" + }, + { + "url": "https://github.com/jhy/jsoup/issues/2538", + "source": "security-advisories@github.com" + }, + { + "url": "https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1", + "source": "security-advisories@github.com" + }, + { + "url": "https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8", + "source": "security-advisories@github.com" + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-65182", + "sourceIdentifier": "security@apache.org", + "published": "2026-08-25T22:17:04.900", + "lastModified": "2026-08-27T15:27:26.040", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.24", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.57", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.0.M1", + "lessThanOrEqual": "9.0.120", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.0", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "7.0.0", + "lessThanOrEqual": "7.0.109", + "versionType": "semver", + "status": "affected" + }, + { + "version": "0", + "lessThan": "7.0.0", + "versionType": "semver", + "status": "unknown" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.2 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-26T15:17:14.686440Z", + "id": "CVE-2026-65182", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-284" + }, + { + "lang": "en", + "value": "CWE-863" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "7.0.0", + "versionEndIncluding": "7.0.109", + "matchCriteriaId": "5BE0EC99-5BCD-4F7F-8124-4A1734B7BF6B" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "8.5.0", + "versionEndExcluding": "9.0.121", + "matchCriteriaId": "9F374FF7-8FFF-476A-8F8B-7BD7597FD546" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.58", + "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.25", + "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/08/26/1", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory", + "Mailing List" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-65183", + "sourceIdentifier": "security@apache.org", + "published": "2026-08-25T22:17:05.050", + "lastModified": "2026-08-27T15:26:04.837", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.24", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.57", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.42", + "lessThanOrEqual": "9.0.120", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.0", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "unaffected" + }, + { + "version": "7.0.0", + "lessThanOrEqual": "7.0.109", + "versionType": "semver", + "status": "unaffected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", + "baseScore": 8.1, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + }, + "exploitabilityScore": 2.2, + "impactScore": 5.9 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-26T15:18:45.492907Z", + "id": "CVE-2026-65183", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "no" + }, + { + "technicalImpact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-367" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "9.0.42", + "versionEndExcluding": "9.0.121", + "matchCriteriaId": "B6149730-D005-45B4-85C5-977EE6D6254C" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.58", + "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.25", + "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/748o4st6d5dk6n3l7tgzo5yl68gg05c0", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/08/26/2", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory", + "Mailing List" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-65637", + "sourceIdentifier": "security@apache.org", + "published": "2026-08-25T22:17:05.177", + "lastModified": "2026-08-27T15:19:42.247", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.20", + "lessThanOrEqual": "11.0.24", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.53", + "lessThanOrEqual": "10.1.57", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.115", + "lessThanOrEqual": "9.0.120", + "versionType": "semver", + "status": "affected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "baseScore": 9.8, + "baseSeverity": "CRITICAL", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.9 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-26T15:20:15.521688Z", + "id": "CVE-2026-65637", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-20" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "9.0.115", + "versionEndExcluding": "9.0.121", + "matchCriteriaId": "0267823D-98C8-4283-B198-185275D06486" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.53", + "versionEndExcluding": "10.1.58", + "matchCriteriaId": "85549589-C5B3-4093-ABF2-37528529AE65" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.20", + "versionEndExcluding": "11.0.25", + "matchCriteriaId": "3070A357-ABBD-4CE7-894B-CAB8F8E9F342" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-65905", + "sourceIdentifier": "security@apache.org", + "published": "2026-08-25T22:17:05.303", + "lastModified": "2026-08-27T15:17:49.277", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST \nauthenticated request with a nonceCount on the upper boundary of the \nreplay window then that request is replayable once only while the \nassociated nonceCount remains within the replay window.\n\n\n\n\u00a0\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected:\u00a0from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.24", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.57", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.0.M1", + "lessThanOrEqual": "9.0.120", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.0", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "7.0.30", + "lessThanOrEqual": "7.0.109", + "versionType": "semver", + "status": "affected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "baseScore": 9.8, + "baseSeverity": "CRITICAL", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.9 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-26T15:20:56.087834Z", + "id": "CVE-2026-65905", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-294" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "7.0.30", + "versionEndIncluding": "7.0.109", + "matchCriteriaId": "35BA6F8E-F0FE-45C1-AD04-576025B89780" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "8.5.0", + "versionEndExcluding": "9.0.121", + "matchCriteriaId": "9F374FF7-8FFF-476A-8F8B-7BD7597FD546" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.58", + "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.25", + "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/08/26/4", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory", + "Mailing List" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-65927", + "sourceIdentifier": "security@apache.org", + "published": "2026-08-25T22:17:05.433", + "lastModified": "2026-08-27T15:17:08.267", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.24", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.57", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.0.M1", + "lessThanOrEqual": "9.0.120", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.0", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "7.0.0", + "lessThanOrEqual": "7.0.109", + "versionType": "semver", + "status": "unaffected" + }, + { + "version": "0", + "lessThan": "7.0.0", + "versionType": "semver", + "status": "unaffected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-26T15:21:40.924718Z", + "id": "CVE-2026-65927", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-193" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "8.5.0", + "versionEndExcluding": "9.0.121", + "matchCriteriaId": "9F374FF7-8FFF-476A-8F8B-7BD7597FD546" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.58", + "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.25", + "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/08/26/5", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory", + "Mailing List" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-66422", + "sourceIdentifier": "security@apache.org", + "published": "2026-08-25T22:17:05.560", + "lastModified": "2026-08-27T15:16:11.953", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.24", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.57", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.25", + "lessThanOrEqual": "9.0.120", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.46", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "7.0.97", + "lessThanOrEqual": "7.0.109", + "versionType": "semver", + "status": "affected" + }, + { + "version": "0", + "lessThan": "7.0.97", + "versionType": "semver", + "status": "unaffected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", + "baseScore": 8.1, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + }, + "exploitabilityScore": 2.8, + "impactScore": 5.2 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-26T18:52:06.586786Z", + "id": "CVE-2026-66422", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "no" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-285" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "7.0.97", + "versionEndIncluding": "7.0.109", + "matchCriteriaId": "2B90D4D8-1D4B-44A5-9C99-13C18914F5F4" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "8.5.46", + "versionEndExcluding": "9.0.121", + "matchCriteriaId": "3DD84434-9BE8-40F1-8E6B-CD2BE62A18EB" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.58", + "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.25", + "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/j5plylz1b2vhqvbkqn7k58nygxhcpk73", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/08/26/6", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory", + "Mailing List" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-68525", + "sourceIdentifier": "security@apache.org", + "published": "2026-08-25T22:17:05.700", + "lastModified": "2026-08-27T15:15:02.453", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.24", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.57", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.0.M1", + "lessThanOrEqual": "9.0.120", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.0", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "7.0.0", + "lessThanOrEqual": "7.0.109", + "versionType": "semver", + "status": "affected" + }, + { + "version": "0", + "lessThan": "7.0.0", + "versionType": "semver", + "status": "unknown" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.2 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-26T18:40:39.554877Z", + "id": "CVE-2026-68525", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-863" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "7.0.0", + "versionEndIncluding": "7.0.109", + "matchCriteriaId": "5BE0EC99-5BCD-4F7F-8124-4A1734B7BF6B" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "8.5.0", + "versionEndExcluding": "9.0.121", + "matchCriteriaId": "9F374FF7-8FFF-476A-8F8B-7BD7597FD546" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.58", + "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.25", + "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/08/26/7", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory", + "Mailing List" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-68569", + "sourceIdentifier": "security@apache.org", + "published": "2026-08-25T22:17:05.837", + "lastModified": "2026-09-21T12:17:17.257", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.24", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.57", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.0.M1", + "lessThanOrEqual": "9.0.120", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.0", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "7.0.0", + "lessThanOrEqual": "7.0.109", + "versionType": "semver", + "status": "affected" + }, + { + "version": "0", + "lessThan": "7.0.0", + "versionType": "semver", + "status": "unknown" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", + "baseScore": 8.1, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 2.8, + "impactScore": 5.2 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-26T18:38:39.170628Z", + "id": "CVE-2026-68569", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "no" + }, + { + "technicalImpact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-287" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "7.0.0", + "versionEndIncluding": "7.0.109", + "matchCriteriaId": "5BE0EC99-5BCD-4F7F-8124-4A1734B7BF6B" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "8.5.0", + "versionEndExcluding": "9.0.121", + "matchCriteriaId": "9F374FF7-8FFF-476A-8F8B-7BD7597FD546" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.58", + "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.25", + "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc", + "source": "security@apache.org", + "tags": [ + "Mailing List", + "Vendor Advisory" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/08/26/8", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Mailing List", + "Third Party Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-68763", + "sourceIdentifier": "security@apache.org", + "published": "2026-08-25T22:17:05.970", + "lastModified": "2026-08-27T13:02:31.670", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat\u00a0via an allocation leak in the HTTP/2 backlog tracking when a stream is reset\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.59 through 8.5.100.\u00a0Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.24", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.57", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.39", + "lessThanOrEqual": "9.0.120", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.59", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "0", + "lessThanOrEqual": "7.0.109", + "versionType": "semver", + "status": "unaffected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-26T18:36:23.912058Z", + "id": "CVE-2026-68763", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-400" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "8.5.59", + "versionEndExcluding": "9.0.121", + "matchCriteriaId": "3C36D2B7-A159-4A7A-B0D3-DB0551E60FEB" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.58", + "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.25", + "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/tv51ty39ppv41v04hdtkp9dp7tg02nzl", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/08/26/9", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory", + "Mailing List" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-73180", + "sourceIdentifier": "security@apache.org", + "published": "2026-08-25T22:17:06.107", + "lastModified": "2026-08-27T12:40:56.270", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109.\u00a0Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue." + } + ], + "affected": [ + { + "source": "security@apache.org", + "affectedData": [ + { + "vendor": "Apache Software Foundation", + "product": "Apache Tomcat", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "11.0.0-M1", + "lessThanOrEqual": "11.0.24", + "versionType": "semver", + "status": "affected" + }, + { + "version": "10.1.0-M1", + "lessThanOrEqual": "10.1.57", + "versionType": "semver", + "status": "affected" + }, + { + "version": "9.0.0.M1", + "lessThanOrEqual": "9.0.120", + "versionType": "semver", + "status": "affected" + }, + { + "version": "8.5.0", + "lessThanOrEqual": "8.5.100", + "versionType": "semver", + "status": "affected" + }, + { + "version": "7.0.43", + "lessThanOrEqual": "7.0.109", + "versionType": "semver", + "status": "affected" + }, + { + "version": "0", + "lessThan": "7.0.43", + "versionType": "semver", + "status": "unaffected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", + "baseScore": 6.8, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE" + }, + "exploitabilityScore": 1.6, + "impactScore": 5.2 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-26T18:34:56.514848Z", + "id": "CVE-2026-73180", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "no" + }, + { + "technicalImpact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-613" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "7.0.43", + "versionEndIncluding": "7.0.109", + "matchCriteriaId": "47D7D0FB-020D-4E2E-ACB3-D926993051ED" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "8.5.0", + "versionEndExcluding": "9.0.121", + "matchCriteriaId": "9F374FF7-8FFF-476A-8F8B-7BD7597FD546" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "10.1.0", + "versionEndExcluding": "10.1.58", + "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", + "versionStartIncluding": "11.0.0", + "versionEndExcluding": "11.0.25", + "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/3j15vztszpyqss253mjq5v1kp7s6hooq", + "source": "security@apache.org", + "tags": [ + "Vendor Advisory", + "Mailing List" + ] + }, + { + "url": "http://www.openwall.com/lists/oss-security/2026/08/26/10", + "source": "af854a3a-2127-422b-91ae-364da2661108", + "tags": [ + "Third Party Advisory", + "Mailing List" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-47886", + "sourceIdentifier": "security@vmware.com", + "published": "2026-08-27T06:17:19.053", + "lastModified": "2026-09-10T14:25:17.517", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19\nSpring Framework 6.1.0 - 6.1.28\nSpring Framework 6.0.0 - 6.0.30\nSpring Framework 5.3.0 - 5.3.49\nSpring Framework 5.2.25.RELEASE and earlier" + } + ], + "affected": [ + { + "source": "security@vmware.com", + "affectedData": [ + { + "vendor": "Spring", + "product": "Spring Framework", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "7.0.0", + "lessThanOrEqual": "7.0.8", + "versionType": "custom", + "status": "affected" + }, + { + "version": "6.2.0", + "lessThanOrEqual": "6.2.19", + "versionType": "custom", + "status": "affected" + }, + { + "version": "6.1.0", + "lessThanOrEqual": "6.1.28", + "versionType": "custom", + "status": "affected" + }, + { + "version": "6.0.0", + "lessThanOrEqual": "6.0.30", + "versionType": "custom", + "status": "affected" + }, + { + "version": "5.3.0", + "lessThanOrEqual": "5.3.49", + "versionType": "custom", + "status": "affected" + }, + { + "version": "0", + "lessThanOrEqual": "5.2.25.RELEASE", + "versionType": "custom", + "status": "affected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-27T14:59:39.970725Z", + "id": "CVE-2026-47886", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-400" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionEndExcluding": "5.2.26", + "matchCriteriaId": "30EF6490-8C00-47AA-92FD-20E4B85D2CAE" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "5.3.0", + "versionEndExcluding": "5.3.50", + "matchCriteriaId": "041DE7D7-3D90-4E6F-B086-63D8E0505527" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "6.0.0", + "versionEndExcluding": "6.0.31", + "matchCriteriaId": "BF7734A6-972B-4AA3-B52F-4CC72AD9DAEA" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "6.1.0", + "versionEndExcluding": "6.1.29", + "matchCriteriaId": "6E5F1411-93C7-440E-9489-8AFF4AA60784" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "6.2.0", + "versionEndExcluding": "6.2.20", + "matchCriteriaId": "B93122A2-48F7-4784-AE33-143DB012EC03" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "7.0.0", + "versionEndExcluding": "7.0.8.1", + "matchCriteriaId": "6CB099EC-F3CA-4AB4-AD9F-B3AE73DE5EA5" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://spring.io/security/cve-2026-47886", + "source": "security@vmware.com", + "tags": [ + "Vendor Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-59282", + "sourceIdentifier": "security@vmware.com", + "published": "2026-08-27T20:17:54.370", + "lastModified": "2026-09-02T17:02:04.760", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19\nSpring Framework 6.1.0 - 6.1.28\nSpring Framework 6.0.0 - 6.0.30\nSpring Framework 5.3.0 - 5.3.49\nSpring Framework 5.2.25.RELEASE and earlier" + } + ], + "affected": [ + { + "source": "security@vmware.com", + "affectedData": [ + { + "vendor": "Spring", + "product": "Spring Framework", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "7.0.0", + "lessThanOrEqual": "7.0.8", + "versionType": "custom", + "status": "affected" + }, + { + "version": "6.2.0", + "lessThanOrEqual": "6.2.19", + "versionType": "custom", + "status": "affected" + }, + { + "version": "6.1.0", + "lessThanOrEqual": "6.1.28", + "versionType": "custom", + "status": "affected" + }, + { + "version": "6.0.0", + "lessThanOrEqual": "6.0.30", + "versionType": "custom", + "status": "affected" + }, + { + "version": "5.3.0", + "lessThanOrEqual": "5.3.49", + "versionType": "custom", + "status": "affected" + }, + { + "version": "0", + "lessThanOrEqual": "5.2.25.RELEASE", + "versionType": "custom", + "status": "affected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-28T18:30:35.298446Z", + "id": "CVE-2026-59282", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "partial" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-400" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionEndExcluding": "5.2.26", + "matchCriteriaId": "30EF6490-8C00-47AA-92FD-20E4B85D2CAE" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "5.3.0", + "versionEndExcluding": "5.3.50", + "matchCriteriaId": "041DE7D7-3D90-4E6F-B086-63D8E0505527" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "6.0.0", + "versionEndExcluding": "6.0.31", + "matchCriteriaId": "BF7734A6-972B-4AA3-B52F-4CC72AD9DAEA" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "6.1.0", + "versionEndExcluding": "6.1.29", + "matchCriteriaId": "6E5F1411-93C7-440E-9489-8AFF4AA60784" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "6.2.0", + "versionEndExcluding": "6.2.20", + "matchCriteriaId": "B93122A2-48F7-4784-AE33-143DB012EC03" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "7.0.0", + "versionEndExcluding": "7.0.8.1", + "matchCriteriaId": "6CB099EC-F3CA-4AB4-AD9F-B3AE73DE5EA5" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://spring.io/security/cve-2026-59282", + "source": "security@vmware.com", + "tags": [ + "Vendor Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-59283", + "sourceIdentifier": "security@vmware.com", + "published": "2026-08-27T20:17:54.470", + "lastModified": "2026-09-01T13:57:20.427", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19\nSpring Framework 6.1.0 - 6.1.28\nSpring Framework 6.0.0 - 6.0.30\nSpring Framework 5.3.0 - 5.3.49\nSpring Framework 5.2.25.RELEASE and earlier" + } + ], + "affected": [ + { + "source": "security@vmware.com", + "affectedData": [ + { + "vendor": "Spring", + "product": "Spring Framework", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "7.0.0", + "lessThanOrEqual": "7.0.8", + "versionType": "custom", + "status": "affected" + }, + { + "version": "6.2.0", + "lessThanOrEqual": "6.2.19", + "versionType": "custom", + "status": "affected" + }, + { + "version": "6.1.0", + "lessThanOrEqual": "6.1.28", + "versionType": "custom", + "status": "affected" + }, + { + "version": "6.0.0", + "lessThanOrEqual": "6.0.30", + "versionType": "custom", + "status": "affected" + }, + { + "version": "5.3.0", + "lessThanOrEqual": "5.3.49", + "versionType": "custom", + "status": "affected" + }, + { + "version": "0", + "lessThanOrEqual": "5.2.25.RELEASE", + "versionType": "custom", + "status": "affected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.2 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-28T18:40:32.707977Z", + "id": "CVE-2026-59283", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-913" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionEndExcluding": "5.2.26", + "matchCriteriaId": "30EF6490-8C00-47AA-92FD-20E4B85D2CAE" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "5.3.0", + "versionEndExcluding": "5.3.50", + "matchCriteriaId": "041DE7D7-3D90-4E6F-B086-63D8E0505527" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "6.0.0", + "versionEndExcluding": "6.0.31", + "matchCriteriaId": "BF7734A6-972B-4AA3-B52F-4CC72AD9DAEA" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "6.1.0", + "versionEndExcluding": "6.1.29", + "matchCriteriaId": "6E5F1411-93C7-440E-9489-8AFF4AA60784" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "6.2.0", + "versionEndExcluding": "6.2.20", + "matchCriteriaId": "B93122A2-48F7-4784-AE33-143DB012EC03" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "7.0.0", + "versionEndExcluding": "7.0.8.1", + "matchCriteriaId": "6CB099EC-F3CA-4AB4-AD9F-B3AE73DE5EA5" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://spring.io/security/cve-2026-59283", + "source": "security@vmware.com", + "tags": [ + "Vendor Advisory" + ] + } + ] + } + }, + { + "cve": { + "id": "CVE-2026-59313", + "sourceIdentifier": "security@vmware.com", + "published": "2026-08-27T20:17:57.343", + "lastModified": "2026-08-31T18:04:07.453", + "vulnStatus": "Analyzed", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE).\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19\nSpring Framework 6.1.0 - 6.1.28\nSpring Framework 6.0.0 - 6.0.30\nSpring Framework 5.3.0 - 5.3.49" + } + ], + "affected": [ + { + "source": "security@vmware.com", + "affectedData": [ + { + "vendor": "Spring", + "product": "Spring Framework", + "defaultStatus": "unaffected", + "versions": [ + { + "version": "7.0.0", + "lessThanOrEqual": "7.0.8", + "versionType": "custom", + "status": "affected" + }, + { + "version": "6.2.0", + "lessThanOrEqual": "6.2.19", + "versionType": "custom", + "status": "affected" + }, + { + "version": "6.1.0", + "lessThanOrEqual": "6.1.28", + "versionType": "custom", + "status": "affected" + }, + { + "version": "6.0.0", + "lessThanOrEqual": "6.0.30", + "versionType": "custom", + "status": "affected" + }, + { + "version": "5.3.0", + "lessThanOrEqual": "5.3.49", + "versionType": "custom", + "status": "affected" + } + ] + } + ] + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "baseScore": 9.8, + "baseSeverity": "CRITICAL", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.9 + } + ], + "ssvcV203": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "ssvcData": { + "timestamp": "2026-08-28T19:58:16.605774Z", + "id": "CVE-2026-59313", + "options": [ + { + "exploitation": "none" + }, + { + "automatable": "yes" + }, + { + "technicalImpact": "total" + } + ], + "role": "CISA Coordinator", + "version": "2.0.3" + } + } + ] + }, + "weaknesses": [ + { + "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-93" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "5.3.0", + "versionEndIncluding": "5.3.49", + "matchCriteriaId": "07A1F231-2A12-40D9-BA00-8FD78EA2687A" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "6.0.0", + "versionEndIncluding": "6.0.30", + "matchCriteriaId": "49FF6A55-CC96-40FF-956F-6714CE1FA506" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "6.1.0", + "versionEndIncluding": "6.1.28", + "matchCriteriaId": "A3EB7E93-6F61-470D-9394-DD4B693802A6" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "6.2.0", + "versionEndIncluding": "6.2.19", + "matchCriteriaId": "918B9B37-BB57-4A69-8615-E97EF862309A" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", + "versionStartIncluding": "7.0.0", + "versionEndIncluding": "7.0.8", + "matchCriteriaId": "784D50C8-34A2-4C76-91BD-095108C7F58E" + } + ] + } + ] + } + ], + "references": [ + { + "url": "https://spring.io/security/cve-2026-59313", + "source": "security@vmware.com", + "tags": [ + "Vendor Advisory" + ] + } + ] + } + } + ] +} \ No newline at end of file diff --git a/.atp/work-session/20260922-114058/artifacts/latest-osv-advisories.json b/.atp/work-session/20260922-114058/artifacts/latest-osv-advisories.json new file mode 100644 index 0000000..6e2dac7 --- /dev/null +++ b/.atp/work-session/20260922-114058/artifacts/latest-osv-advisories.json @@ -0,0 +1,5661 @@ +[ + { + "id": "GHSA-5gvw-p9qm-jgwh", + "summary": "jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization", + "details": "## Summary\n`UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by iterating its properties and calling `prop.deserializeAndSet()` with **no `prop.visibleInView(ctxt.getActiveView())` guard** \u2014 the exact guard `processUnwrappedCreatorProperties()` received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guard `BeanDeserializer.deserializeWithUnwrapped` applies to directly-matched properties. As a result, a property annotated with both `@JsonView(PrivilegedView.class)` and `@JsonUnwrapped` is written from attacker JSON even when deserializing under a more-restrictive active view.\n\n**Correction to the original framing (runtime-verified):** the gap is NOT a per-field inner `@JsonView` (the unwrapped sub-object's own `BeanDeserializer` gates inner fields correctly). The unchecked gate is the **view of the unwrapped CONTAINER property**.\n\n## Intent proof (runtime, 2.x HEAD 21dd70dd and 3.x HEAD 7a5939d6)\nAn `@JsonView(AdminView)` property that is NOT `@JsonUnwrapped` \u2192 `null` under `PublicView` (correctly gated). The identical property WITH `@JsonUnwrapped` \u2192 fully populated (bypass). The fix the creator path already received, not applied to the regular-property method.\n\n## Impact \u2014 write-side mass-assignment / privilege escalation\n`@JsonView` is commonly used as a write-side authorization guard: a public endpoint binds the body under `readerWithView(PublicView.class)` and groups privileged state in a nested object whose container property is `@JsonView(AdminView)`. When that property is `@JsonUnwrapped`, an untrusted caller mass-assigns it. PoC: a self-service registration where `AccountFlags{role,approved,creditBalance}` is `@JsonView(AdminView) @JsonUnwrapped`; attacker JSON `{role:ADMIN,approved:true,creditBalance:1000000}` under `PublicView` binds all three \u2192 approved admin with arbitrary balance. The failing gate is a WRITE gate, hence integrity-high (`C:N/I:H/A:N`); no worse than the C:L/I:L parent and arguably higher as `@JsonView`-as-write-guard is the exact use case #5971/#5969 defended.\n\n## Affected\n- `com.fasterxml.jackson.core:jackson-databind` 2.x: confirmed bypass at 21dd70dd (== released 2.21.4 / 2.22.0 line; includes the #5973 backport). `DEFAULT_VIEW_INCLUSION` default=true.\n- `tools.jackson.core:jackson-databind` 3.x: confirmed bypass at HEAD 7a5939d6 (latest 3.x). `DEFAULT_VIEW_INCLUSION` default=false \u2192 the stock-config repro is the common shape where privileged inner fields are individually `@JsonView(PublicView)` and the developer relies on the container `@JsonView(AdminView)`; the 3.x PoC mass-assigns role/approved/creditBalance under PublicView. (The other simultaneous report's PoC was reportedly fixed on 3.x; this distinct container-property path is not.)\n\n## Additive variants (runtime-confirmed both branches; all closed by the same one-line guard)\n- nested `@JsonUnwrapped` (unwrapped-in-unwrapped) \u2014 recursive bypass.\n- merge / `readerWithView(...).withValueToUpdate(...)` (PATCH/partial-update) \u2014 bypass; non-unwrapped merge control gates correctly.\n- builder-based deserializer (`@JsonDeserialize(builder=...)`) \u2014 `BuilderBasedDeserializer` routes through the same `processUnwrapped`.\n- Honest non-findings: read-side serialization correctly honors views (no leak); `@JsonAnySetter`+view and `@JsonTypeInfo`+`@JsonUnwrapped` are separate/unsupported behaviors, not this bug.\n\n## Fix\nAdd `prop.visibleInView(ctxt.getActiveView())` (when `MapperFeature.DEFAULT_VIEW_INCLUSION`/active-view applies) to the `processUnwrapped()` property loop, mirroring `processUnwrappedCreatorProperties()`. One change closes the impact PoC + all three variants across `BeanDeserializer` and `BuilderBasedDeserializer`. Full runnable PoCs (2.x + 3.x) + variant harnesses available on request.", + "aliases": [ + "CVE-2026-59889" + ], + "modified": "2026-09-10T03:51:10.658074231Z", + "published": "2026-07-21T22:00:43Z", + "database_specific": { + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-07-21T22:00:43Z", + "nvd_published_at": "2026-07-14T21:17:06Z", + "cwe_ids": [ + "CWE-863" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59889" + }, + { + "type": "WEB", + "url": "https://github.com/FasterXML/jackson-databind/issues/6060" + }, + { + "type": "WEB", + "url": "https://github.com/FasterXML/jackson-databind/pull/6056" + }, + { + "type": "WEB", + "url": "https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/FasterXML/jackson-databind" + } + ], + "affected": [ + { + "package": { + "name": "com.fasterxml.jackson.core:jackson-databind", + "ecosystem": "Maven", + "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.21.0" + }, + { + "fixed": "2.21.5" + } + ] + } + ], + "versions": [ + "2.21.0", + "2.21.1", + "2.21.2", + "2.21.3", + "2.21.4" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json" + } + }, + { + "package": { + "name": "tools.jackson.core:jackson-databind", + "ecosystem": "Maven", + "purl": "pkg:maven/tools.jackson.core/jackson-databind" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.1.5" + } + ] + } + ], + "versions": [ + "3.0.0", + "3.0.1", + "3.0.2", + "3.0.3", + "3.0.4", + "3.1.0", + "3.1.0-rc1", + "3.1.1", + "3.1.2", + "3.1.3", + "3.1.4" + ], + "database_specific": { + "last_known_affected_version_range": "<= 3.1.4", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json" + } + }, + { + "package": { + "name": "com.fasterxml.jackson.core:jackson-databind", + "ecosystem": "Maven", + "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.18.0" + }, + { + "fixed": "2.18.9" + } + ] + } + ], + "versions": [ + "2.18.0", + "2.18.1", + "2.18.2", + "2.18.3", + "2.18.4", + "2.18.5", + "2.18.6", + "2.18.7", + "2.18.8" + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.18.8", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json" + } + }, + { + "package": { + "name": "com.fasterxml.jackson.core:jackson-databind", + "ecosystem": "Maven", + "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.22.0" + }, + { + "fixed": "2.22.1" + } + ] + } + ], + "versions": [ + "2.22.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json" + } + }, + { + "package": { + "name": "tools.jackson.core:jackson-databind", + "ecosystem": "Maven", + "purl": "pkg:maven/tools.jackson.core/jackson-databind" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2.0" + }, + { + "fixed": "3.2.1" + } + ] + } + ], + "versions": [ + "3.2.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json" + } + } + ], + "schema_version": "1.9.0", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ] + }, + { + "id": "GHSA-5jmj-h7xm-6q6v", + "summary": "jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties", + "details": "## Summary\nIn `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a `contextual` deserializer whose `BeanPropertyMap` has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by `@JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)`) rebuilds from `this._beanProperties` (the original, unfiltered map) instead of `contextual._beanProperties`, then overwrites the filtered map \u2014 restoring every property `_handleByNameInclusion` had just removed. The ignored property becomes writable again.\n\n## Impact\nAn application that both enables case-insensitive matching and relies on per-property `@JsonIgnoreProperties` to keep a field unwritable can have that field set from untrusted JSON (mass-assignment-style write).\n\n## Affected / Patched\nWill be fixed in 2.18.9, 2.21.5, 2.22.1 and 3.1.4.\n\n## Severity / CWE\nMaintainer: minor. Reporter: Moderate. CWE-915.\n\n## Upstream fix\nFasterXML/jackson-databind#5962 (PR #5964, `0e1b0b2`), milestone 3.1.4. Released 2026-06-04.", + "aliases": [ + "CVE-2026-54515" + ], + "modified": "2026-09-10T03:51:08.069993966Z", + "published": "2026-06-23T21:23:58Z", + "database_specific": { + "cwe_ids": [ + "CWE-915" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-06-23T21:23:58Z", + "nvd_published_at": "2026-06-23T21:17:02Z" + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515" + }, + { + "type": "WEB", + "url": "https://github.com/FasterXML/jackson-databind/issues/5962" + }, + { + "type": "WEB", + "url": "https://github.com/FasterXML/jackson-databind/issues/5964" + }, + { + "type": "WEB", + "url": "https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa" + }, + { + "type": "PACKAGE", + "url": "https://github.com/FasterXML/jackson-databind" + } + ], + "affected": [ + { + "package": { + "name": "com.fasterxml.jackson.core:jackson-databind", + "ecosystem": "Maven", + "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1.0" + }, + { + "fixed": "3.1.4" + } + ] + } + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" + } + }, + { + "package": { + "name": "tools.jackson.core:jackson-databind", + "ecosystem": "Maven", + "purl": "pkg:maven/tools.jackson.core/jackson-databind" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1.0" + }, + { + "fixed": "3.1.4" + } + ] + } + ], + "versions": [ + "3.1.0", + "3.1.1", + "3.1.2", + "3.1.3" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" + } + }, + { + "package": { + "name": "com.fasterxml.jackson.core:jackson-databind", + "ecosystem": "Maven", + "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.8.0" + }, + { + "fixed": "2.18.9" + } + ] + } + ], + "versions": [ + "2.10.0", + "2.10.0.pr1", + "2.10.0.pr2", + "2.10.0.pr3", + "2.10.1", + "2.10.2", + "2.10.3", + "2.10.4", + "2.10.5", + "2.10.5.1", + "2.11.0", + "2.11.0.rc1", + "2.11.1", + "2.11.2", + "2.11.3", + "2.11.4", + "2.12.0", + "2.12.0-rc1", + "2.12.0-rc2", + "2.12.1", + "2.12.2", + "2.12.3", + "2.12.4", + "2.12.5", + "2.12.6", + "2.12.6.1", + "2.12.7", + "2.12.7.1", + "2.12.7.2", + "2.13.0", + "2.13.0-rc1", + "2.13.0-rc2", + "2.13.1", + "2.13.2", + "2.13.2.1", + "2.13.2.2", + "2.13.3", + "2.13.4", + "2.13.4.1", + "2.13.4.2", + "2.13.5", + "2.14.0", + "2.14.0-rc1", + "2.14.0-rc2", + "2.14.0-rc3", + "2.14.1", + "2.14.2", + "2.14.3", + "2.15.0", + "2.15.0-rc1", + "2.15.0-rc2", + "2.15.0-rc3", + "2.15.1", + "2.15.2", + "2.15.3", + "2.15.4", + "2.16.0", + "2.16.0-rc1", + "2.16.1", + "2.16.2", + "2.17.0", + "2.17.0-rc1", + "2.17.1", + "2.17.2", + "2.17.3", + "2.18.0", + "2.18.0-rc1", + "2.18.1", + "2.18.2", + "2.18.3", + "2.18.4", + "2.18.5", + "2.18.6", + "2.18.7", + "2.18.8", + "2.8.0", + "2.8.1", + "2.8.10", + "2.8.11", + "2.8.11.1", + "2.8.11.2", + "2.8.11.3", + "2.8.11.4", + "2.8.11.5", + "2.8.11.6", + "2.8.2", + "2.8.3", + "2.8.4", + "2.8.5", + "2.8.6", + "2.8.7", + "2.8.8", + "2.8.8.1", + "2.8.9", + "2.9.0", + "2.9.0.pr1", + "2.9.0.pr2", + "2.9.0.pr3", + "2.9.0.pr4", + "2.9.1", + "2.9.10", + "2.9.10.1", + "2.9.10.2", + "2.9.10.3", + "2.9.10.4", + "2.9.10.5", + "2.9.10.6", + "2.9.10.7", + "2.9.10.8", + "2.9.2", + "2.9.3", + "2.9.4", + "2.9.5", + "2.9.6", + "2.9.7", + "2.9.8", + "2.9.9", + "2.9.9.1", + "2.9.9.2", + "2.9.9.3" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" + } + }, + { + "package": { + "name": "com.fasterxml.jackson.core:jackson-databind", + "ecosystem": "Maven", + "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.19.0" + }, + { + "fixed": "2.21.5" + } + ] + } + ], + "versions": [ + "2.19.0", + "2.19.1", + "2.19.2", + "2.19.3", + "2.19.4", + "2.20.0", + "2.20.0-rc1", + "2.20.1", + "2.20.2", + "2.21.0", + "2.21.1", + "2.21.2", + "2.21.3", + "2.21.4" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" + } + }, + { + "package": { + "name": "com.fasterxml.jackson.core:jackson-databind", + "ecosystem": "Maven", + "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.22.0" + }, + { + "fixed": "2.22.1" + } + ] + } + ], + "versions": [ + "2.22.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json" + } + } + ], + "schema_version": "1.9.0", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ] + }, + { + "id": "GHSA-9xv2-5v5q-p794", + "summary": "Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability", + "details": "Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\nThe following versions were EOL at the time the CVE was created but are known to be affected:\u00a0from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.", + "aliases": [ + "BIT-tomcat-2026-65905", + "CVE-2026-65905" + ], + "modified": "2026-09-11T08:25:52.825871989Z", + "published": "2026-08-26T00:30:52Z", + "database_specific": { + "cwe_ids": [ + "CWE-294" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-09-02T22:38:14Z", + "nvd_published_at": "2026-08-25T22:17:05Z" + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65905" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/tomcat" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/08/26/4" + } + ], + "affected": [ + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M1" + }, + { + "fixed": "11.0.25" + } + ] + } + ], + "versions": [ + "11.0.0", + "11.0.0-M1", + "11.0.0-M10", + "11.0.0-M11", + "11.0.0-M12", + "11.0.0-M13", + "11.0.0-M14", + "11.0.0-M15", + "11.0.0-M16", + "11.0.0-M17", + "11.0.0-M18", + "11.0.0-M19", + "11.0.0-M20", + "11.0.0-M21", + "11.0.0-M22", + "11.0.0-M24", + "11.0.0-M25", + "11.0.0-M26", + "11.0.0-M3", + "11.0.0-M4", + "11.0.0-M5", + "11.0.0-M6", + "11.0.0-M7", + "11.0.0-M9", + "11.0.1", + "11.0.10", + "11.0.11", + "11.0.12", + "11.0.13", + "11.0.14", + "11.0.15", + "11.0.18", + "11.0.2", + "11.0.20", + "11.0.21", + "11.0.22", + "11.0.23", + "11.0.24", + "11.0.3", + "11.0.4", + "11.0.5", + "11.0.6", + "11.0.7", + "11.0.8", + "11.0.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.0-M1" + }, + { + "fixed": "10.1.58" + } + ] + } + ], + "versions": [ + "10.1.0", + "10.1.0-M1", + "10.1.0-M10", + "10.1.0-M11", + "10.1.0-M12", + "10.1.0-M14", + "10.1.0-M15", + "10.1.0-M16", + "10.1.0-M17", + "10.1.0-M2", + "10.1.0-M4", + "10.1.0-M5", + "10.1.0-M6", + "10.1.0-M7", + "10.1.0-M8", + "10.1.1", + "10.1.10", + "10.1.11", + "10.1.12", + "10.1.13", + "10.1.14", + "10.1.15", + "10.1.16", + "10.1.17", + "10.1.18", + "10.1.19", + "10.1.2", + "10.1.20", + "10.1.23", + "10.1.24", + "10.1.25", + "10.1.26", + "10.1.28", + "10.1.29", + "10.1.30", + "10.1.31", + "10.1.33", + "10.1.34", + "10.1.35", + "10.1.36", + "10.1.39", + "10.1.4", + "10.1.40", + "10.1.41", + "10.1.42", + "10.1.43", + "10.1.44", + "10.1.45", + "10.1.46", + "10.1.47", + "10.1.48", + "10.1.49", + "10.1.5", + "10.1.50", + "10.1.52", + "10.1.53", + "10.1.54", + "10.1.55", + "10.1.56", + "10.1.57", + "10.1.6", + "10.1.7", + "10.1.8", + "10.1.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0.M1" + }, + { + "fixed": "9.0.121" + } + ] + } + ], + "versions": [ + "9.0.0.M1", + "9.0.0.M10", + "9.0.0.M11", + "9.0.0.M13", + "9.0.0.M15", + "9.0.0.M17", + "9.0.0.M18", + "9.0.0.M19", + "9.0.0.M20", + "9.0.0.M21", + "9.0.0.M22", + "9.0.0.M25", + "9.0.0.M26", + "9.0.0.M27", + "9.0.0.M3", + "9.0.0.M4", + "9.0.0.M6", + "9.0.0.M8", + "9.0.0.M9", + "9.0.1", + "9.0.10", + "9.0.100", + "9.0.102", + "9.0.104", + "9.0.105", + "9.0.106", + "9.0.107", + "9.0.108", + "9.0.109", + "9.0.11", + "9.0.110", + "9.0.111", + "9.0.112", + "9.0.113", + "9.0.115", + "9.0.116", + "9.0.117", + "9.0.118", + "9.0.119", + "9.0.12", + "9.0.120", + "9.0.13", + "9.0.14", + "9.0.16", + "9.0.17", + "9.0.19", + "9.0.2", + "9.0.20", + "9.0.21", + "9.0.22", + "9.0.24", + "9.0.26", + "9.0.27", + "9.0.29", + "9.0.30", + "9.0.31", + "9.0.33", + "9.0.34", + "9.0.35", + "9.0.36", + "9.0.37", + "9.0.38", + "9.0.39", + "9.0.4", + "9.0.40", + "9.0.41", + "9.0.43", + "9.0.44", + "9.0.45", + "9.0.46", + "9.0.48", + "9.0.5", + "9.0.50", + "9.0.52", + "9.0.53", + "9.0.54", + "9.0.55", + "9.0.56", + "9.0.58", + "9.0.59", + "9.0.6", + "9.0.60", + "9.0.62", + "9.0.63", + "9.0.64", + "9.0.65", + "9.0.67", + "9.0.68", + "9.0.69", + "9.0.7", + "9.0.70", + "9.0.71", + "9.0.72", + "9.0.73", + "9.0.74", + "9.0.75", + "9.0.76", + "9.0.78", + "9.0.79", + "9.0.8", + "9.0.80", + "9.0.81", + "9.0.82", + "9.0.83", + "9.0.84", + "9.0.85", + "9.0.86", + "9.0.87", + "9.0.88", + "9.0.89", + "9.0.90", + "9.0.91", + "9.0.93", + "9.0.94", + "9.0.95", + "9.0.96", + "9.0.97", + "9.0.98", + "9.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5.0" + }, + { + "last_affected": "8.5.100" + } + ] + } + ], + "versions": [ + "8.5.0", + "8.5.100", + "8.5.11", + "8.5.12", + "8.5.13", + "8.5.14", + "8.5.15", + "8.5.16", + "8.5.19", + "8.5.2", + "8.5.20", + "8.5.21", + "8.5.23", + "8.5.24", + "8.5.27", + "8.5.28", + "8.5.29", + "8.5.3", + "8.5.30", + "8.5.31", + "8.5.32", + "8.5.33", + "8.5.34", + "8.5.35", + "8.5.37", + "8.5.38", + "8.5.39", + "8.5.4", + "8.5.40", + "8.5.41", + "8.5.42", + "8.5.43", + "8.5.45", + "8.5.46", + "8.5.47", + "8.5.49", + "8.5.5", + "8.5.50", + "8.5.51", + "8.5.53", + "8.5.54", + "8.5.55", + "8.5.56", + "8.5.57", + "8.5.58", + "8.5.59", + "8.5.6", + "8.5.60", + "8.5.61", + "8.5.63", + "8.5.64", + "8.5.65", + "8.5.66", + "8.5.68", + "8.5.69", + "8.5.70", + "8.5.71", + "8.5.72", + "8.5.73", + "8.5.75", + "8.5.76", + "8.5.77", + "8.5.78", + "8.5.79", + "8.5.8", + "8.5.81", + "8.5.82", + "8.5.83", + "8.5.84", + "8.5.85", + "8.5.86", + "8.5.87", + "8.5.88", + "8.5.89", + "8.5.9", + "8.5.90", + "8.5.91", + "8.5.92", + "8.5.93", + "8.5.94", + "8.5.95", + "8.5.96", + "8.5.97", + "8.5.98", + "8.5.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.30" + }, + { + "last_affected": "7.0.109" + } + ] + } + ], + "versions": [ + "7.0.100", + "7.0.103", + "7.0.104", + "7.0.105", + "7.0.106", + "7.0.107", + "7.0.108", + "7.0.109", + "7.0.35", + "7.0.37", + "7.0.39", + "7.0.40", + "7.0.41", + "7.0.42", + "7.0.47", + "7.0.50", + "7.0.52", + "7.0.53", + "7.0.54", + "7.0.55", + "7.0.56", + "7.0.57", + "7.0.59", + "7.0.61", + "7.0.62", + "7.0.63", + "7.0.64", + "7.0.65", + "7.0.67", + "7.0.68", + "7.0.69", + "7.0.70", + "7.0.72", + "7.0.73", + "7.0.75", + "7.0.76", + "7.0.77", + "7.0.78", + "7.0.79", + "7.0.81", + "7.0.82", + "7.0.84", + "7.0.85", + "7.0.86", + "7.0.88", + "7.0.90", + "7.0.91", + "7.0.92", + "7.0.93", + "7.0.94", + "7.0.96", + "7.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M1" + }, + { + "fixed": "11.0.25" + } + ] + } + ], + "versions": [ + "11.0.0", + "11.0.0-M1", + "11.0.0-M10", + "11.0.0-M11", + "11.0.0-M12", + "11.0.0-M13", + "11.0.0-M14", + "11.0.0-M15", + "11.0.0-M16", + "11.0.0-M17", + "11.0.0-M18", + "11.0.0-M19", + "11.0.0-M20", + "11.0.0-M21", + "11.0.0-M22", + "11.0.0-M24", + "11.0.0-M25", + "11.0.0-M26", + "11.0.0-M3", + "11.0.0-M4", + "11.0.0-M5", + "11.0.0-M6", + "11.0.0-M7", + "11.0.0-M9", + "11.0.1", + "11.0.10", + "11.0.11", + "11.0.12", + "11.0.13", + "11.0.14", + "11.0.15", + "11.0.18", + "11.0.2", + "11.0.20", + "11.0.21", + "11.0.22", + "11.0.23", + "11.0.24", + "11.0.3", + "11.0.4", + "11.0.5", + "11.0.6", + "11.0.7", + "11.0.8", + "11.0.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.0-M1" + }, + { + "fixed": "10.1.58" + } + ] + } + ], + "versions": [ + "10.1.0", + "10.1.0-M1", + "10.1.0-M10", + "10.1.0-M11", + "10.1.0-M12", + "10.1.0-M14", + "10.1.0-M15", + "10.1.0-M16", + "10.1.0-M17", + "10.1.0-M2", + "10.1.0-M4", + "10.1.0-M5", + "10.1.0-M6", + "10.1.0-M7", + "10.1.0-M8", + "10.1.1", + "10.1.10", + "10.1.11", + "10.1.12", + "10.1.13", + "10.1.14", + "10.1.15", + "10.1.16", + "10.1.17", + "10.1.18", + "10.1.19", + "10.1.2", + "10.1.20", + "10.1.23", + "10.1.24", + "10.1.25", + "10.1.26", + "10.1.28", + "10.1.29", + "10.1.30", + "10.1.31", + "10.1.33", + "10.1.34", + "10.1.35", + "10.1.36", + "10.1.39", + "10.1.4", + "10.1.40", + "10.1.41", + "10.1.42", + "10.1.43", + "10.1.44", + "10.1.45", + "10.1.46", + "10.1.47", + "10.1.48", + "10.1.49", + "10.1.5", + "10.1.50", + "10.1.52", + "10.1.53", + "10.1.54", + "10.1.55", + "10.1.56", + "10.1.57", + "10.1.6", + "10.1.7", + "10.1.8", + "10.1.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0.M1" + }, + { + "fixed": "9.0.121" + } + ] + } + ], + "versions": [ + "9.0.0.M1", + "9.0.0.M10", + "9.0.0.M11", + "9.0.0.M13", + "9.0.0.M15", + "9.0.0.M17", + "9.0.0.M18", + "9.0.0.M19", + "9.0.0.M20", + "9.0.0.M21", + "9.0.0.M22", + "9.0.0.M25", + "9.0.0.M26", + "9.0.0.M27", + "9.0.0.M3", + "9.0.0.M4", + "9.0.0.M6", + "9.0.0.M8", + "9.0.0.M9", + "9.0.1", + "9.0.10", + "9.0.100", + "9.0.102", + "9.0.104", + "9.0.105", + "9.0.106", + "9.0.107", + "9.0.108", + "9.0.109", + "9.0.11", + "9.0.110", + "9.0.111", + "9.0.112", + "9.0.113", + "9.0.115", + "9.0.116", + "9.0.117", + "9.0.118", + "9.0.119", + "9.0.12", + "9.0.120", + "9.0.13", + "9.0.14", + "9.0.16", + "9.0.17", + "9.0.19", + "9.0.2", + "9.0.20", + "9.0.21", + "9.0.22", + "9.0.24", + "9.0.26", + "9.0.27", + "9.0.29", + "9.0.30", + "9.0.31", + "9.0.33", + "9.0.34", + "9.0.35", + "9.0.36", + "9.0.37", + "9.0.38", + "9.0.39", + "9.0.4", + "9.0.40", + "9.0.41", + "9.0.43", + "9.0.44", + "9.0.45", + "9.0.46", + "9.0.48", + "9.0.5", + "9.0.50", + "9.0.52", + "9.0.53", + "9.0.54", + "9.0.55", + "9.0.56", + "9.0.58", + "9.0.59", + "9.0.6", + "9.0.60", + "9.0.62", + "9.0.63", + "9.0.64", + "9.0.65", + "9.0.67", + "9.0.68", + "9.0.69", + "9.0.7", + "9.0.70", + "9.0.71", + "9.0.72", + "9.0.73", + "9.0.74", + "9.0.75", + "9.0.76", + "9.0.78", + "9.0.79", + "9.0.8", + "9.0.80", + "9.0.81", + "9.0.82", + "9.0.83", + "9.0.84", + "9.0.85", + "9.0.86", + "9.0.87", + "9.0.88", + "9.0.89", + "9.0.90", + "9.0.91", + "9.0.93", + "9.0.94", + "9.0.95", + "9.0.96", + "9.0.97", + "9.0.98", + "9.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5.0" + }, + { + "last_affected": "8.5.100" + } + ] + } + ], + "versions": [ + "8.5.0", + "8.5.100", + "8.5.11", + "8.5.12", + "8.5.13", + "8.5.14", + "8.5.15", + "8.5.16", + "8.5.19", + "8.5.2", + "8.5.20", + "8.5.21", + "8.5.23", + "8.5.24", + "8.5.27", + "8.5.28", + "8.5.29", + "8.5.3", + "8.5.30", + "8.5.31", + "8.5.32", + "8.5.33", + "8.5.34", + "8.5.35", + "8.5.37", + "8.5.38", + "8.5.39", + "8.5.4", + "8.5.40", + "8.5.41", + "8.5.42", + "8.5.43", + "8.5.45", + "8.5.46", + "8.5.47", + "8.5.49", + "8.5.5", + "8.5.50", + "8.5.51", + "8.5.53", + "8.5.54", + "8.5.55", + "8.5.56", + "8.5.57", + "8.5.58", + "8.5.59", + "8.5.6", + "8.5.60", + "8.5.61", + "8.5.63", + "8.5.64", + "8.5.65", + "8.5.66", + "8.5.68", + "8.5.69", + "8.5.70", + "8.5.71", + "8.5.72", + "8.5.73", + "8.5.75", + "8.5.76", + "8.5.77", + "8.5.78", + "8.5.79", + "8.5.8", + "8.5.81", + "8.5.82", + "8.5.83", + "8.5.84", + "8.5.85", + "8.5.86", + "8.5.87", + "8.5.88", + "8.5.89", + "8.5.9", + "8.5.90", + "8.5.91", + "8.5.92", + "8.5.93", + "8.5.94", + "8.5.95", + "8.5.96", + "8.5.97", + "8.5.98", + "8.5.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.30" + }, + { + "last_affected": "7.0.109" + } + ] + } + ], + "versions": [ + "7.0.100", + "7.0.103", + "7.0.104", + "7.0.105", + "7.0.106", + "7.0.107", + "7.0.108", + "7.0.109", + "7.0.30", + "7.0.32", + "7.0.33", + "7.0.34", + "7.0.35", + "7.0.37", + "7.0.39", + "7.0.40", + "7.0.41", + "7.0.42", + "7.0.47", + "7.0.50", + "7.0.52", + "7.0.53", + "7.0.54", + "7.0.55", + "7.0.56", + "7.0.57", + "7.0.59", + "7.0.61", + "7.0.62", + "7.0.63", + "7.0.64", + "7.0.65", + "7.0.67", + "7.0.68", + "7.0.69", + "7.0.70", + "7.0.72", + "7.0.73", + "7.0.75", + "7.0.76", + "7.0.77", + "7.0.78", + "7.0.79", + "7.0.81", + "7.0.82", + "7.0.84", + "7.0.85", + "7.0.86", + "7.0.88", + "7.0.90", + "7.0.91", + "7.0.92", + "7.0.93", + "7.0.94", + "7.0.96", + "7.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M1" + }, + { + "fixed": "11.0.25" + } + ] + } + ], + "versions": [ + "11.0.0", + "11.0.0-M1", + "11.0.0-M10", + "11.0.0-M11", + "11.0.0-M12", + "11.0.0-M13", + "11.0.0-M14", + "11.0.0-M15", + "11.0.0-M16", + "11.0.0-M17", + "11.0.0-M18", + "11.0.0-M19", + "11.0.0-M20", + "11.0.0-M21", + "11.0.0-M22", + "11.0.0-M24", + "11.0.0-M25", + "11.0.0-M26", + "11.0.0-M3", + "11.0.0-M4", + "11.0.0-M5", + "11.0.0-M6", + "11.0.0-M7", + "11.0.0-M9", + "11.0.1", + "11.0.10", + "11.0.11", + "11.0.12", + "11.0.13", + "11.0.14", + "11.0.15", + "11.0.18", + "11.0.2", + "11.0.20", + "11.0.21", + "11.0.22", + "11.0.23", + "11.0.24", + "11.0.3", + "11.0.4", + "11.0.5", + "11.0.6", + "11.0.7", + "11.0.8", + "11.0.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.0-M1" + }, + { + "fixed": "10.1.58" + } + ] + } + ], + "versions": [ + "10.1.0", + "10.1.0-M1", + "10.1.0-M10", + "10.1.0-M11", + "10.1.0-M12", + "10.1.0-M14", + "10.1.0-M15", + "10.1.0-M16", + "10.1.0-M17", + "10.1.0-M2", + "10.1.0-M4", + "10.1.0-M5", + "10.1.0-M6", + "10.1.0-M7", + "10.1.0-M8", + "10.1.1", + "10.1.10", + "10.1.11", + "10.1.12", + "10.1.13", + "10.1.14", + "10.1.15", + "10.1.16", + "10.1.17", + "10.1.18", + "10.1.19", + "10.1.2", + "10.1.20", + "10.1.23", + "10.1.24", + "10.1.25", + "10.1.26", + "10.1.28", + "10.1.29", + "10.1.30", + "10.1.31", + "10.1.33", + "10.1.34", + "10.1.35", + "10.1.36", + "10.1.39", + "10.1.4", + "10.1.40", + "10.1.41", + "10.1.42", + "10.1.43", + "10.1.44", + "10.1.45", + "10.1.46", + "10.1.47", + "10.1.48", + "10.1.49", + "10.1.5", + "10.1.50", + "10.1.52", + "10.1.53", + "10.1.54", + "10.1.55", + "10.1.56", + "10.1.57", + "10.1.6", + "10.1.7", + "10.1.8", + "10.1.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0.M1" + }, + { + "fixed": "9.0.121" + } + ] + } + ], + "versions": [ + "9.0.0.M1", + "9.0.0.M10", + "9.0.0.M11", + "9.0.0.M13", + "9.0.0.M15", + "9.0.0.M17", + "9.0.0.M18", + "9.0.0.M19", + "9.0.0.M20", + "9.0.0.M21", + "9.0.0.M22", + "9.0.0.M25", + "9.0.0.M26", + "9.0.0.M27", + "9.0.0.M3", + "9.0.0.M4", + "9.0.0.M6", + "9.0.0.M8", + "9.0.0.M9", + "9.0.1", + "9.0.10", + "9.0.100", + "9.0.102", + "9.0.104", + "9.0.105", + "9.0.106", + "9.0.107", + "9.0.108", + "9.0.109", + "9.0.11", + "9.0.110", + "9.0.111", + "9.0.112", + "9.0.113", + "9.0.115", + "9.0.116", + "9.0.117", + "9.0.118", + "9.0.119", + "9.0.12", + "9.0.120", + "9.0.13", + "9.0.14", + "9.0.16", + "9.0.17", + "9.0.19", + "9.0.2", + "9.0.20", + "9.0.21", + "9.0.22", + "9.0.24", + "9.0.26", + "9.0.27", + "9.0.29", + "9.0.30", + "9.0.31", + "9.0.33", + "9.0.34", + "9.0.35", + "9.0.36", + "9.0.37", + "9.0.38", + "9.0.39", + "9.0.4", + "9.0.40", + "9.0.41", + "9.0.43", + "9.0.44", + "9.0.45", + "9.0.46", + "9.0.48", + "9.0.5", + "9.0.50", + "9.0.52", + "9.0.53", + "9.0.54", + "9.0.55", + "9.0.56", + "9.0.58", + "9.0.59", + "9.0.6", + "9.0.60", + "9.0.62", + "9.0.63", + "9.0.64", + "9.0.65", + "9.0.67", + "9.0.68", + "9.0.69", + "9.0.7", + "9.0.70", + "9.0.71", + "9.0.72", + "9.0.73", + "9.0.74", + "9.0.75", + "9.0.76", + "9.0.78", + "9.0.79", + "9.0.8", + "9.0.80", + "9.0.81", + "9.0.82", + "9.0.83", + "9.0.84", + "9.0.85", + "9.0.86", + "9.0.87", + "9.0.88", + "9.0.89", + "9.0.90", + "9.0.91", + "9.0.93", + "9.0.94", + "9.0.95", + "9.0.96", + "9.0.97", + "9.0.98", + "9.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5.0" + }, + { + "last_affected": "8.5.100" + } + ] + } + ], + "versions": [ + "8.5.0", + "8.5.100", + "8.5.11", + "8.5.12", + "8.5.13", + "8.5.14", + "8.5.15", + "8.5.16", + "8.5.19", + "8.5.2", + "8.5.20", + "8.5.21", + "8.5.23", + "8.5.24", + "8.5.27", + "8.5.28", + "8.5.29", + "8.5.3", + "8.5.30", + "8.5.31", + "8.5.32", + "8.5.33", + "8.5.34", + "8.5.35", + "8.5.37", + "8.5.38", + "8.5.39", + "8.5.4", + "8.5.40", + "8.5.41", + "8.5.42", + "8.5.43", + "8.5.45", + "8.5.46", + "8.5.47", + "8.5.49", + "8.5.5", + "8.5.50", + "8.5.51", + "8.5.53", + "8.5.54", + "8.5.55", + "8.5.56", + "8.5.57", + "8.5.58", + "8.5.59", + "8.5.6", + "8.5.60", + "8.5.61", + "8.5.63", + "8.5.64", + "8.5.65", + "8.5.66", + "8.5.68", + "8.5.69", + "8.5.70", + "8.5.71", + "8.5.72", + "8.5.73", + "8.5.75", + "8.5.76", + "8.5.77", + "8.5.78", + "8.5.79", + "8.5.8", + "8.5.81", + "8.5.82", + "8.5.83", + "8.5.84", + "8.5.85", + "8.5.86", + "8.5.87", + "8.5.88", + "8.5.89", + "8.5.9", + "8.5.90", + "8.5.91", + "8.5.92", + "8.5.93", + "8.5.94", + "8.5.95", + "8.5.96", + "8.5.97", + "8.5.98", + "8.5.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.30" + }, + { + "last_affected": "7.0.109" + } + ] + } + ], + "versions": [ + "7.0.100", + "7.0.103", + "7.0.104", + "7.0.105", + "7.0.106", + "7.0.107", + "7.0.108", + "7.0.109", + "7.0.30", + "7.0.32", + "7.0.33", + "7.0.34", + "7.0.35", + "7.0.37", + "7.0.39", + "7.0.40", + "7.0.41", + "7.0.42", + "7.0.47", + "7.0.50", + "7.0.52", + "7.0.53", + "7.0.54", + "7.0.55", + "7.0.56", + "7.0.57", + "7.0.59", + "7.0.61", + "7.0.62", + "7.0.63", + "7.0.64", + "7.0.65", + "7.0.67", + "7.0.68", + "7.0.69", + "7.0.70", + "7.0.72", + "7.0.73", + "7.0.75", + "7.0.76", + "7.0.77", + "7.0.78", + "7.0.79", + "7.0.81", + "7.0.82", + "7.0.84", + "7.0.85", + "7.0.86", + "7.0.88", + "7.0.90", + "7.0.91", + "7.0.92", + "7.0.93", + "7.0.94", + "7.0.96", + "7.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json" + } + } + ], + "schema_version": "1.9.0", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ] + }, + { + "id": "GHSA-gcx9-497g-6cp6", + "summary": "Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability", + "details": "Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.", + "aliases": [ + "BIT-tomcat-2026-65182", + "CVE-2026-65182" + ], + "modified": "2026-09-11T08:25:41.300012858Z", + "published": "2026-08-26T00:30:52Z", + "database_specific": { + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-09-02T22:37:43Z", + "nvd_published_at": "2026-08-25T22:17:04Z", + "cwe_ids": [ + "CWE-284" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65182" + }, + { + "type": "WEB", + "url": "https://github.com/apache/tomcat/commit/8bafd79a3b54684e80e9cb1bafd4746aede7d3f5" + }, + { + "type": "WEB", + "url": "https://github.com/apache/tomcat/commit/b2c56ec8f20c66773a1a813034ffcdb60841f1cf" + }, + { + "type": "WEB", + "url": "https://github.com/apache/tomcat/commit/b79752d2a8578d94743e2a95c50af297f780c0df" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m" + }, + { + "type": "WEB", + "url": "https://tomcat.apache.org/security-10.html" + }, + { + "type": "WEB", + "url": "https://tomcat.apache.org/security-11.html" + }, + { + "type": "WEB", + "url": "https://tomcat.apache.org/security-9.html" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/08/26/1" + } + ], + "affected": [ + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M1" + }, + { + "fixed": "11.0.25" + } + ] + } + ], + "versions": [ + "11.0.0", + "11.0.0-M1", + "11.0.0-M10", + "11.0.0-M11", + "11.0.0-M12", + "11.0.0-M13", + "11.0.0-M14", + "11.0.0-M15", + "11.0.0-M16", + "11.0.0-M17", + "11.0.0-M18", + "11.0.0-M19", + "11.0.0-M20", + "11.0.0-M21", + "11.0.0-M22", + "11.0.0-M24", + "11.0.0-M25", + "11.0.0-M26", + "11.0.0-M3", + "11.0.0-M4", + "11.0.0-M5", + "11.0.0-M6", + "11.0.0-M7", + "11.0.0-M9", + "11.0.1", + "11.0.10", + "11.0.11", + "11.0.12", + "11.0.13", + "11.0.14", + "11.0.15", + "11.0.18", + "11.0.2", + "11.0.20", + "11.0.21", + "11.0.22", + "11.0.23", + "11.0.24", + "11.0.3", + "11.0.4", + "11.0.5", + "11.0.6", + "11.0.7", + "11.0.8", + "11.0.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.0-M1" + }, + { + "fixed": "10.1.58" + } + ] + } + ], + "versions": [ + "10.1.0", + "10.1.0-M1", + "10.1.0-M10", + "10.1.0-M11", + "10.1.0-M12", + "10.1.0-M14", + "10.1.0-M15", + "10.1.0-M16", + "10.1.0-M17", + "10.1.0-M2", + "10.1.0-M4", + "10.1.0-M5", + "10.1.0-M6", + "10.1.0-M7", + "10.1.0-M8", + "10.1.1", + "10.1.10", + "10.1.11", + "10.1.12", + "10.1.13", + "10.1.14", + "10.1.15", + "10.1.16", + "10.1.17", + "10.1.18", + "10.1.19", + "10.1.2", + "10.1.20", + "10.1.23", + "10.1.24", + "10.1.25", + "10.1.26", + "10.1.28", + "10.1.29", + "10.1.30", + "10.1.31", + "10.1.33", + "10.1.34", + "10.1.35", + "10.1.36", + "10.1.39", + "10.1.4", + "10.1.40", + "10.1.41", + "10.1.42", + "10.1.43", + "10.1.44", + "10.1.45", + "10.1.46", + "10.1.47", + "10.1.48", + "10.1.49", + "10.1.5", + "10.1.50", + "10.1.52", + "10.1.53", + "10.1.54", + "10.1.55", + "10.1.56", + "10.1.57", + "10.1.6", + "10.1.7", + "10.1.8", + "10.1.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0-M1" + }, + { + "fixed": "9.0.121" + } + ] + } + ], + "versions": [ + "9.0.0.M1", + "9.0.0.M10", + "9.0.0.M11", + "9.0.0.M13", + "9.0.0.M15", + "9.0.0.M17", + "9.0.0.M18", + "9.0.0.M19", + "9.0.0.M20", + "9.0.0.M21", + "9.0.0.M22", + "9.0.0.M25", + "9.0.0.M26", + "9.0.0.M27", + "9.0.0.M3", + "9.0.0.M4", + "9.0.0.M6", + "9.0.0.M8", + "9.0.0.M9", + "9.0.1", + "9.0.10", + "9.0.100", + "9.0.102", + "9.0.104", + "9.0.105", + "9.0.106", + "9.0.107", + "9.0.108", + "9.0.109", + "9.0.11", + "9.0.110", + "9.0.111", + "9.0.112", + "9.0.113", + "9.0.115", + "9.0.116", + "9.0.117", + "9.0.118", + "9.0.119", + "9.0.12", + "9.0.120", + "9.0.13", + "9.0.14", + "9.0.16", + "9.0.17", + "9.0.19", + "9.0.2", + "9.0.20", + "9.0.21", + "9.0.22", + "9.0.24", + "9.0.26", + "9.0.27", + "9.0.29", + "9.0.30", + "9.0.31", + "9.0.33", + "9.0.34", + "9.0.35", + "9.0.36", + "9.0.37", + "9.0.38", + "9.0.39", + "9.0.4", + "9.0.40", + "9.0.41", + "9.0.43", + "9.0.44", + "9.0.45", + "9.0.46", + "9.0.48", + "9.0.5", + "9.0.50", + "9.0.52", + "9.0.53", + "9.0.54", + "9.0.55", + "9.0.56", + "9.0.58", + "9.0.59", + "9.0.6", + "9.0.60", + "9.0.62", + "9.0.63", + "9.0.64", + "9.0.65", + "9.0.67", + "9.0.68", + "9.0.69", + "9.0.7", + "9.0.70", + "9.0.71", + "9.0.72", + "9.0.73", + "9.0.74", + "9.0.75", + "9.0.76", + "9.0.78", + "9.0.79", + "9.0.8", + "9.0.80", + "9.0.81", + "9.0.82", + "9.0.83", + "9.0.84", + "9.0.85", + "9.0.86", + "9.0.87", + "9.0.88", + "9.0.89", + "9.0.90", + "9.0.91", + "9.0.93", + "9.0.94", + "9.0.95", + "9.0.96", + "9.0.97", + "9.0.98", + "9.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5.0" + }, + { + "last_affected": "8.5.100" + } + ] + } + ], + "versions": [ + "8.5.0", + "8.5.100", + "8.5.11", + "8.5.12", + "8.5.13", + "8.5.14", + "8.5.15", + "8.5.16", + "8.5.19", + "8.5.2", + "8.5.20", + "8.5.21", + "8.5.23", + "8.5.24", + "8.5.27", + "8.5.28", + "8.5.29", + "8.5.3", + "8.5.30", + "8.5.31", + "8.5.32", + "8.5.33", + "8.5.34", + "8.5.35", + "8.5.37", + "8.5.38", + "8.5.39", + "8.5.4", + "8.5.40", + "8.5.41", + "8.5.42", + "8.5.43", + "8.5.45", + "8.5.46", + "8.5.47", + "8.5.49", + "8.5.5", + "8.5.50", + "8.5.51", + "8.5.53", + "8.5.54", + "8.5.55", + "8.5.56", + "8.5.57", + "8.5.58", + "8.5.59", + "8.5.6", + "8.5.60", + "8.5.61", + "8.5.63", + "8.5.64", + "8.5.65", + "8.5.66", + "8.5.68", + "8.5.69", + "8.5.70", + "8.5.71", + "8.5.72", + "8.5.73", + "8.5.75", + "8.5.76", + "8.5.77", + "8.5.78", + "8.5.79", + "8.5.8", + "8.5.81", + "8.5.82", + "8.5.83", + "8.5.84", + "8.5.85", + "8.5.86", + "8.5.87", + "8.5.88", + "8.5.89", + "8.5.9", + "8.5.90", + "8.5.91", + "8.5.92", + "8.5.93", + "8.5.94", + "8.5.95", + "8.5.96", + "8.5.97", + "8.5.98", + "8.5.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "last_affected": "7.0.109" + } + ] + } + ], + "versions": [ + "7.0.100", + "7.0.103", + "7.0.104", + "7.0.105", + "7.0.106", + "7.0.107", + "7.0.108", + "7.0.109", + "7.0.35", + "7.0.37", + "7.0.39", + "7.0.40", + "7.0.41", + "7.0.42", + "7.0.47", + "7.0.50", + "7.0.52", + "7.0.53", + "7.0.54", + "7.0.55", + "7.0.56", + "7.0.57", + "7.0.59", + "7.0.61", + "7.0.62", + "7.0.63", + "7.0.64", + "7.0.65", + "7.0.67", + "7.0.68", + "7.0.69", + "7.0.70", + "7.0.72", + "7.0.73", + "7.0.75", + "7.0.76", + "7.0.77", + "7.0.78", + "7.0.79", + "7.0.81", + "7.0.82", + "7.0.84", + "7.0.85", + "7.0.86", + "7.0.88", + "7.0.90", + "7.0.91", + "7.0.92", + "7.0.93", + "7.0.94", + "7.0.96", + "7.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M1" + }, + { + "fixed": "11.0.25" + } + ] + } + ], + "versions": [ + "11.0.0", + "11.0.0-M1", + "11.0.0-M10", + "11.0.0-M11", + "11.0.0-M12", + "11.0.0-M13", + "11.0.0-M14", + "11.0.0-M15", + "11.0.0-M16", + "11.0.0-M17", + "11.0.0-M18", + "11.0.0-M19", + "11.0.0-M20", + "11.0.0-M21", + "11.0.0-M22", + "11.0.0-M24", + "11.0.0-M25", + "11.0.0-M26", + "11.0.0-M3", + "11.0.0-M4", + "11.0.0-M5", + "11.0.0-M6", + "11.0.0-M7", + "11.0.0-M9", + "11.0.1", + "11.0.10", + "11.0.11", + "11.0.12", + "11.0.13", + "11.0.14", + "11.0.15", + "11.0.18", + "11.0.2", + "11.0.20", + "11.0.21", + "11.0.22", + "11.0.23", + "11.0.24", + "11.0.3", + "11.0.4", + "11.0.5", + "11.0.6", + "11.0.7", + "11.0.8", + "11.0.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.0-M1" + }, + { + "fixed": "10.1.58" + } + ] + } + ], + "versions": [ + "10.1.0", + "10.1.0-M1", + "10.1.0-M10", + "10.1.0-M11", + "10.1.0-M12", + "10.1.0-M14", + "10.1.0-M15", + "10.1.0-M16", + "10.1.0-M17", + "10.1.0-M2", + "10.1.0-M4", + "10.1.0-M5", + "10.1.0-M6", + "10.1.0-M7", + "10.1.0-M8", + "10.1.1", + "10.1.10", + "10.1.11", + "10.1.12", + "10.1.13", + "10.1.14", + "10.1.15", + "10.1.16", + "10.1.17", + "10.1.18", + "10.1.19", + "10.1.2", + "10.1.20", + "10.1.23", + "10.1.24", + "10.1.25", + "10.1.26", + "10.1.28", + "10.1.29", + "10.1.30", + "10.1.31", + "10.1.33", + "10.1.34", + "10.1.35", + "10.1.36", + "10.1.39", + "10.1.4", + "10.1.40", + "10.1.41", + "10.1.42", + "10.1.43", + "10.1.44", + "10.1.45", + "10.1.46", + "10.1.47", + "10.1.48", + "10.1.49", + "10.1.5", + "10.1.50", + "10.1.52", + "10.1.53", + "10.1.54", + "10.1.55", + "10.1.56", + "10.1.57", + "10.1.6", + "10.1.7", + "10.1.8", + "10.1.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0-M1" + }, + { + "fixed": "9.0.121" + } + ] + } + ], + "versions": [ + "9.0.0.M1", + "9.0.0.M10", + "9.0.0.M11", + "9.0.0.M13", + "9.0.0.M15", + "9.0.0.M17", + "9.0.0.M18", + "9.0.0.M19", + "9.0.0.M20", + "9.0.0.M21", + "9.0.0.M22", + "9.0.0.M25", + "9.0.0.M26", + "9.0.0.M27", + "9.0.0.M3", + "9.0.0.M4", + "9.0.0.M6", + "9.0.0.M8", + "9.0.0.M9", + "9.0.1", + "9.0.10", + "9.0.100", + "9.0.102", + "9.0.104", + "9.0.105", + "9.0.106", + "9.0.107", + "9.0.108", + "9.0.109", + "9.0.11", + "9.0.110", + "9.0.111", + "9.0.112", + "9.0.113", + "9.0.115", + "9.0.116", + "9.0.117", + "9.0.118", + "9.0.119", + "9.0.12", + "9.0.120", + "9.0.13", + "9.0.14", + "9.0.16", + "9.0.17", + "9.0.19", + "9.0.2", + "9.0.20", + "9.0.21", + "9.0.22", + "9.0.24", + "9.0.26", + "9.0.27", + "9.0.29", + "9.0.30", + "9.0.31", + "9.0.33", + "9.0.34", + "9.0.35", + "9.0.36", + "9.0.37", + "9.0.38", + "9.0.39", + "9.0.4", + "9.0.40", + "9.0.41", + "9.0.43", + "9.0.44", + "9.0.45", + "9.0.46", + "9.0.48", + "9.0.5", + "9.0.50", + "9.0.52", + "9.0.53", + "9.0.54", + "9.0.55", + "9.0.56", + "9.0.58", + "9.0.59", + "9.0.6", + "9.0.60", + "9.0.62", + "9.0.63", + "9.0.64", + "9.0.65", + "9.0.67", + "9.0.68", + "9.0.69", + "9.0.7", + "9.0.70", + "9.0.71", + "9.0.72", + "9.0.73", + "9.0.74", + "9.0.75", + "9.0.76", + "9.0.78", + "9.0.79", + "9.0.8", + "9.0.80", + "9.0.81", + "9.0.82", + "9.0.83", + "9.0.84", + "9.0.85", + "9.0.86", + "9.0.87", + "9.0.88", + "9.0.89", + "9.0.90", + "9.0.91", + "9.0.93", + "9.0.94", + "9.0.95", + "9.0.96", + "9.0.97", + "9.0.98", + "9.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5.0" + }, + { + "last_affected": "8.5.100" + } + ] + } + ], + "versions": [ + "8.5.0", + "8.5.100", + "8.5.11", + "8.5.12", + "8.5.13", + "8.5.14", + "8.5.15", + "8.5.16", + "8.5.19", + "8.5.2", + "8.5.20", + "8.5.21", + "8.5.23", + "8.5.24", + "8.5.27", + "8.5.28", + "8.5.29", + "8.5.3", + "8.5.30", + "8.5.31", + "8.5.32", + "8.5.33", + "8.5.34", + "8.5.35", + "8.5.37", + "8.5.38", + "8.5.39", + "8.5.4", + "8.5.40", + "8.5.41", + "8.5.42", + "8.5.43", + "8.5.45", + "8.5.46", + "8.5.47", + "8.5.49", + "8.5.5", + "8.5.50", + "8.5.51", + "8.5.53", + "8.5.54", + "8.5.55", + "8.5.56", + "8.5.57", + "8.5.58", + "8.5.59", + "8.5.6", + "8.5.60", + "8.5.61", + "8.5.63", + "8.5.64", + "8.5.65", + "8.5.66", + "8.5.68", + "8.5.69", + "8.5.70", + "8.5.71", + "8.5.72", + "8.5.73", + "8.5.75", + "8.5.76", + "8.5.77", + "8.5.78", + "8.5.79", + "8.5.8", + "8.5.81", + "8.5.82", + "8.5.83", + "8.5.84", + "8.5.85", + "8.5.86", + "8.5.87", + "8.5.88", + "8.5.89", + "8.5.9", + "8.5.90", + "8.5.91", + "8.5.92", + "8.5.93", + "8.5.94", + "8.5.95", + "8.5.96", + "8.5.97", + "8.5.98", + "8.5.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "last_affected": "7.0.109" + } + ] + } + ], + "versions": [ + "7.0.0", + "7.0.100", + "7.0.103", + "7.0.104", + "7.0.105", + "7.0.106", + "7.0.107", + "7.0.108", + "7.0.109", + "7.0.11", + "7.0.12", + "7.0.14", + "7.0.16", + "7.0.19", + "7.0.2", + "7.0.20", + "7.0.21", + "7.0.22", + "7.0.23", + "7.0.25", + "7.0.26", + "7.0.27", + "7.0.28", + "7.0.29", + "7.0.30", + "7.0.32", + "7.0.33", + "7.0.34", + "7.0.35", + "7.0.37", + "7.0.39", + "7.0.4", + "7.0.40", + "7.0.41", + "7.0.42", + "7.0.47", + "7.0.5", + "7.0.50", + "7.0.52", + "7.0.53", + "7.0.54", + "7.0.55", + "7.0.56", + "7.0.57", + "7.0.59", + "7.0.6", + "7.0.61", + "7.0.62", + "7.0.63", + "7.0.64", + "7.0.65", + "7.0.67", + "7.0.68", + "7.0.69", + "7.0.70", + "7.0.72", + "7.0.73", + "7.0.75", + "7.0.76", + "7.0.77", + "7.0.78", + "7.0.79", + "7.0.8", + "7.0.81", + "7.0.82", + "7.0.84", + "7.0.85", + "7.0.86", + "7.0.88", + "7.0.90", + "7.0.91", + "7.0.92", + "7.0.93", + "7.0.94", + "7.0.96", + "7.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M1" + }, + { + "fixed": "11.0.25" + } + ] + } + ], + "versions": [ + "11.0.0", + "11.0.0-M1", + "11.0.0-M10", + "11.0.0-M11", + "11.0.0-M12", + "11.0.0-M13", + "11.0.0-M14", + "11.0.0-M15", + "11.0.0-M16", + "11.0.0-M17", + "11.0.0-M18", + "11.0.0-M19", + "11.0.0-M20", + "11.0.0-M21", + "11.0.0-M22", + "11.0.0-M24", + "11.0.0-M25", + "11.0.0-M26", + "11.0.0-M3", + "11.0.0-M4", + "11.0.0-M5", + "11.0.0-M6", + "11.0.0-M7", + "11.0.0-M9", + "11.0.1", + "11.0.10", + "11.0.11", + "11.0.12", + "11.0.13", + "11.0.14", + "11.0.15", + "11.0.18", + "11.0.2", + "11.0.20", + "11.0.21", + "11.0.22", + "11.0.23", + "11.0.24", + "11.0.3", + "11.0.4", + "11.0.5", + "11.0.6", + "11.0.7", + "11.0.8", + "11.0.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.0-M1" + }, + { + "fixed": "10.1.58" + } + ] + } + ], + "versions": [ + "10.1.0", + "10.1.0-M1", + "10.1.0-M10", + "10.1.0-M11", + "10.1.0-M12", + "10.1.0-M14", + "10.1.0-M15", + "10.1.0-M16", + "10.1.0-M17", + "10.1.0-M2", + "10.1.0-M4", + "10.1.0-M5", + "10.1.0-M6", + "10.1.0-M7", + "10.1.0-M8", + "10.1.1", + "10.1.10", + "10.1.11", + "10.1.12", + "10.1.13", + "10.1.14", + "10.1.15", + "10.1.16", + "10.1.17", + "10.1.18", + "10.1.19", + "10.1.2", + "10.1.20", + "10.1.23", + "10.1.24", + "10.1.25", + "10.1.26", + "10.1.28", + "10.1.29", + "10.1.30", + "10.1.31", + "10.1.33", + "10.1.34", + "10.1.35", + "10.1.36", + "10.1.39", + "10.1.4", + "10.1.40", + "10.1.41", + "10.1.42", + "10.1.43", + "10.1.44", + "10.1.45", + "10.1.46", + "10.1.47", + "10.1.48", + "10.1.49", + "10.1.5", + "10.1.50", + "10.1.52", + "10.1.53", + "10.1.54", + "10.1.55", + "10.1.56", + "10.1.57", + "10.1.6", + "10.1.7", + "10.1.8", + "10.1.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0-M1" + }, + { + "fixed": "9.0.121" + } + ] + } + ], + "versions": [ + "9.0.0.M1", + "9.0.0.M10", + "9.0.0.M11", + "9.0.0.M13", + "9.0.0.M15", + "9.0.0.M17", + "9.0.0.M18", + "9.0.0.M19", + "9.0.0.M20", + "9.0.0.M21", + "9.0.0.M22", + "9.0.0.M25", + "9.0.0.M26", + "9.0.0.M27", + "9.0.0.M3", + "9.0.0.M4", + "9.0.0.M6", + "9.0.0.M8", + "9.0.0.M9", + "9.0.1", + "9.0.10", + "9.0.100", + "9.0.102", + "9.0.104", + "9.0.105", + "9.0.106", + "9.0.107", + "9.0.108", + "9.0.109", + "9.0.11", + "9.0.110", + "9.0.111", + "9.0.112", + "9.0.113", + "9.0.115", + "9.0.116", + "9.0.117", + "9.0.118", + "9.0.119", + "9.0.12", + "9.0.120", + "9.0.13", + "9.0.14", + "9.0.16", + "9.0.17", + "9.0.19", + "9.0.2", + "9.0.20", + "9.0.21", + "9.0.22", + "9.0.24", + "9.0.26", + "9.0.27", + "9.0.29", + "9.0.30", + "9.0.31", + "9.0.33", + "9.0.34", + "9.0.35", + "9.0.36", + "9.0.37", + "9.0.38", + "9.0.39", + "9.0.4", + "9.0.40", + "9.0.41", + "9.0.43", + "9.0.44", + "9.0.45", + "9.0.46", + "9.0.48", + "9.0.5", + "9.0.50", + "9.0.52", + "9.0.53", + "9.0.54", + "9.0.55", + "9.0.56", + "9.0.58", + "9.0.59", + "9.0.6", + "9.0.60", + "9.0.62", + "9.0.63", + "9.0.64", + "9.0.65", + "9.0.67", + "9.0.68", + "9.0.69", + "9.0.7", + "9.0.70", + "9.0.71", + "9.0.72", + "9.0.73", + "9.0.74", + "9.0.75", + "9.0.76", + "9.0.78", + "9.0.79", + "9.0.8", + "9.0.80", + "9.0.81", + "9.0.82", + "9.0.83", + "9.0.84", + "9.0.85", + "9.0.86", + "9.0.87", + "9.0.88", + "9.0.89", + "9.0.90", + "9.0.91", + "9.0.93", + "9.0.94", + "9.0.95", + "9.0.96", + "9.0.97", + "9.0.98", + "9.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5.0" + }, + { + "last_affected": "8.5.100" + } + ] + } + ], + "versions": [ + "8.5.0", + "8.5.100", + "8.5.11", + "8.5.12", + "8.5.13", + "8.5.14", + "8.5.15", + "8.5.16", + "8.5.19", + "8.5.2", + "8.5.20", + "8.5.21", + "8.5.23", + "8.5.24", + "8.5.27", + "8.5.28", + "8.5.29", + "8.5.3", + "8.5.30", + "8.5.31", + "8.5.32", + "8.5.33", + "8.5.34", + "8.5.35", + "8.5.37", + "8.5.38", + "8.5.39", + "8.5.4", + "8.5.40", + "8.5.41", + "8.5.42", + "8.5.43", + "8.5.45", + "8.5.46", + "8.5.47", + "8.5.49", + "8.5.5", + "8.5.50", + "8.5.51", + "8.5.53", + "8.5.54", + "8.5.55", + "8.5.56", + "8.5.57", + "8.5.58", + "8.5.59", + "8.5.6", + "8.5.60", + "8.5.61", + "8.5.63", + "8.5.64", + "8.5.65", + "8.5.66", + "8.5.68", + "8.5.69", + "8.5.70", + "8.5.71", + "8.5.72", + "8.5.73", + "8.5.75", + "8.5.76", + "8.5.77", + "8.5.78", + "8.5.79", + "8.5.8", + "8.5.81", + "8.5.82", + "8.5.83", + "8.5.84", + "8.5.85", + "8.5.86", + "8.5.87", + "8.5.88", + "8.5.89", + "8.5.9", + "8.5.90", + "8.5.91", + "8.5.92", + "8.5.93", + "8.5.94", + "8.5.95", + "8.5.96", + "8.5.97", + "8.5.98", + "8.5.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "last_affected": "7.0.109" + } + ] + } + ], + "versions": [ + "7.0.0", + "7.0.100", + "7.0.103", + "7.0.104", + "7.0.105", + "7.0.106", + "7.0.107", + "7.0.108", + "7.0.109", + "7.0.11", + "7.0.12", + "7.0.14", + "7.0.16", + "7.0.19", + "7.0.2", + "7.0.20", + "7.0.21", + "7.0.22", + "7.0.23", + "7.0.25", + "7.0.26", + "7.0.27", + "7.0.28", + "7.0.29", + "7.0.30", + "7.0.32", + "7.0.33", + "7.0.34", + "7.0.35", + "7.0.37", + "7.0.39", + "7.0.4", + "7.0.40", + "7.0.41", + "7.0.42", + "7.0.47", + "7.0.5", + "7.0.50", + "7.0.52", + "7.0.53", + "7.0.54", + "7.0.55", + "7.0.56", + "7.0.57", + "7.0.59", + "7.0.6", + "7.0.61", + "7.0.62", + "7.0.63", + "7.0.64", + "7.0.65", + "7.0.67", + "7.0.68", + "7.0.69", + "7.0.70", + "7.0.72", + "7.0.73", + "7.0.75", + "7.0.76", + "7.0.77", + "7.0.78", + "7.0.79", + "7.0.8", + "7.0.81", + "7.0.82", + "7.0.84", + "7.0.85", + "7.0.86", + "7.0.88", + "7.0.90", + "7.0.91", + "7.0.92", + "7.0.93", + "7.0.94", + "7.0.96", + "7.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json" + } + } + ], + "schema_version": "1.9.0", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ] + }, + { + "id": "GHSA-h3x4-894j-xpx5", + "summary": "Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability", + "details": "Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.", + "aliases": [ + "BIT-tomcat-2026-68525", + "CVE-2026-68525" + ], + "modified": "2026-09-11T08:25:40.118635278Z", + "published": "2026-08-26T00:30:52Z", + "database_specific": { + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2026-09-02T22:39:14Z", + "nvd_published_at": "2026-08-25T22:17:05Z", + "cwe_ids": [ + "CWE-863" + ] + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68525" + }, + { + "type": "WEB", + "url": "https://github.com/apache/tomcat/commit/10d048e16034ddf12055e0cede0da05b15c823b8" + }, + { + "type": "WEB", + "url": "https://github.com/apache/tomcat/commit/32f0c38526b4e655ff0c17cd97afedefc624fe43" + }, + { + "type": "WEB", + "url": "https://github.com/apache/tomcat/commit/58123aa468a20e2a079b7e0c68a4009e2475c098" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/tomcat" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7" + }, + { + "type": "WEB", + "url": "https://tomcat.apache.org/security-10.html" + }, + { + "type": "WEB", + "url": "https://tomcat.apache.org/security-11.html" + }, + { + "type": "WEB", + "url": "https://tomcat.apache.org/security-9.html" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/08/26/7" + } + ], + "affected": [ + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M1" + }, + { + "fixed": "11.0.25" + } + ] + } + ], + "versions": [ + "11.0.0", + "11.0.0-M1", + "11.0.0-M10", + "11.0.0-M11", + "11.0.0-M12", + "11.0.0-M13", + "11.0.0-M14", + "11.0.0-M15", + "11.0.0-M16", + "11.0.0-M17", + "11.0.0-M18", + "11.0.0-M19", + "11.0.0-M20", + "11.0.0-M21", + "11.0.0-M22", + "11.0.0-M24", + "11.0.0-M25", + "11.0.0-M26", + "11.0.0-M3", + "11.0.0-M4", + "11.0.0-M5", + "11.0.0-M6", + "11.0.0-M7", + "11.0.0-M9", + "11.0.1", + "11.0.10", + "11.0.11", + "11.0.12", + "11.0.13", + "11.0.14", + "11.0.15", + "11.0.18", + "11.0.2", + "11.0.20", + "11.0.21", + "11.0.22", + "11.0.23", + "11.0.24", + "11.0.3", + "11.0.4", + "11.0.5", + "11.0.6", + "11.0.7", + "11.0.8", + "11.0.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.0-M1" + }, + { + "fixed": "10.1.58" + } + ] + } + ], + "versions": [ + "10.1.0", + "10.1.0-M1", + "10.1.0-M10", + "10.1.0-M11", + "10.1.0-M12", + "10.1.0-M14", + "10.1.0-M15", + "10.1.0-M16", + "10.1.0-M17", + "10.1.0-M2", + "10.1.0-M4", + "10.1.0-M5", + "10.1.0-M6", + "10.1.0-M7", + "10.1.0-M8", + "10.1.1", + "10.1.10", + "10.1.11", + "10.1.12", + "10.1.13", + "10.1.14", + "10.1.15", + "10.1.16", + "10.1.17", + "10.1.18", + "10.1.19", + "10.1.2", + "10.1.20", + "10.1.23", + "10.1.24", + "10.1.25", + "10.1.26", + "10.1.28", + "10.1.29", + "10.1.30", + "10.1.31", + "10.1.33", + "10.1.34", + "10.1.35", + "10.1.36", + "10.1.39", + "10.1.4", + "10.1.40", + "10.1.41", + "10.1.42", + "10.1.43", + "10.1.44", + "10.1.45", + "10.1.46", + "10.1.47", + "10.1.48", + "10.1.49", + "10.1.5", + "10.1.50", + "10.1.52", + "10.1.53", + "10.1.54", + "10.1.55", + "10.1.56", + "10.1.57", + "10.1.6", + "10.1.7", + "10.1.8", + "10.1.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0-M1" + }, + { + "fixed": "9.0.121" + } + ] + } + ], + "versions": [ + "9.0.0.M1", + "9.0.0.M10", + "9.0.0.M11", + "9.0.0.M13", + "9.0.0.M15", + "9.0.0.M17", + "9.0.0.M18", + "9.0.0.M19", + "9.0.0.M20", + "9.0.0.M21", + "9.0.0.M22", + "9.0.0.M25", + "9.0.0.M26", + "9.0.0.M27", + "9.0.0.M3", + "9.0.0.M4", + "9.0.0.M6", + "9.0.0.M8", + "9.0.0.M9", + "9.0.1", + "9.0.10", + "9.0.100", + "9.0.102", + "9.0.104", + "9.0.105", + "9.0.106", + "9.0.107", + "9.0.108", + "9.0.109", + "9.0.11", + "9.0.110", + "9.0.111", + "9.0.112", + "9.0.113", + "9.0.115", + "9.0.116", + "9.0.117", + "9.0.118", + "9.0.119", + "9.0.12", + "9.0.120", + "9.0.13", + "9.0.14", + "9.0.16", + "9.0.17", + "9.0.19", + "9.0.2", + "9.0.20", + "9.0.21", + "9.0.22", + "9.0.24", + "9.0.26", + "9.0.27", + "9.0.29", + "9.0.30", + "9.0.31", + "9.0.33", + "9.0.34", + "9.0.35", + "9.0.36", + "9.0.37", + "9.0.38", + "9.0.39", + "9.0.4", + "9.0.40", + "9.0.41", + "9.0.43", + "9.0.44", + "9.0.45", + "9.0.46", + "9.0.48", + "9.0.5", + "9.0.50", + "9.0.52", + "9.0.53", + "9.0.54", + "9.0.55", + "9.0.56", + "9.0.58", + "9.0.59", + "9.0.6", + "9.0.60", + "9.0.62", + "9.0.63", + "9.0.64", + "9.0.65", + "9.0.67", + "9.0.68", + "9.0.69", + "9.0.7", + "9.0.70", + "9.0.71", + "9.0.72", + "9.0.73", + "9.0.74", + "9.0.75", + "9.0.76", + "9.0.78", + "9.0.79", + "9.0.8", + "9.0.80", + "9.0.81", + "9.0.82", + "9.0.83", + "9.0.84", + "9.0.85", + "9.0.86", + "9.0.87", + "9.0.88", + "9.0.89", + "9.0.90", + "9.0.91", + "9.0.93", + "9.0.94", + "9.0.95", + "9.0.96", + "9.0.97", + "9.0.98", + "9.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5.0" + }, + { + "last_affected": "8.5.100" + } + ] + } + ], + "versions": [ + "8.5.0", + "8.5.100", + "8.5.11", + "8.5.12", + "8.5.13", + "8.5.14", + "8.5.15", + "8.5.16", + "8.5.19", + "8.5.2", + "8.5.20", + "8.5.21", + "8.5.23", + "8.5.24", + "8.5.27", + "8.5.28", + "8.5.29", + "8.5.3", + "8.5.30", + "8.5.31", + "8.5.32", + "8.5.33", + "8.5.34", + "8.5.35", + "8.5.37", + "8.5.38", + "8.5.39", + "8.5.4", + "8.5.40", + "8.5.41", + "8.5.42", + "8.5.43", + "8.5.45", + "8.5.46", + "8.5.47", + "8.5.49", + "8.5.5", + "8.5.50", + "8.5.51", + "8.5.53", + "8.5.54", + "8.5.55", + "8.5.56", + "8.5.57", + "8.5.58", + "8.5.59", + "8.5.6", + "8.5.60", + "8.5.61", + "8.5.63", + "8.5.64", + "8.5.65", + "8.5.66", + "8.5.68", + "8.5.69", + "8.5.70", + "8.5.71", + "8.5.72", + "8.5.73", + "8.5.75", + "8.5.76", + "8.5.77", + "8.5.78", + "8.5.79", + "8.5.8", + "8.5.81", + "8.5.82", + "8.5.83", + "8.5.84", + "8.5.85", + "8.5.86", + "8.5.87", + "8.5.88", + "8.5.89", + "8.5.9", + "8.5.90", + "8.5.91", + "8.5.92", + "8.5.93", + "8.5.94", + "8.5.95", + "8.5.96", + "8.5.97", + "8.5.98", + "8.5.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "last_affected": "7.0.109" + } + ] + } + ], + "versions": [ + "7.0.100", + "7.0.103", + "7.0.104", + "7.0.105", + "7.0.106", + "7.0.107", + "7.0.108", + "7.0.109", + "7.0.35", + "7.0.37", + "7.0.39", + "7.0.40", + "7.0.41", + "7.0.42", + "7.0.47", + "7.0.50", + "7.0.52", + "7.0.53", + "7.0.54", + "7.0.55", + "7.0.56", + "7.0.57", + "7.0.59", + "7.0.61", + "7.0.62", + "7.0.63", + "7.0.64", + "7.0.65", + "7.0.67", + "7.0.68", + "7.0.69", + "7.0.70", + "7.0.72", + "7.0.73", + "7.0.75", + "7.0.76", + "7.0.77", + "7.0.78", + "7.0.79", + "7.0.81", + "7.0.82", + "7.0.84", + "7.0.85", + "7.0.86", + "7.0.88", + "7.0.90", + "7.0.91", + "7.0.92", + "7.0.93", + "7.0.94", + "7.0.96", + "7.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M1" + }, + { + "fixed": "11.0.25" + } + ] + } + ], + "versions": [ + "11.0.0", + "11.0.0-M1", + "11.0.0-M10", + "11.0.0-M11", + "11.0.0-M12", + "11.0.0-M13", + "11.0.0-M14", + "11.0.0-M15", + "11.0.0-M16", + "11.0.0-M17", + "11.0.0-M18", + "11.0.0-M19", + "11.0.0-M20", + "11.0.0-M21", + "11.0.0-M22", + "11.0.0-M24", + "11.0.0-M25", + "11.0.0-M26", + "11.0.0-M3", + "11.0.0-M4", + "11.0.0-M5", + "11.0.0-M6", + "11.0.0-M7", + "11.0.0-M9", + "11.0.1", + "11.0.10", + "11.0.11", + "11.0.12", + "11.0.13", + "11.0.14", + "11.0.15", + "11.0.18", + "11.0.2", + "11.0.20", + "11.0.21", + "11.0.22", + "11.0.23", + "11.0.24", + "11.0.3", + "11.0.4", + "11.0.5", + "11.0.6", + "11.0.7", + "11.0.8", + "11.0.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.0-M1" + }, + { + "fixed": "10.1.58" + } + ] + } + ], + "versions": [ + "10.1.0", + "10.1.0-M1", + "10.1.0-M10", + "10.1.0-M11", + "10.1.0-M12", + "10.1.0-M14", + "10.1.0-M15", + "10.1.0-M16", + "10.1.0-M17", + "10.1.0-M2", + "10.1.0-M4", + "10.1.0-M5", + "10.1.0-M6", + "10.1.0-M7", + "10.1.0-M8", + "10.1.1", + "10.1.10", + "10.1.11", + "10.1.12", + "10.1.13", + "10.1.14", + "10.1.15", + "10.1.16", + "10.1.17", + "10.1.18", + "10.1.19", + "10.1.2", + "10.1.20", + "10.1.23", + "10.1.24", + "10.1.25", + "10.1.26", + "10.1.28", + "10.1.29", + "10.1.30", + "10.1.31", + "10.1.33", + "10.1.34", + "10.1.35", + "10.1.36", + "10.1.39", + "10.1.4", + "10.1.40", + "10.1.41", + "10.1.42", + "10.1.43", + "10.1.44", + "10.1.45", + "10.1.46", + "10.1.47", + "10.1.48", + "10.1.49", + "10.1.5", + "10.1.50", + "10.1.52", + "10.1.53", + "10.1.54", + "10.1.55", + "10.1.56", + "10.1.57", + "10.1.6", + "10.1.7", + "10.1.8", + "10.1.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0-M1" + }, + { + "fixed": "9.0.121" + } + ] + } + ], + "versions": [ + "9.0.0.M1", + "9.0.0.M10", + "9.0.0.M11", + "9.0.0.M13", + "9.0.0.M15", + "9.0.0.M17", + "9.0.0.M18", + "9.0.0.M19", + "9.0.0.M20", + "9.0.0.M21", + "9.0.0.M22", + "9.0.0.M25", + "9.0.0.M26", + "9.0.0.M27", + "9.0.0.M3", + "9.0.0.M4", + "9.0.0.M6", + "9.0.0.M8", + "9.0.0.M9", + "9.0.1", + "9.0.10", + "9.0.100", + "9.0.102", + "9.0.104", + "9.0.105", + "9.0.106", + "9.0.107", + "9.0.108", + "9.0.109", + "9.0.11", + "9.0.110", + "9.0.111", + "9.0.112", + "9.0.113", + "9.0.115", + "9.0.116", + "9.0.117", + "9.0.118", + "9.0.119", + "9.0.12", + "9.0.120", + "9.0.13", + "9.0.14", + "9.0.16", + "9.0.17", + "9.0.19", + "9.0.2", + "9.0.20", + "9.0.21", + "9.0.22", + "9.0.24", + "9.0.26", + "9.0.27", + "9.0.29", + "9.0.30", + "9.0.31", + "9.0.33", + "9.0.34", + "9.0.35", + "9.0.36", + "9.0.37", + "9.0.38", + "9.0.39", + "9.0.4", + "9.0.40", + "9.0.41", + "9.0.43", + "9.0.44", + "9.0.45", + "9.0.46", + "9.0.48", + "9.0.5", + "9.0.50", + "9.0.52", + "9.0.53", + "9.0.54", + "9.0.55", + "9.0.56", + "9.0.58", + "9.0.59", + "9.0.6", + "9.0.60", + "9.0.62", + "9.0.63", + "9.0.64", + "9.0.65", + "9.0.67", + "9.0.68", + "9.0.69", + "9.0.7", + "9.0.70", + "9.0.71", + "9.0.72", + "9.0.73", + "9.0.74", + "9.0.75", + "9.0.76", + "9.0.78", + "9.0.79", + "9.0.8", + "9.0.80", + "9.0.81", + "9.0.82", + "9.0.83", + "9.0.84", + "9.0.85", + "9.0.86", + "9.0.87", + "9.0.88", + "9.0.89", + "9.0.90", + "9.0.91", + "9.0.93", + "9.0.94", + "9.0.95", + "9.0.96", + "9.0.97", + "9.0.98", + "9.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5.0" + }, + { + "last_affected": "8.5.100" + } + ] + } + ], + "versions": [ + "8.5.0", + "8.5.100", + "8.5.11", + "8.5.12", + "8.5.13", + "8.5.14", + "8.5.15", + "8.5.16", + "8.5.19", + "8.5.2", + "8.5.20", + "8.5.21", + "8.5.23", + "8.5.24", + "8.5.27", + "8.5.28", + "8.5.29", + "8.5.3", + "8.5.30", + "8.5.31", + "8.5.32", + "8.5.33", + "8.5.34", + "8.5.35", + "8.5.37", + "8.5.38", + "8.5.39", + "8.5.4", + "8.5.40", + "8.5.41", + "8.5.42", + "8.5.43", + "8.5.45", + "8.5.46", + "8.5.47", + "8.5.49", + "8.5.5", + "8.5.50", + "8.5.51", + "8.5.53", + "8.5.54", + "8.5.55", + "8.5.56", + "8.5.57", + "8.5.58", + "8.5.59", + "8.5.6", + "8.5.60", + "8.5.61", + "8.5.63", + "8.5.64", + "8.5.65", + "8.5.66", + "8.5.68", + "8.5.69", + "8.5.70", + "8.5.71", + "8.5.72", + "8.5.73", + "8.5.75", + "8.5.76", + "8.5.77", + "8.5.78", + "8.5.79", + "8.5.8", + "8.5.81", + "8.5.82", + "8.5.83", + "8.5.84", + "8.5.85", + "8.5.86", + "8.5.87", + "8.5.88", + "8.5.89", + "8.5.9", + "8.5.90", + "8.5.91", + "8.5.92", + "8.5.93", + "8.5.94", + "8.5.95", + "8.5.96", + "8.5.97", + "8.5.98", + "8.5.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat:tomcat-catalina", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "last_affected": "7.0.109" + } + ] + } + ], + "versions": [ + "7.0.0", + "7.0.100", + "7.0.103", + "7.0.104", + "7.0.105", + "7.0.106", + "7.0.107", + "7.0.108", + "7.0.109", + "7.0.11", + "7.0.12", + "7.0.14", + "7.0.16", + "7.0.19", + "7.0.2", + "7.0.20", + "7.0.21", + "7.0.22", + "7.0.23", + "7.0.25", + "7.0.26", + "7.0.27", + "7.0.28", + "7.0.29", + "7.0.30", + "7.0.32", + "7.0.33", + "7.0.34", + "7.0.35", + "7.0.37", + "7.0.39", + "7.0.4", + "7.0.40", + "7.0.41", + "7.0.42", + "7.0.47", + "7.0.5", + "7.0.50", + "7.0.52", + "7.0.53", + "7.0.54", + "7.0.55", + "7.0.56", + "7.0.57", + "7.0.59", + "7.0.6", + "7.0.61", + "7.0.62", + "7.0.63", + "7.0.64", + "7.0.65", + "7.0.67", + "7.0.68", + "7.0.69", + "7.0.70", + "7.0.72", + "7.0.73", + "7.0.75", + "7.0.76", + "7.0.77", + "7.0.78", + "7.0.79", + "7.0.8", + "7.0.81", + "7.0.82", + "7.0.84", + "7.0.85", + "7.0.86", + "7.0.88", + "7.0.90", + "7.0.91", + "7.0.92", + "7.0.93", + "7.0.94", + "7.0.96", + "7.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M1" + }, + { + "fixed": "11.0.25" + } + ] + } + ], + "versions": [ + "11.0.0", + "11.0.0-M1", + "11.0.0-M10", + "11.0.0-M11", + "11.0.0-M12", + "11.0.0-M13", + "11.0.0-M14", + "11.0.0-M15", + "11.0.0-M16", + "11.0.0-M17", + "11.0.0-M18", + "11.0.0-M19", + "11.0.0-M20", + "11.0.0-M21", + "11.0.0-M22", + "11.0.0-M24", + "11.0.0-M25", + "11.0.0-M26", + "11.0.0-M3", + "11.0.0-M4", + "11.0.0-M5", + "11.0.0-M6", + "11.0.0-M7", + "11.0.0-M9", + "11.0.1", + "11.0.10", + "11.0.11", + "11.0.12", + "11.0.13", + "11.0.14", + "11.0.15", + "11.0.18", + "11.0.2", + "11.0.20", + "11.0.21", + "11.0.22", + "11.0.23", + "11.0.24", + "11.0.3", + "11.0.4", + "11.0.5", + "11.0.6", + "11.0.7", + "11.0.8", + "11.0.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.0-M1" + }, + { + "fixed": "10.1.58" + } + ] + } + ], + "versions": [ + "10.1.0", + "10.1.0-M1", + "10.1.0-M10", + "10.1.0-M11", + "10.1.0-M12", + "10.1.0-M14", + "10.1.0-M15", + "10.1.0-M16", + "10.1.0-M17", + "10.1.0-M2", + "10.1.0-M4", + "10.1.0-M5", + "10.1.0-M6", + "10.1.0-M7", + "10.1.0-M8", + "10.1.1", + "10.1.10", + "10.1.11", + "10.1.12", + "10.1.13", + "10.1.14", + "10.1.15", + "10.1.16", + "10.1.17", + "10.1.18", + "10.1.19", + "10.1.2", + "10.1.20", + "10.1.23", + "10.1.24", + "10.1.25", + "10.1.26", + "10.1.28", + "10.1.29", + "10.1.30", + "10.1.31", + "10.1.33", + "10.1.34", + "10.1.35", + "10.1.36", + "10.1.39", + "10.1.4", + "10.1.40", + "10.1.41", + "10.1.42", + "10.1.43", + "10.1.44", + "10.1.45", + "10.1.46", + "10.1.47", + "10.1.48", + "10.1.49", + "10.1.5", + "10.1.50", + "10.1.52", + "10.1.53", + "10.1.54", + "10.1.55", + "10.1.56", + "10.1.57", + "10.1.6", + "10.1.7", + "10.1.8", + "10.1.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.0-M1" + }, + { + "fixed": "9.0.121" + } + ] + } + ], + "versions": [ + "9.0.0.M1", + "9.0.0.M10", + "9.0.0.M11", + "9.0.0.M13", + "9.0.0.M15", + "9.0.0.M17", + "9.0.0.M18", + "9.0.0.M19", + "9.0.0.M20", + "9.0.0.M21", + "9.0.0.M22", + "9.0.0.M25", + "9.0.0.M26", + "9.0.0.M27", + "9.0.0.M3", + "9.0.0.M4", + "9.0.0.M6", + "9.0.0.M8", + "9.0.0.M9", + "9.0.1", + "9.0.10", + "9.0.100", + "9.0.102", + "9.0.104", + "9.0.105", + "9.0.106", + "9.0.107", + "9.0.108", + "9.0.109", + "9.0.11", + "9.0.110", + "9.0.111", + "9.0.112", + "9.0.113", + "9.0.115", + "9.0.116", + "9.0.117", + "9.0.118", + "9.0.119", + "9.0.12", + "9.0.120", + "9.0.13", + "9.0.14", + "9.0.16", + "9.0.17", + "9.0.19", + "9.0.2", + "9.0.20", + "9.0.21", + "9.0.22", + "9.0.24", + "9.0.26", + "9.0.27", + "9.0.29", + "9.0.30", + "9.0.31", + "9.0.33", + "9.0.34", + "9.0.35", + "9.0.36", + "9.0.37", + "9.0.38", + "9.0.39", + "9.0.4", + "9.0.40", + "9.0.41", + "9.0.43", + "9.0.44", + "9.0.45", + "9.0.46", + "9.0.48", + "9.0.5", + "9.0.50", + "9.0.52", + "9.0.53", + "9.0.54", + "9.0.55", + "9.0.56", + "9.0.58", + "9.0.59", + "9.0.6", + "9.0.60", + "9.0.62", + "9.0.63", + "9.0.64", + "9.0.65", + "9.0.67", + "9.0.68", + "9.0.69", + "9.0.7", + "9.0.70", + "9.0.71", + "9.0.72", + "9.0.73", + "9.0.74", + "9.0.75", + "9.0.76", + "9.0.78", + "9.0.79", + "9.0.8", + "9.0.80", + "9.0.81", + "9.0.82", + "9.0.83", + "9.0.84", + "9.0.85", + "9.0.86", + "9.0.87", + "9.0.88", + "9.0.89", + "9.0.90", + "9.0.91", + "9.0.93", + "9.0.94", + "9.0.95", + "9.0.96", + "9.0.97", + "9.0.98", + "9.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "8.5.0" + }, + { + "last_affected": "8.5.100" + } + ] + } + ], + "versions": [ + "8.5.0", + "8.5.100", + "8.5.11", + "8.5.12", + "8.5.13", + "8.5.14", + "8.5.15", + "8.5.16", + "8.5.19", + "8.5.2", + "8.5.20", + "8.5.21", + "8.5.23", + "8.5.24", + "8.5.27", + "8.5.28", + "8.5.29", + "8.5.3", + "8.5.30", + "8.5.31", + "8.5.32", + "8.5.33", + "8.5.34", + "8.5.35", + "8.5.37", + "8.5.38", + "8.5.39", + "8.5.4", + "8.5.40", + "8.5.41", + "8.5.42", + "8.5.43", + "8.5.45", + "8.5.46", + "8.5.47", + "8.5.49", + "8.5.5", + "8.5.50", + "8.5.51", + "8.5.53", + "8.5.54", + "8.5.55", + "8.5.56", + "8.5.57", + "8.5.58", + "8.5.59", + "8.5.6", + "8.5.60", + "8.5.61", + "8.5.63", + "8.5.64", + "8.5.65", + "8.5.66", + "8.5.68", + "8.5.69", + "8.5.70", + "8.5.71", + "8.5.72", + "8.5.73", + "8.5.75", + "8.5.76", + "8.5.77", + "8.5.78", + "8.5.79", + "8.5.8", + "8.5.81", + "8.5.82", + "8.5.83", + "8.5.84", + "8.5.85", + "8.5.86", + "8.5.87", + "8.5.88", + "8.5.89", + "8.5.9", + "8.5.90", + "8.5.91", + "8.5.92", + "8.5.93", + "8.5.94", + "8.5.95", + "8.5.96", + "8.5.97", + "8.5.98", + "8.5.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + }, + { + "package": { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "last_affected": "7.0.109" + } + ] + } + ], + "versions": [ + "7.0.0", + "7.0.100", + "7.0.103", + "7.0.104", + "7.0.105", + "7.0.106", + "7.0.107", + "7.0.108", + "7.0.109", + "7.0.11", + "7.0.12", + "7.0.14", + "7.0.16", + "7.0.19", + "7.0.2", + "7.0.20", + "7.0.21", + "7.0.22", + "7.0.23", + "7.0.25", + "7.0.26", + "7.0.27", + "7.0.28", + "7.0.29", + "7.0.30", + "7.0.32", + "7.0.33", + "7.0.34", + "7.0.35", + "7.0.37", + "7.0.39", + "7.0.4", + "7.0.40", + "7.0.41", + "7.0.42", + "7.0.47", + "7.0.5", + "7.0.50", + "7.0.52", + "7.0.53", + "7.0.54", + "7.0.55", + "7.0.56", + "7.0.57", + "7.0.59", + "7.0.6", + "7.0.61", + "7.0.62", + "7.0.63", + "7.0.64", + "7.0.65", + "7.0.67", + "7.0.68", + "7.0.69", + "7.0.70", + "7.0.72", + "7.0.73", + "7.0.75", + "7.0.76", + "7.0.77", + "7.0.78", + "7.0.79", + "7.0.8", + "7.0.81", + "7.0.82", + "7.0.84", + "7.0.85", + "7.0.86", + "7.0.88", + "7.0.90", + "7.0.91", + "7.0.92", + "7.0.93", + "7.0.94", + "7.0.96", + "7.0.99" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json" + } + } + ], + "schema_version": "1.9.0", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ] + }, + { + "id": "GHSA-j92g-9f8w-j867", + "summary": "PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms", + "details": "### Impact\n\n`channelBinding=require` connections can be silently downgraded from `SCRAM-SHA-256-PLUS` (with channel binding) to plain `SCRAM-SHA-256` (without it), losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade with a certificate whose signature algorithm has no `tls-server-end-point` channel-binding hash. Examples are `Ed25519`, `Ed448`, and post-quantum algorithms.\n\nTwo issues combine in releases 42.7.4 through 42.7.11:\n\n1. The bundled `com.ongres.scram:scram-client` (3.1 or 3.2) returns an empty byte array instead of failing when it cannot derive the binding hash for such a certificate. This is the library issue tracked as [GHSA-p9jg-fcr6-3mhf](https://github.com/ongres/scram/security/advisories/GHSA-p9jg-fcr6-3mhf).\n2. pgJDBC does not enforce `channelBinding=require` where it matters. `ScramAuthenticator` checks only that the server *advertised* a `-PLUS` mechanism; it neither rejects the empty binding nor checks that the *negotiated* mechanism uses channel binding. The connection therefore downgrades silently, and would do so even against a fixed `scram-client`, because the missing enforcement is in pgJDBC's own code.\n\nOnly connections that set `channelBinding=require` are affected. Under the default `prefer` policy, and under `allow` or `disable`, falling back to plain SCRAM is the documented behaviour. Releases before 42.7.4 are unaffected, because they do not support channel binding.\n\n### Patches\n\nFixed in pgJDBC 42.7.12. pgJDBC now enforces channel binding in its own code, independently of the `scram-client` version:\n\n- Under `channelBinding=require`, it fails the connection when no channel-binding data can be extracted from the server certificate, instead of passing an empty value to the SCRAM client. The error names the certificate signature algorithm.\n- After negotiation, it requires the selected mechanism to use channel binding (a `-PLUS` mechanism) whenever `channelBinding=require` is set, regardless of how negotiation resolved.\n\nUpgrade to 42.7.12 or later.\n\n### Workarounds\n\nNo pgJDBC setting restores channel-binding enforcement on an affected release; upgrading is the fix.\n\nIf you cannot upgrade immediately, verify the server certificate at the TLS layer so that a man-in-the-middle cannot present a substitute certificate. Set `sslmode=verify-full` with a truststore that contains only your server's CA. This defence is independent of channel binding and blocks the same attacker. Connections that rely on `channelBinding=require` in place of certificate verification have no equivalent workaround and should upgrade.\n\n### References\n\n- [GHSA-p9jg-fcr6-3mhf](https://github.com/ongres/scram/security/advisories/GHSA-p9jg-fcr6-3mhf) \u2014 the related `com.ongres.scram:scram-client` issue (root cause of the empty channel-binding value).\n- `scram-client` 3.3 release (library fix): https://github.com/ongres/scram/releases/tag/3.3\n- pgJDBC fix in 42.7.12: [commit](https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99)", + "aliases": [ + "BIT-postgresql-jdbc-driver-2026-54291", + "CVE-2026-54291" + ], + "modified": "2026-09-10T03:50:12.377062079Z", + "published": "2026-07-21T17:47:39Z", + "database_specific": { + "github_reviewed_at": "2026-07-21T17:47:39Z", + "nvd_published_at": "2026-07-06T19:17:08Z", + "cwe_ids": [ + "CWE-636", + "CWE-757" + ], + "severity": "HIGH", + "github_reviewed": true + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54291" + }, + { + "type": "WEB", + "url": "https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99" + }, + { + "type": "WEB", + "url": "https://github.com/ongres/scram/releases/tag/3.3" + }, + { + "type": "PACKAGE", + "url": "https://github.com/pgjdbc/pgjdbc" + } + ], + "affected": [ + { + "package": { + "name": "org.postgresql:postgresql", + "ecosystem": "Maven", + "purl": "pkg:maven/org.postgresql/postgresql" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "42.7.4" + }, + { + "fixed": "42.7.12" + } + ] + } + ], + "versions": [ + "42.7.10", + "42.7.11", + "42.7.4", + "42.7.5", + "42.7.6", + "42.7.7", + "42.7.8", + "42.7.9" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-j92g-9f8w-j867/GHSA-j92g-9f8w-j867.json" + } + } + ], + "schema_version": "1.9.0", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N" + } + ] + }, + { + "id": "GHSA-mhm7-754m-9p8w", + "summary": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", + "details": "## Summary\n\nIn `BeanDeserializer.deserializeUsingPropertyBasedWithExternalTypeId`, the active-view (`@JsonView`) filter was applied only to the regular bean-property branch; the creator-property branch performed no `creatorProp.visibleInView(activeView)` check. A constructor parameter annotated with both `@JsonView(RestrictedView.class)` and `@JsonTypeInfo(use=Id.NAME,\n include=As.EXTERNAL_PROPERTY)` is populated from attacker JSON even when a more restrictive view is active.\n\n This is a patch gap. GHSA-5hh8 (CVE-2026-54517) and GHSA-rcqc (CVE-2026-54518) descriptions cover only the main property-based path and the unwrapped-creator path respectively; the external-type-id creator path was fixed on the 3.x line via #6004 (\"Extend #5969/#5971 fixes to ... external-type-id case in regular BeanDeserializer\", commit 7dc7a17, 2026-05-22) but\n **the fix was never backported to 2.21 or 2.18**. Users on 2.21.4 and 2.18.8 who upgraded per the published advisories remain vulnerable to the same `@JsonView` bypass technique via a different code path.\n\n## Vulnerable Code Path\n\nFile: `com/fasterxml/jackson/databind/deser/BeanDeserializer.java`\nMethod: `deserializeUsingPropertyBasedWithExternalTypeId`\n\nOn 2.21.4 (and 2.18.8), the creator-property branch (around line 1125-1158) checks `creatorProp.isInjectionOnly()` and hands off to `ext.handlePropertyValue(...)` / `buffer.assignParameter(...)` without ever consulting `visibleInView(activeView)`:\n\n ```java\n if (creatorProp != null) {\n // [databind#1381]: if useInput=FALSE, skip deserialization from input\n if (creatorProp.isInjectionOnly()) { ... }\n // NO visibleInView(activeView) CHECK HERE\n if (!ext.handlePropertyValue(p, ctxt, propName, null)) {\n if (buffer.assignParameter(creatorProp, ...)) { ... }\n }\n continue;\n }\n```\n\nOn 3.1.4, the same branch contains the additional guard (commit 7dc7a17):\n\n ```java\n if (creatorProp != null) {\n // [databind#5971]: must honor active view here too\n if ((activeView != null) && !creatorProp.visibleInView(activeView)) {\n p.skipChildren();\n continue;\n }\n ...\n }\n```\n\nThe 2.21 and 2.18 backport PRs (#6005 and #6003) only backported the main-path fixes from #5969/#5971; the external-type-id fix from #6004 was not backported. The maintainer closed #6005\n with \"got changes merged forward, looks like it's all covered now\", but the forward-merge did not include the ExtTypeId creator branch.\n\n Proof of Concept\n\n Compiles and runs against jackson-databind 2.21.4:\n \n```java\n import com.fasterxml.jackson.annotation.*;\n import com.fasterxml.jackson.databind.ObjectMapper;\n\n public class JsonViewExternalTypeIdBypass {\n public static class PublicView {}\n public static class AdminView extends PublicView {}\n\n public static abstract class Asset { public String name; }\n public static class PublicAsset extends Asset {}\n public static class AdminAsset extends Asset { public String secret; }\n\n public static class Container {\n @JsonTypeInfo(use = JsonTypeInfo.Id.NAME,\n include = JsonTypeInfo.As.EXTERNAL_PROPERTY,\n property = \"kind\")\n @JsonSubTypes({\n @JsonSubTypes.Type(value = PublicAsset.class, name = \"pub\"),\n @JsonSubTypes.Type(value = AdminAsset.class, name = \"admin\")\n })\n @JsonView(AdminView.class)\n public Asset asset;\n\n public String label;\n\n @JsonCreator\n public Container(\n @JsonProperty(\"label\") String label,\n @JsonProperty(\"asset\") @JsonView(AdminView.class) Asset asset) {\n this.label = label;\n this.asset = asset;\n }\n }\n\n public static class Wrapper {\n @JsonView(PublicView.class)\n public Container data;\n }\n\n public static void main(String[] args) throws Exception {\n // Admin-only \"asset\" should be blocked when reading with PublicView\n String json = \"{\\\"data\\\":{\\\"label\\\":\\\"hello\\\",\\\"kind\\\":\\\"admin\\\",\"\n + \"\\\"asset\\\":{\\\"name\\\":\\\"foo\\\",\\\"secret\\\":\\\"LEAKED\\\"}}}\";\n\n ObjectMapper om = new ObjectMapper();\n Wrapper r = om.readerWithView(PublicView.class)\n .forType(Wrapper.class)\n .readValue(json);\n\n System.out.println(r.data);\n // Actual on 2.21.4: Container{label='hello', asset=AdminAsset{name='foo', secret='LEAKED'}}\n // Expected (secure): Container{label='hello', asset=null}\n if (r.data.asset != null && r.data.asset instanceof AdminAsset) {\n System.out.println(\"[!!] BYPASS CONFIRMED \u2014 admin-only asset populated under PublicView\");\n }\n }\n }\n```\n\nA control case that removes include = As.EXTERNAL_PROPERTY (forcing the normal property-based path) correctly returns asset = null, confirming the bypass is specific to the ExternalTypeId\n code path and not a misconfiguration.\n\n### Impact\n\n View-restricted (e.g. admin-only) creator properties can be populated from untrusted input where @JsonView is used as a write-side authorization boundary. Typical victims are Spring Boot\n REST controllers that use @JsonView(PublicView.class) on the request body to whitelist user-settable fields \u2014 an attacker can inject the restricted creator parameter (including choosing\n the polymorphic subtype via the sibling kind/type-id property) by combining it with a polymorphic @JsonTypeInfo(EXTERNAL_PROPERTY) annotation on the same field.\n\n- CWE-863 (Incorrect Authorization)\n- Same impact class as CVE-2026-54517 / CVE-2026-54518\n- No RCE, no DoS \u2014 this is an access-control / mass-assignment bypass\n\n### Trigger Conditions\n\nDeveloper code must combine (no opt-in user configuration required):\n\n1. Property-based @JsonCreator on the outer type\n2. A creator parameter annotated with @JsonView(RestrictedView.class)\n3. The same parameter annotated with @JsonTypeInfo(use=Id.NAME, include=As.EXTERNAL_PROPERTY, property=\"...\")", + "modified": "2026-09-10T03:50:52.852212609Z", + "published": "2026-07-21T19:40:12Z", + "database_specific": { + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2026-07-21T19:40:12Z", + "nvd_published_at": null, + "cwe_ids": [ + "CWE-863" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w" + }, + { + "type": "WEB", + "url": "https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed" + }, + { + "type": "WEB", + "url": "https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c" + }, + { + "type": "PACKAGE", + "url": "https://github.com/FasterXML/jackson-databind" + } + ], + "affected": [ + { + "package": { + "name": "com.fasterxml.jackson.core:jackson-databind", + "ecosystem": "Maven", + "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.18.0" + }, + { + "fixed": "2.18.9" + } + ] + } + ], + "versions": [ + "2.18.0", + "2.18.1", + "2.18.2", + "2.18.3", + "2.18.4", + "2.18.5", + "2.18.6", + "2.18.7", + "2.18.8" + ], + "database_specific": { + "last_known_affected_version_range": "<= 2.18.8", + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mhm7-754m-9p8w/GHSA-mhm7-754m-9p8w.json" + } + }, + { + "package": { + "name": "com.fasterxml.jackson.core:jackson-databind", + "ecosystem": "Maven", + "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.21.0" + }, + { + "fixed": "2.21.5" + } + ] + } + ], + "versions": [ + "2.21.0", + "2.21.1", + "2.21.2", + "2.21.3", + "2.21.4" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mhm7-754m-9p8w/GHSA-mhm7-754m-9p8w.json", + "last_known_affected_version_range": "<= 2.21.4" + } + } + ], + "schema_version": "1.9.0", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ] + }, + { + "id": "GHSA-pmhh-3w7g-xqp8", + "summary": "jsoup: Cleaner may expose markup with custom raw-text elements", + "details": "When a custom `Safelist` permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization and potentially allowing XSS.\n\njsoup\u2019s built-in Safelists are unaffected.\n\n## Patches\n\nUpgrade to jsoup 1.23.1.\n\n## Workarounds\n\nUntil upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML.\n\n## Additional security considerations\n\nThis fix addresses malformed tag-name handling only.\n\nPermitting raw-text elements in a custom `Safelist` does not make their contents inherently safe. For example, applications that permit `style` must apply appropriate CSS safeguards separately, because jsoup does not parse or sanitize CSS.", + "aliases": [ + "CVE-2026-71497" + ], + "modified": "2026-09-10T03:50:53.809983880Z", + "published": "2026-08-06T21:09:36Z", + "database_specific": { + "github_reviewed_at": "2026-08-06T21:09:36Z", + "nvd_published_at": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true + }, + "references": [ + { + "type": "WEB", + "url": "https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8" + }, + { + "type": "WEB", + "url": "https://github.com/jhy/jsoup/issues/2538" + }, + { + "type": "WEB", + "url": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70" + }, + { + "type": "PACKAGE", + "url": "https://github.com/jhy/jsoup" + }, + { + "type": "WEB", + "url": "https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1" + } + ], + "affected": [ + { + "package": { + "name": "org.jsoup:jsoup", + "ecosystem": "Maven", + "purl": "pkg:maven/org.jsoup/jsoup" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.14.3" + }, + { + "fixed": "1.23.1" + } + ] + } + ], + "versions": [ + "1.14.3", + "1.15.1", + "1.15.2", + "1.15.3", + "1.15.4", + "1.16.1", + "1.16.2", + "1.17.1", + "1.17.2", + "1.18.1", + "1.18.2", + "1.18.3", + "1.19.1", + "1.20.1", + "1.21.1", + "1.21.2", + "1.22.1", + "1.22.2" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-pmhh-3w7g-xqp8/GHSA-pmhh-3w7g-xqp8.json" + } + } + ], + "schema_version": "1.9.0", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ] + }, + { + "id": "GHSA-qv9r-c865-cp47", + "summary": "Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization", + "details": "Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.\n\nThe fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.\n\nThe defect is reachable only when both of the following conditions hold:\n\n * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{\"JSON\"}).\n * The application logs a MapMessage that contains an attacker-controlled floating-point value.\n\n\nAn attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.\n\nUsers are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.", + "aliases": [ + "CVE-2026-49844" + ], + "modified": "2026-09-10T03:50:52.972700022Z", + "published": "2026-07-11T00:31:48Z", + "database_specific": { + "github_reviewed_at": "2026-08-13T18:28:30Z", + "nvd_published_at": "2026-07-10T22:16:42Z", + "cwe_ids": [ + "CWE-116" + ], + "severity": "MODERATE", + "github_reviewed": true + }, + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49844" + }, + { + "type": "WEB", + "url": "https://github.com/apache/logging-log4j2/pull/4163" + }, + { + "type": "WEB", + "url": "https://github.com/apache/logging-log4j2/commit/19edb23e162d6c728a8c2221a240037d389ed300" + }, + { + "type": "WEB", + "url": "https://github.com/apache/logging-log4j2/commit/feadf8eb0b4acb6ddfa4c0ab2bbc6d88b8e12d82" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apache/logging-log4j2" + }, + { + "type": "WEB", + "url": "https://github.com/apache/logging-log4j2/releases/tag/rel/2.25.5" + }, + { + "type": "WEB", + "url": "https://github.com/apache/logging-log4j2/releases/tag/rel/2.26.1" + }, + { + "type": "WEB", + "url": "https://logging.apache.org/cyclonedx/vdr.xml" + }, + { + "type": "WEB", + "url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message" + }, + { + "type": "WEB", + "url": "https://logging.apache.org/security.html#CVE-2026-49844" + } + ], + "affected": [ + { + "package": { + "name": "org.apache.logging.log4j:log4j-api", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.logging.log4j/log4j-api" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.13.1" + }, + { + "fixed": "2.25.5" + } + ] + } + ], + "versions": [ + "2.13.1", + "2.13.2", + "2.13.3", + "2.14.0", + "2.14.1", + "2.15.0", + "2.16.0", + "2.17.0", + "2.17.1", + "2.17.2", + "2.18.0", + "2.19.0", + "2.20.0", + "2.21.0", + "2.21.1", + "2.22.0", + "2.22.1", + "2.23.0", + "2.23.1", + "2.24.0", + "2.24.1", + "2.24.2", + "2.24.3", + "2.25.0", + "2.25.1", + "2.25.2", + "2.25.3", + "2.25.4" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-qv9r-c865-cp47/GHSA-qv9r-c865-cp47.json" + } + }, + { + "package": { + "name": "org.apache.logging.log4j:log4j-api", + "ecosystem": "Maven", + "purl": "pkg:maven/org.apache.logging.log4j/log4j-api" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.26.0" + }, + { + "fixed": "2.26.1" + } + ] + } + ], + "versions": [ + "2.26.0" + ], + "database_specific": { + "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-qv9r-c865-cp47/GHSA-qv9r-c865-cp47.json" + } + } + ], + "schema_version": "1.9.0", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N" + } + ] + } +] \ No newline at end of file diff --git a/.atp/work-session/20260922-114058/artifacts/latest-osv-results.json b/.atp/work-session/20260922-114058/artifacts/latest-osv-results.json new file mode 100644 index 0000000..5bd0452 --- /dev/null +++ b/.atp/work-session/20260922-114058/artifacts/latest-osv-results.json @@ -0,0 +1,624 @@ +{ + "checked_at": "2026-09-22T02:53:22.121058+00:00", + "source": "https://api.osv.dev/v1/querybatch", + "packages": [ + { + "name": "org.springframework.boot:spring-boot-starter-web", + "version": "3.5.16", + "scope": "compile", + "in_war": false, + "result": {} + }, + { + "name": "org.springframework.boot:spring-boot-starter", + "version": "3.5.16", + "scope": "compile", + "in_war": false, + "result": {} + }, + { + "name": "org.springframework.boot:spring-boot", + "version": "3.5.16", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework.boot:spring-boot-autoconfigure", + "version": "3.5.16", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework.boot:spring-boot-starter-logging", + "version": "3.5.16", + "scope": "compile", + "in_war": false, + "result": {} + }, + { + "name": "ch.qos.logback:logback-classic", + "version": "1.5.34", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "ch.qos.logback:logback-core", + "version": "1.5.34", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.apache.logging.log4j:log4j-to-slf4j", + "version": "2.24.3", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.apache.logging.log4j:log4j-api", + "version": "2.24.3", + "scope": "compile", + "in_war": true, + "result": { + "vulns": [ + { + "id": "GHSA-qv9r-c865-cp47", + "modified": "2026-09-10T03:50:52.972700Z" + } + ] + } + }, + { + "name": "org.slf4j:jul-to-slf4j", + "version": "2.0.18", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.yaml:snakeyaml", + "version": "2.4", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework.boot:spring-boot-starter-json", + "version": "3.5.16", + "scope": "compile", + "in_war": false, + "result": {} + }, + { + "name": "com.fasterxml.jackson.core:jackson-databind", + "version": "2.21.4", + "scope": "compile", + "in_war": true, + "result": { + "vulns": [ + { + "id": "GHSA-5gvw-p9qm-jgwh", + "modified": "2026-09-10T03:51:10.658074Z" + }, + { + "id": "GHSA-5jmj-h7xm-6q6v", + "modified": "2026-09-10T03:51:08.069993Z" + }, + { + "id": "GHSA-mhm7-754m-9p8w", + "modified": "2026-09-10T03:50:52.852212Z" + } + ] + } + }, + { + "name": "com.fasterxml.jackson.core:jackson-annotations", + "version": "2.21", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "com.fasterxml.jackson.core:jackson-core", + "version": "2.21.4", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "com.fasterxml.jackson.datatype:jackson-datatype-jdk8", + "version": "2.21.4", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "com.fasterxml.jackson.datatype:jackson-datatype-jsr310", + "version": "2.21.4", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "com.fasterxml.jackson.module:jackson-module-parameter-names", + "version": "2.21.4", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework:spring-web", + "version": "6.2.19", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework:spring-beans", + "version": "6.2.19", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "io.micrometer:micrometer-observation", + "version": "1.15.12", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "io.micrometer:micrometer-commons", + "version": "1.15.12", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework:spring-webmvc", + "version": "6.2.19", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework:spring-aop", + "version": "6.2.19", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework:spring-context", + "version": "6.2.19", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework:spring-expression", + "version": "6.2.19", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.mybatis.spring.boot:mybatis-spring-boot-starter", + "version": "3.0.5", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework.boot:spring-boot-starter-jdbc", + "version": "3.5.16", + "scope": "compile", + "in_war": false, + "result": {} + }, + { + "name": "com.zaxxer:HikariCP", + "version": "6.3.3", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework:spring-jdbc", + "version": "6.2.19", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework:spring-tx", + "version": "6.2.19", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.mybatis.spring.boot:mybatis-spring-boot-autoconfigure", + "version": "3.0.5", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.mybatis:mybatis", + "version": "3.5.19", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.mybatis:mybatis-spring", + "version": "3.0.5", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.postgresql:postgresql", + "version": "42.7.11", + "scope": "runtime", + "in_war": true, + "result": { + "vulns": [ + { + "id": "GHSA-j92g-9f8w-j867", + "modified": "2026-09-10T03:50:12.377062Z" + } + ] + } + }, + { + "name": "org.apache.tomcat.embed:tomcat-embed-jasper", + "version": "10.1.55", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.apache.tomcat.embed:tomcat-embed-core", + "version": "10.1.55", + "scope": "compile", + "in_war": true, + "result": { + "vulns": [ + { + "id": "GHSA-9xv2-5v5q-p794", + "modified": "2026-09-11T08:25:52.825871Z" + }, + { + "id": "GHSA-gcx9-497g-6cp6", + "modified": "2026-09-11T08:25:41.300012Z" + }, + { + "id": "GHSA-h3x4-894j-xpx5", + "modified": "2026-09-11T08:25:40.118635Z" + } + ] + } + }, + { + "name": "org.apache.tomcat:tomcat-annotations-api", + "version": "10.1.55", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.apache.tomcat.embed:tomcat-embed-el", + "version": "10.1.55", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.eclipse.jdt:ecj", + "version": "3.33.0", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.projectlombok:lombok", + "version": "1.18.46", + "scope": "compile", + "in_war": false, + "result": {} + }, + { + "name": "org.springframework.boot:spring-boot-starter-tomcat", + "version": "3.5.16", + "scope": "provided", + "in_war": false, + "result": {} + }, + { + "name": "jakarta.annotation:jakarta.annotation-api", + "version": "2.1.1", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.apache.tomcat.embed:tomcat-embed-websocket", + "version": "10.1.55", + "scope": "provided", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework.boot:spring-boot-starter-test", + "version": "3.5.16", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.springframework.boot:spring-boot-test", + "version": "3.5.16", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.springframework.boot:spring-boot-test-autoconfigure", + "version": "3.5.16", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "com.jayway.jsonpath:json-path", + "version": "2.9.0", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.slf4j:slf4j-api", + "version": "2.0.18", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "jakarta.xml.bind:jakarta.xml.bind-api", + "version": "4.0.5", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "jakarta.activation:jakarta.activation-api", + "version": "2.1.4", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "net.minidev:json-smart", + "version": "2.5.2", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "net.minidev:accessors-smart", + "version": "2.5.2", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.ow2.asm:asm", + "version": "9.7.1", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.assertj:assertj-core", + "version": "3.27.7", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "net.bytebuddy:byte-buddy", + "version": "1.17.8", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.awaitility:awaitility", + "version": "4.2.2", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.hamcrest:hamcrest", + "version": "3.0", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.junit.jupiter:junit-jupiter", + "version": "5.12.2", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.junit.jupiter:junit-jupiter-api", + "version": "5.12.2", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.opentest4j:opentest4j", + "version": "1.3.0", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.junit.platform:junit-platform-commons", + "version": "1.12.2", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.apiguardian:apiguardian-api", + "version": "1.1.2", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.junit.jupiter:junit-jupiter-params", + "version": "5.12.2", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.junit.jupiter:junit-jupiter-engine", + "version": "5.12.2", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.junit.platform:junit-platform-engine", + "version": "1.12.2", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.mockito:mockito-core", + "version": "5.17.0", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "net.bytebuddy:byte-buddy-agent", + "version": "1.17.8", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.objenesis:objenesis", + "version": "3.3", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.mockito:mockito-junit-jupiter", + "version": "5.17.0", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.skyscreamer:jsonassert", + "version": "1.5.3", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "com.vaadin.external.google:android-json", + "version": "0.0.20131108.vaadin1", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.springframework:spring-core", + "version": "6.2.19", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework:spring-jcl", + "version": "6.2.19", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework:spring-test", + "version": "6.2.19", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.xmlunit:xmlunit-core", + "version": "2.10.4", + "scope": "test", + "in_war": false, + "result": {} + }, + { + "name": "org.commonmark:commonmark", + "version": "0.22.0", + "scope": "compile", + "in_war": true, + "result": {} + }, + { + "name": "org.jsoup:jsoup", + "version": "1.17.2", + "scope": "compile", + "in_war": true, + "result": { + "vulns": [ + { + "id": "GHSA-pmhh-3w7g-xqp8", + "modified": "2026-09-10T03:50:53.809983Z" + } + ] + } + }, + { + "name": "ognl:ognl", + "version": "3.4.4", + "scope": "shaded", + "in_war": true, + "result": {} + }, + { + "name": "org.javassist:javassist", + "version": "3.30.2-GA", + "scope": "shaded", + "in_war": true, + "result": {} + }, + { + "name": "org.springframework.boot:spring-boot-jarmode-tools", + "version": "3.5.16", + "scope": "packaged-tool", + "in_war": true, + "result": {} + } + ] +} \ No newline at end of file diff --git a/.atp/work-session/20260922-114058/artifacts/nvd-bulk-first-attempt.log b/.atp/work-session/20260922-114058/artifacts/nvd-bulk-first-attempt.log new file mode 100644 index 0000000..ab67bf2 --- /dev/null +++ b/.atp/work-session/20260922-114058/artifacts/nvd-bulk-first-attempt.log @@ -0,0 +1,503 @@ +[INFO] Scanning for projects... +[INFO] +[INFO] ----------------------< com.pandoli365:bibimbap >----------------------- +[INFO] Building bibimbap 0.0.1-SNAPSHOT +[INFO] from pom.xml +[INFO] --------------------------------[ war ]--------------------------------- +[INFO] +[INFO] --- dependency-check:12.2.2:check (default-cli) @ bibimbap --- +[INFO] Checking for updates +[WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 2nd time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 3rd time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 4th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 5th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 6th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 7th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 8th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 9th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 10th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 11th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 12th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 13th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 14th time +[WARNING] NVD API request failures are occurring; retrying request for the 15th time +[WARNING] NVD API request failures are occurring; retrying request for the 16th time +[WARNING] NVD API request failures are occurring; retrying request for the 17th time +[WARNING] NVD API request failures are occurring; retrying request for the 18th time +[WARNING] NVD API request failures are occurring; retrying request for the 19th time +[WARNING] NVD API request failures are occurring; retrying request for the 20th time +[WARNING] NVD API request failures are occurring; retrying request for the 21st time +[WARNING] NVD API request failures are occurring; retrying request for the 22nd time +[WARNING] NVD API request failures are occurring; retrying request for the 23rd time +[WARNING] NVD API request failures are occurring; retrying request for the 24th time +[WARNING] NVD API request failures are occurring; retrying request for the 25th time +[WARNING] NVD API request failures are occurring; retrying request for the 26th time +[WARNING] NVD API request failures are occurring; retrying request for the 27th time +[WARNING] NVD API request failures are occurring; retrying request for the 28th time +[WARNING] NVD API request failures are occurring; retrying request for the 29th time +[WARNING] NVD API request failures are occurring; retrying request for the 30th time +[WARNING] NVD API request failures are occurring; retrying request for the 31st time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 2nd time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 3rd time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 4th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 5th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 6th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 7th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 8th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 9th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 10th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 11th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 12th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 13th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 14th time +[WARNING] NVD API request failures are occurring; retrying request for the 15th time +[WARNING] NVD API request failures are occurring; retrying request for the 16th time +[WARNING] NVD API request failures are occurring; retrying request for the 17th time +[WARNING] NVD API request failures are occurring; retrying request for the 18th time +[WARNING] NVD API request failures are occurring; retrying request for the 19th time +[WARNING] NVD API request failures are occurring; retrying request for the 20th time +[WARNING] NVD API request failures are occurring; retrying request for the 21st time +[WARNING] NVD API request failures are occurring; retrying request for the 22nd time +[WARNING] NVD API request failures are occurring; retrying request for the 23rd time +[WARNING] NVD API request failures are occurring; retrying request for the 24th time +[WARNING] NVD API request failures are occurring; retrying request for the 25th time +[WARNING] NVD API request failures are occurring; retrying request for the 26th time +[WARNING] NVD API request failures are occurring; retrying request for the 27th time +[WARNING] NVD API request failures are occurring; retrying request for the 28th time +[WARNING] NVD API request failures are occurring; retrying request for the 29th time +[WARNING] NVD API request failures are occurring; retrying request for the 30th time +[WARNING] NVD API request failures are occurring; retrying request for the 31st time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 2nd time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 3rd time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 4th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 5th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 6th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 7th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 8th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 9th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 10th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 11th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 12th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 13th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 14th time +[WARNING] NVD API request failures are occurring; retrying request for the 15th time +[WARNING] NVD API request failures are occurring; retrying request for the 16th time +[WARNING] NVD API request failures are occurring; retrying request for the 17th time +[WARNING] NVD API request failures are occurring; retrying request for the 18th time +[WARNING] NVD API request failures are occurring; retrying request for the 19th time +[WARNING] NVD API request failures are occurring; retrying request for the 20th time +[WARNING] NVD API request failures are occurring; retrying request for the 21st time +[WARNING] NVD API request failures are occurring; retrying request for the 22nd time +[WARNING] NVD API request failures are occurring; retrying request for the 23rd time +[WARNING] NVD API request failures are occurring; retrying request for the 24th time +[WARNING] NVD API request failures are occurring; retrying request for the 25th time +[WARNING] NVD API request failures are occurring; retrying request for the 26th time +[WARNING] NVD API request failures are occurring; retrying request for the 27th time +[WARNING] NVD API request failures are occurring; retrying request for the 28th time +[WARNING] NVD API request failures are occurring; retrying request for the 29th time +[WARNING] NVD API request failures are occurring; retrying request for the 30th time +[WARNING] NVD API request failures are occurring; retrying request for the 31st time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 2nd time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 3rd time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 4th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 5th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 6th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 7th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 8th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 9th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 10th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 11th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 12th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 13th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 14th time +[WARNING] NVD API request failures are occurring; retrying request for the 15th time +[WARNING] NVD API request failures are occurring; retrying request for the 16th time +[WARNING] NVD API request failures are occurring; retrying request for the 17th time +[WARNING] NVD API request failures are occurring; retrying request for the 18th time +[WARNING] NVD API request failures are occurring; retrying request for the 19th time +[WARNING] NVD API request failures are occurring; retrying request for the 20th time +[WARNING] NVD API request failures are occurring; retrying request for the 21st time +[WARNING] NVD API request failures are occurring; retrying request for the 22nd time +[WARNING] NVD API request failures are occurring; retrying request for the 23rd time +[WARNING] NVD API request failures are occurring; retrying request for the 24th time +[WARNING] NVD API request failures are occurring; retrying request for the 25th time +[WARNING] NVD API request failures are occurring; retrying request for the 26th time +[WARNING] NVD API request failures are occurring; retrying request for the 27th time +[WARNING] NVD API request failures are occurring; retrying request for the 28th time +[WARNING] NVD API request failures are occurring; retrying request for the 29th time +[WARNING] NVD API request failures are occurring; retrying request for the 30th time +[WARNING] NVD API request failures are occurring; retrying request for the 31st time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 2nd time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 3rd time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 4th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 5th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 6th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 7th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 8th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 9th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 10th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 11th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 12th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 13th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 14th time +[WARNING] NVD API request failures are occurring; retrying request for the 15th time +[WARNING] NVD API request failures are occurring; retrying request for the 16th time +[WARNING] NVD API request failures are occurring; retrying request for the 17th time +[WARNING] NVD API request failures are occurring; retrying request for the 18th time +[WARNING] NVD API request failures are occurring; retrying request for the 19th time +[WARNING] NVD API request failures are occurring; retrying request for the 20th time +[WARNING] NVD API request failures are occurring; retrying request for the 21st time +[WARNING] NVD API request failures are occurring; retrying request for the 22nd time +[WARNING] NVD API request failures are occurring; retrying request for the 23rd time +[WARNING] NVD API request failures are occurring; retrying request for the 24th time +[WARNING] NVD API request failures are occurring; retrying request for the 25th time +[WARNING] NVD API request failures are occurring; retrying request for the 26th time +[WARNING] NVD API request failures are occurring; retrying request for the 27th time +[WARNING] NVD API request failures are occurring; retrying request for the 28th time +[WARNING] NVD API request failures are occurring; retrying request for the 29th time +[WARNING] NVD API request failures are occurring; retrying request for the 30th time +[WARNING] NVD API request failures are occurring; retrying request for the 31st time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 2nd time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 3rd time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 4th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 5th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 6th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 7th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 8th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 9th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 10th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 11th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 12th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 13th time +[WARNING] Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : 14th time +[WARNING] NVD API request failures are occurring; retrying request for the 15th time +[WARNING] NVD API request failures are occurring; retrying request for the 16th time +[WARNING] NVD API request failures are occurring; retrying request for the 17th time +[WARNING] NVD API request failures are occurring; retrying request for the 18th time +[WARNING] NVD API request failures are occurring; retrying request for the 19th time +[WARNING] NVD API request failures are occurring; retrying request for the 20th time +[WARNING] NVD API request failures are occurring; retrying request for the 21st time +[WARNING] NVD API request failures are occurring; retrying request for the 22nd time +[WARNING] NVD API request failures are occurring; retrying request for the 23rd time +[WARNING] NVD API request failures are occurring; retrying request for the 24th time +[WARNING] NVD API request failures are occurring; retrying request for the 25th time +[WARNING] NVD API request failures are occurring; retrying request for the 26th time +[WARNING] NVD API request failures are occurring; retrying request for the 27th time +[WARNING] NVD API request failures are occurring; retrying request for the 28th time +[WARNING] NVD API request failures are occurring; retrying request for the 29th time +[WARNING] NVD API request failures are occurring; retrying request for the 30th time +[WARNING] NVD API request failures are occurring; retrying request for the 31st time +[ERROR] Error updating the NVD Data +org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data + at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:387) + at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128) + at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887) + at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692) + at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291) + at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174) + at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75) + at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162) + at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73) + at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53) + at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173) + at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101) + at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919) + at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285) + at org.apache.maven.cli.MavenCli.main (MavenCli.java:207) + at jdk.internal.reflect.DirectMethodHandleAccessor.invoke (DirectMethodHandleAccessor.java:103) + at java.lang.reflect.Method.invoke (Method.java:580) + at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255) + at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201) + at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362) + at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314) +Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiRetryExceededException: NVD Update Failed: attempted to retrieve data from the NVD unsuccessfully five times. + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:361) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:456) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:456) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:456) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:456) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:456) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:456) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:356) + at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:343) + at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128) + at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887) + at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692) + at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291) + at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174) + at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75) + at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162) + at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73) + at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53) + at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173) + at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101) + at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919) + at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285) + at org.apache.maven.cli.MavenCli.main (MavenCli.java:207) + at jdk.internal.reflect.DirectMethodHandleAccessor.invoke (DirectMethodHandleAccessor.java:103) + at java.lang.reflect.Method.invoke (Method.java:580) + at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255) + at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201) + at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362) + at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314) +[WARNING] Failed to update hosted suppressions file, results may contain false positives already resolved by the DependencyCheck project +org.owasp.dependencycheck.data.update.exception.UpdateException: Failed to update the hosted suppressions file + at org.owasp.dependencycheck.data.update.HostedSuppressionsDataSource.fetchHostedSuppressions (HostedSuppressionsDataSource.java:137) + at org.owasp.dependencycheck.data.update.HostedSuppressionsDataSource.update (HostedSuppressionsDataSource.java:78) + at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887) + at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692) + at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291) + at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174) + at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75) + at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162) + at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73) + at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53) + at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173) + at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101) + at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919) + at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285) + at org.apache.maven.cli.MavenCli.main (MavenCli.java:207) + at jdk.internal.reflect.DirectMethodHandleAccessor.invoke (DirectMethodHandleAccessor.java:103) + at java.lang.reflect.Method.invoke (Method.java:580) + at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255) + at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201) + at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362) + at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314) +Caused by: org.owasp.dependencycheck.utils.DownloadFailedException: Download failed, unable to copy 'https://dependency-check.github.io/DependencyCheck/suppressions/publishedSuppressions.xml' to '/root/.m2/repository/org/owasp/dependency-check-utils/12.2.2/../../dependency-check-data/11.0/publishedSuppressions.xml'; Network is unreachable + at org.owasp.dependencycheck.utils.Downloader.fetchFile (Downloader.java:425) + at org.owasp.dependencycheck.utils.Downloader.fetchFile (Downloader.java:384) + at org.owasp.dependencycheck.data.update.HostedSuppressionsDataSource.fetchHostedSuppressions (HostedSuppressionsDataSource.java:135) + at org.owasp.dependencycheck.data.update.HostedSuppressionsDataSource.update (HostedSuppressionsDataSource.java:78) + at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887) + at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692) + at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291) + at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174) + at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75) + at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162) + at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73) + at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53) + at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173) + at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101) + at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919) + at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285) + at org.apache.maven.cli.MavenCli.main (MavenCli.java:207) + at jdk.internal.reflect.DirectMethodHandleAccessor.invoke (DirectMethodHandleAccessor.java:103) + at java.lang.reflect.Method.invoke (Method.java:580) + at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255) + at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201) + at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362) + at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314) +Caused by: java.net.SocketException: Network is unreachable + at sun.nio.ch.Net.connect0 (Native Method) + at sun.nio.ch.Net.connect (Net.java:601) + at sun.nio.ch.Net.connect (Net.java:590) + at sun.nio.ch.NioSocketImpl.connect (NioSocketImpl.java:583) + at java.net.SocksSocketImpl.connect (SocksSocketImpl.java:327) + at java.net.Socket.connect (Socket.java:751) + at org.apache.hc.client5.http.impl.io.DefaultHttpClientConnectionOperator.connect (DefaultHttpClientConnectionOperator.java:219) + at org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager.connect (PoolingHttpClientConnectionManager.java:547) + at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint (InternalExecRuntime.java:164) + at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint (InternalExecRuntime.java:174) + at org.apache.hc.client5.http.impl.classic.ConnectExec.execute (ConnectExec.java:144) + at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute (ExecChainElement.java:51) + at org.apache.hc.client5.http.impl.classic.ProtocolExec.execute (ProtocolExec.java:192) + at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute (ExecChainElement.java:51) + at org.apache.hc.client5.http.impl.classic.ContentCompressionExec.execute (ContentCompressionExec.java:138) + at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute (ExecChainElement.java:51) + at org.apache.hc.client5.http.impl.classic.HttpRequestRetryExec.execute (HttpRequestRetryExec.java:112) + at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute (ExecChainElement.java:51) + at org.apache.hc.client5.http.impl.classic.RedirectExec.execute (RedirectExec.java:110) + at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute (ExecChainElement.java:51) + at org.apache.hc.client5.http.impl.classic.InternalHttpClient.doExecute (InternalHttpClient.java:185) + at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute (CloseableHttpClient.java:245) + at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute (CloseableHttpClient.java:188) + at org.owasp.dependencycheck.utils.Downloader.fetchFile (Downloader.java:410) + at org.owasp.dependencycheck.utils.Downloader.fetchFile (Downloader.java:384) + at org.owasp.dependencycheck.data.update.HostedSuppressionsDataSource.fetchHostedSuppressions (HostedSuppressionsDataSource.java:135) + at org.owasp.dependencycheck.data.update.HostedSuppressionsDataSource.update (HostedSuppressionsDataSource.java:78) + at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887) + at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692) + at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291) + at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174) + at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75) + at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162) + at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73) + at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53) + at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173) + at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101) + at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919) + at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285) + at org.apache.maven.cli.MavenCli.main (MavenCli.java:207) + at jdk.internal.reflect.DirectMethodHandleAccessor.invoke (DirectMethodHandleAccessor.java:103) + at java.lang.reflect.Method.invoke (Method.java:580) + at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255) + at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201) + at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362) + at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314) +[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json +[ERROR] java.net.SocketException: Network is unreachable +org.owasp.dependencycheck.data.update.exception.UpdateException: java.net.SocketException: Network is unreachable + at org.owasp.dependencycheck.data.update.KnownExploitedDataSource.update (KnownExploitedDataSource.java:106) + at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887) + at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692) + at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291) + at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174) + at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75) + at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162) + at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73) + at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53) + at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173) + at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101) + at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919) + at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285) + at org.apache.maven.cli.MavenCli.main (MavenCli.java:207) + at jdk.internal.reflect.DirectMethodHandleAccessor.invoke (DirectMethodHandleAccessor.java:103) + at java.lang.reflect.Method.invoke (Method.java:580) + at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255) + at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201) + at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362) + at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314) +Caused by: java.net.SocketException: Network is unreachable + at sun.nio.ch.Net.connect0 (Native Method) + at sun.nio.ch.Net.connect (Net.java:601) + at sun.nio.ch.Net.connect (Net.java:590) + at sun.nio.ch.NioSocketImpl.connect (NioSocketImpl.java:583) + at java.net.SocksSocketImpl.connect (SocksSocketImpl.java:327) + at java.net.Socket.connect (Socket.java:751) + at org.apache.hc.client5.http.impl.io.DefaultHttpClientConnectionOperator.connect (DefaultHttpClientConnectionOperator.java:219) + at org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager.connect (PoolingHttpClientConnectionManager.java:547) + at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint (InternalExecRuntime.java:164) + at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint (InternalExecRuntime.java:174) + at org.apache.hc.client5.http.impl.classic.ConnectExec.execute (ConnectExec.java:144) + at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute (ExecChainElement.java:51) + at org.apache.hc.client5.http.impl.classic.ProtocolExec.execute (ProtocolExec.java:192) + at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute (ExecChainElement.java:51) + at org.apache.hc.client5.http.impl.classic.ContentCompressionExec.execute (ContentCompressionExec.java:138) + at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute (ExecChainElement.java:51) + at org.apache.hc.client5.http.impl.classic.HttpRequestRetryExec.execute (HttpRequestRetryExec.java:112) + at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute (ExecChainElement.java:51) + at org.apache.hc.client5.http.impl.classic.RedirectExec.execute (RedirectExec.java:110) + at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute (ExecChainElement.java:51) + at org.apache.hc.client5.http.impl.classic.InternalHttpClient.doExecute (InternalHttpClient.java:185) + at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute (CloseableHttpClient.java:245) + at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute (CloseableHttpClient.java:188) + at org.owasp.dependencycheck.utils.Downloader.fetchAndHandle (Downloader.java:732) + at org.owasp.dependencycheck.utils.Downloader.fetchAndHandle (Downloader.java:701) + at org.owasp.dependencycheck.utils.Downloader.fetchAndHandle (Downloader.java:653) + at org.owasp.dependencycheck.data.update.KnownExploitedDataSource.update (KnownExploitedDataSource.java:96) + at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887) + at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692) + at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291) + at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174) + at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75) + at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162) + at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73) + at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53) + at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173) + at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101) + at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919) + at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285) + at org.apache.maven.cli.MavenCli.main (MavenCli.java:207) + at jdk.internal.reflect.DirectMethodHandleAccessor.invoke (DirectMethodHandleAccessor.java:103) + at java.lang.reflect.Method.invoke (Method.java:580) + at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255) + at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201) + at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362) + at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314) +[WARNING] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities. +[ERROR] Unable to continue dependency-check analysis. +[INFO] ------------------------------------------------------------------------ +[INFO] BUILD FAILURE +[INFO] ------------------------------------------------------------------------ +[INFO] Total time: 01:33 min +[INFO] Finished at: 2026-09-22T02:53:12Z +[INFO] ------------------------------------------------------------------------ +[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default-cli) on project bibimbap: Fatal exception(s) analyzing bibimbap: One or more exceptions occurred during analysis: +[ERROR] UpdateException: java.net.SocketException: Network is unreachable +[ERROR] caused by SocketException: Network is unreachable +[ERROR] NoDataException: No documents exist +[ERROR] -> [Help 1] +[ERROR] +[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch. +[ERROR] Re-run Maven using the -X switch to enable full debug logging. +[ERROR] +[ERROR] For more information about the errors and possible solutions, please read the following articles: +[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException diff --git a/.atp/work-session/20260922-114058/artifacts/nvd-bulk-trusted-attempt.log b/.atp/work-session/20260922-114058/artifacts/nvd-bulk-trusted-attempt.log new file mode 100644 index 0000000..5c16d6e --- /dev/null +++ b/.atp/work-session/20260922-114058/artifacts/nvd-bulk-trusted-attempt.log @@ -0,0 +1,99 @@ +[INFO] Scanning for projects... +[INFO] +[INFO] ----------------------< com.pandoli365:bibimbap >----------------------- +[INFO] Building bibimbap 0.0.1-SNAPSHOT +[INFO] from pom.xml +[INFO] --------------------------------[ war ]--------------------------------- +[INFO] +[INFO] --- dependency-check:12.2.2:check (default-cli) @ bibimbap --- +[INFO] Checking for updates +[WARNING] An NVD API Key was not provided - it is highly recommended to use an NVD API key as the update can take a VERY long time without an API Key +[INFO] NVD API has 395,957 records in this update +[ERROR] Error updating the NVD Data +org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data + at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:387) + at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128) + at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887) + at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692) + at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291) + at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174) + at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75) + at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162) + at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73) + at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53) + at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173) + at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101) + at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919) + at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285) + at org.apache.maven.cli.MavenCli.main (MavenCli.java:207) + at jdk.internal.reflect.DirectMethodHandleAccessor.invoke (DirectMethodHandleAccessor.java:103) + at java.lang.reflect.Method.invoke (Method.java:580) + at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255) + at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201) + at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362) + at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314) +Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiRetryExceededException: NVD Update Failed: attempted to retrieve data from the NVD unsuccessfully five times. + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:361) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:456) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:456) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:456) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:456) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:456) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next (NvdCveClient.java:456) + at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next (NvdCveClient.java:356) + at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi (NvdApiDataSource.java:343) + at org.owasp.dependencycheck.data.update.NvdApiDataSource.update (NvdApiDataSource.java:128) + at org.owasp.dependencycheck.Engine.doUpdates (Engine.java:887) + at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase (Engine.java:692) + at org.owasp.dependencycheck.Engine.analyzeDependencies (Engine.java:619) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.runCheck (BaseDependencyCheckMojo.java:2093) + at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute (BaseDependencyCheckMojo.java:1291) + at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328) + at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174) + at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75) + at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162) + at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39) + at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105) + at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73) + at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53) + at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261) + at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173) + at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101) + at org.apache.maven.cli.MavenCli.execute (MavenCli.java:919) + at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:285) + at org.apache.maven.cli.MavenCli.main (MavenCli.java:207) + at jdk.internal.reflect.DirectMethodHandleAccessor.invoke (DirectMethodHandleAccessor.java:103) + at java.lang.reflect.Method.invoke (Method.java:580) + at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:255) + at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:201) + at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:362) + at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:314) +[INFO] ------------------------------------------------------------------------ +[INFO] BUILD FAILURE +[INFO] ------------------------------------------------------------------------ +[INFO] Total time: 02:46 min +[INFO] Finished at: 2026-09-22T02:56:40Z +[INFO] ------------------------------------------------------------------------ +[ERROR] Failed to execute goal org.owasp:dependency-check-maven:12.2.2:check (default-cli) on project bibimbap: Execution default-cli of goal org.owasp:dependency-check-maven:12.2.2:check failed: Shutdown in progress -> [Help 1] +[ERROR] +[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch. +[ERROR] Re-run Maven using the -X switch to enable full debug logging. +[ERROR] +[ERROR] For more information about the errors and possible solutions, please read the following articles: +[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/PluginExecutionException diff --git a/.atp/work-session/20260922-114058/artifacts/war-inventory.json b/.atp/work-session/20260922-114058/artifacts/war-inventory.json new file mode 100644 index 0000000..6ebd0f5 --- /dev/null +++ b/.atp/work-session/20260922-114058/artifacts/war-inventory.json @@ -0,0 +1,218 @@ +[ + { + "jar": "WEB-INF/lib/commonmark-0.22.0.jar", + "coordinates": [ + "org.commonmark:commonmark:0.22.0" + ] + }, + { + "jar": "WEB-INF/lib/micrometer-commons-1.15.12.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/log4j-to-slf4j-2.24.3.jar", + "coordinates": [ + "org.apache.logging.log4j:log4j-to-slf4j:2.24.3" + ] + }, + { + "jar": "WEB-INF/lib/HikariCP-6.3.3.jar", + "coordinates": [ + "com.zaxxer:HikariCP:6.3.3" + ] + }, + { + "jar": "WEB-INF/lib/log4j-api-2.24.3.jar", + "coordinates": [ + "org.apache.logging.log4j:log4j-api:2.24.3" + ] + }, + { + "jar": "WEB-INF/lib/logback-core-1.5.34.jar", + "coordinates": [ + "ch.qos.logback:logback-core:1.5.34" + ] + }, + { + "jar": "WEB-INF/lib/spring-core-6.2.19.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/spring-context-6.2.19.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/spring-webmvc-6.2.19.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/jackson-databind-2.21.4.jar", + "coordinates": [ + "com.fasterxml.jackson.core:jackson-databind:2.21.4" + ] + }, + { + "jar": "WEB-INF/lib/spring-aop-6.2.19.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/logback-classic-1.5.34.jar", + "coordinates": [ + "ch.qos.logback:logback-classic:1.5.34" + ] + }, + { + "jar": "WEB-INF/lib/spring-boot-3.5.16.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/jackson-datatype-jsr310-2.21.4.jar", + "coordinates": [ + "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.21.4" + ] + }, + { + "jar": "WEB-INF/lib/tomcat-embed-jasper-10.1.55.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/spring-expression-6.2.19.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/jackson-datatype-jdk8-2.21.4.jar", + "coordinates": [ + "com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.21.4" + ] + }, + { + "jar": "WEB-INF/lib/jackson-core-2.21.4.jar", + "coordinates": [ + "com.fasterxml.jackson.core:jackson-core:2.21.4" + ] + }, + { + "jar": "WEB-INF/lib/jakarta.annotation-api-2.1.1.jar", + "coordinates": [ + "jakarta.annotation:jakarta.annotation-api:2.1.1" + ] + }, + { + "jar": "WEB-INF/lib/spring-jdbc-6.2.19.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/jackson-module-parameter-names-2.21.4.jar", + "coordinates": [ + "com.fasterxml.jackson.module:jackson-module-parameter-names:2.21.4" + ] + }, + { + "jar": "WEB-INF/lib/micrometer-observation-1.15.12.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/spring-beans-6.2.19.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/spring-tx-6.2.19.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/postgresql-42.7.11.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/jackson-annotations-2.21.jar", + "coordinates": [ + "com.fasterxml.jackson.core:jackson-annotations:2.21" + ] + }, + { + "jar": "WEB-INF/lib/jsoup-1.17.2.jar", + "coordinates": [ + "org.jsoup:jsoup:1.17.2" + ] + }, + { + "jar": "WEB-INF/lib/ecj-3.33.0.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/tomcat-annotations-api-10.1.55.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/mybatis-spring-boot-starter-3.0.5.jar", + "coordinates": [ + "org.mybatis.spring.boot:mybatis-spring-boot-starter:3.0.5" + ] + }, + { + "jar": "WEB-INF/lib/slf4j-api-2.0.18.jar", + "coordinates": [ + "org.slf4j:slf4j-api:2.0.18" + ] + }, + { + "jar": "WEB-INF/lib/mybatis-3.5.19.jar", + "coordinates": [ + "org.mybatis:mybatis:3.5.19", + "ognl:ognl:3.4.4", + "org.javassist:javassist:3.30.2-GA" + ] + }, + { + "jar": "WEB-INF/lib/mybatis-spring-3.0.5.jar", + "coordinates": [ + "org.mybatis:mybatis-spring:3.0.5" + ] + }, + { + "jar": "WEB-INF/lib/spring-boot-autoconfigure-3.5.16.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/jul-to-slf4j-2.0.18.jar", + "coordinates": [ + "org.slf4j:jul-to-slf4j:2.0.18" + ] + }, + { + "jar": "WEB-INF/lib/snakeyaml-2.4.jar", + "coordinates": [ + "org.yaml:snakeyaml:2.4" + ] + }, + { + "jar": "WEB-INF/lib/tomcat-embed-core-10.1.55.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/tomcat-embed-el-10.1.55.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/spring-web-6.2.19.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/spring-jcl-6.2.19.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/mybatis-spring-boot-autoconfigure-3.0.5.jar", + "coordinates": [ + "org.mybatis.spring.boot:mybatis-spring-boot-autoconfigure:3.0.5" + ] + }, + { + "jar": "WEB-INF/lib-provided/tomcat-embed-websocket-10.1.55.jar", + "coordinates": [] + }, + { + "jar": "WEB-INF/lib/spring-boot-jarmode-tools-3.5.16.jar", + "coordinates": [] + } +] \ No newline at end of file diff --git a/.atp/work-session/20260922-114058/report.md b/.atp/work-session/20260922-114058/report.md index 426776a..4e00936 100644 --- a/.atp/work-session/20260922-114058/report.md +++ b/.atp/work-session/20260922-114058/report.md @@ -3,7 +3,7 @@ schema_version: 2 profile: research-lite session_id: 20260922-114058 started_at: 2026-09-22T11:40:58.902204+09:00 -ended_at: 2026-09-22T11:50:01.878221+09:00 +ended_at: 2026-09-22T11:59:50.675179+09:00 user_request: 지금까지 작업된 결과물들 검증과 라이브 출시 준비 상태 판정 --- # Summary @@ -70,3 +70,30 @@ negative: [] - 임시 app/db 컨테이너·해당 익명 볼륨·네트워크 정리 완료. WAR/전체 브라우저 캡처/의존성 HTML은 /tmp/bibimbap-readiness-*에 남김(검증 참고용). - 저장한 로그는 줄끝 공백만 정규화했다. HTTP 관측의 세션 ID는 삭제했다. + +## Phase 2 — 최신 의존성 취약점 검증 + +### Decisions +- 사용자 후속 요청: 최신 취약점은 확실히 해야겠네. NVD 데이터 갱신 및 배포 WAR의 provided 의존성 포함 재검증. 제품 소스 수정 없이 기존 격리 복사본의 검증용 POM만 수정한다. +- tier_b_sequential 유지; 독립 advisor 미사용. + +### Invocations +- orchestrator: 완료. OSV 온라인 81 좌표, WAR 43/43 JAR 대응, NVD 실시간 28/28 CVE 및 공급자 권고 대조. 제품 수정 없음. + +### Summary +최신 공개 권고의 영향 버전에 배포 구성요소 6종이 포함된다. 28개 CVE + 1개 GHSA는 버전/권고 검토 집합이며, 실제 악용 입증 건수가 아니다. jsoup/Jackson/Log4j/Spring 일부 조건은 현재 소스에 없고 Tomcat/DB 외부 운영 설정은 미확인이다. 이전 캐시 0건은 출시 근거에서 제외한다. + +### verified_by_me +- OSV: 온라인 응답 9 unique advisory, 5 runtime packages; pagination 없음. 모든 WAR JAR의 Maven 좌표 포함 확인. +- 공급자 추가 대조: Tomcat 19 CVE, Spring 4 CVE; 총 28 CVE + 1 GHSA. NVD API 28 requested/28 returned, timestamp 2026-09-22T02:56:02.312 UTC. +- NVD bulk: 최초 실패(exit 1); 실행 전용 CA truststore+IPv4 재시도 후 395,957건 전체 초기 복제 진입. 대상 실시간 조회 완료 뒤 이 세션의 PID 824에 TERM 전송, exit 143 확인. bulk scan PASS 아님. +- TLS 검증 비활성화 0; 사용자 전역 truststore 변경 0; 코드 변경 0, 전체 L1 반복 불필요. +- 문서 링크/JSON 대상 수/버전 목록·WAR 커버리지 일치 확인. + +### needs_user_verification +- 실제 운영 HTTP/2/Realm/Valve/TLS/DB channel binding 정책. +- 지원 Boot 계열로 이전할지 상용 Spring 패치 경로를 사용할지 결정 후 구현·회귀검증. +- NVD bulk cache 갱신 미완료; 향후 Dependency-Check는 갱신 완료 시각과 데이터 존재를 먼저 확인. + +### Retrospective +이전 scan 성공+0건은 최신성의 증거가 아니었다. 공급자 권고와 OSV에는 매핑/수록 차이가 있어 양쪽 대조가 필요하다. Tomcat fixed=10.1.58은 공개 릴리스가 아니므로 실제 배포 수정본 10.1.59로 구분했다. 실행 가이드의 autoUpdate=false에서도 온라인 갱신된다는 오해를 문서에서 정정했다. 독립 advisor 검토 아님. diff --git a/docs/analysis/2026-09-22-current-dependency-advisories.md b/docs/analysis/2026-09-22-current-dependency-advisories.md new file mode 100644 index 0000000..cc861e9 --- /dev/null +++ b/docs/analysis/2026-09-22-current-dependency-advisories.md @@ -0,0 +1,66 @@ +# 2026-09-22 최신 의존성 보안 권고 대조 + +**판정: 최신 권고 기준 무취약점으로 승인할 수 없다.** 배포 라이브러리 6종이 보안 권고의 영향 버전에 해당한다. 이것은 앱에서 실제 악용이 입증된 취약점 6건이라는 뜻이 아니다. 현재 소스에서 전제 기능이 없는 항목과 운영 설정 확인이 필요한 항목을 분리했다. 앞선 캐시 검사 0건은 출시 근거에서 제외한다. + +## 실제 조회 범위와 증거 + +- 대상: 제품 소스 `1848394`, 앞선 live WAR와 동일한 해시. 이후 커밋은 문서만 변경했다. +- Maven 의존성 및 WAR 내부 메타데이터로 **81개 좌표/버전**을 OSV 온라인 API에 조회했다. test/provided/shaded/packaged-tool을 포함하며 WAR **43개 JAR 전부**가 조회 목록과 매칭됐다. 좌표 수와 JAR 수는 shaded 및 테스트 의존성 때문에 다르다. +- OSV batch 응답 2026-09-22 02:53:22 UTC: 런타임 5종에서 **9개 고유 권고** 매칭. 추가 jarmode-tools 조회 0건. 페이지 토큰 없음. +- 공식 공급자 권고를 추가 대조했다. Tomcat 19개 CVE와 Spring 4개 CVE가 현재 버전 범위에 해당한다. OSV와 합쳐 **28개 고유 CVE + CVE 미부여 GHSA 1개**를 검토 대상으로 정리했다. 모든 알려지지 않은 취약점을 포함하는 전수 보증은 아니다. +- NVD 실시간 API의 `cveIds` 조회: **28개 요청/28개 응답**, 응답 시각 `2026-09-22T02:56:02.312` UTC. OSV의 CVE 없는 GHSA는 공급자 권고로 확인했다. +- [온라인 OSV 응답](../../.atp/work-session/20260922-114058/artifacts/latest-osv-results.json), [권고 상세](../../.atp/work-session/20260922-114058/artifacts/latest-osv-advisories.json), [NVD 실시간 응답](../../.atp/work-session/20260922-114058/artifacts/latest-nvd-targeted.json), [WAR 목록](../../.atp/work-session/20260922-114058/artifacts/war-inventory.json). + +## 버전별 판단 + +아래 수정 버전은 검토한 권고를 해소하는 기준이며, 현재 프로젝트에서 빌드·기능 호환성까지 검증한 업그레이드 결과는 아니다. + +| 배포 구성요소 | 현재 | 권고 대응 버전/경로 | 앱 적용성 판단 | +| --- | --- | --- | --- | +| Tomcat | 10.1.55 | 공개 배포본 10.1.59 이상 | 19개 CVE 영향 범위. HTTP/2·Realm 인증·RewriteValve·WebSocket·UDS 등 조건별 확인 필요. 저장소에는 해당 설정/endpoint가 없지만 운영 WAS의 외부 설정은 미확인 | +| Spring Framework | 6.2.19 | 6.2.20 상용 지원 또는 7.0.9 이상을 포함하는 호환 Boot 계열 | 아래 4건은 영향 버전이나 해당 SpEL/자동 생성 List/함수형 SSE 사용이 소스에서 발견되지 않음 | +| Jackson databind | 2.21.4 | 같은 계열 2.21.5 이상, BOM 정합 유지 | 3개 권고 매칭. JsonView/JsonUnwrapped/JsonIgnoreProperties/외부 타입 속성 조합이 소스에 없음 | +| PostgreSQL JDBC | 42.7.11 | 42.7.12 이상 | channelBinding=require + TLS 인증서 조건. 로컬 구성에 require 없음; 운영 DB 연결 정책은 미확인 | +| jsoup | 1.17.2 | 1.23.1 이상 | 버전은 영향 범위지만 현재 sanitizer가 raw-text 태그를 허용하지 않아 이 권고의 전제는 불충족 | +| Log4j API | 2.24.3 | 2.25.5 또는 2.26.1 이상 계열 | MapMessage JSON 직렬화가 전제. 현재 Logback 사용, 해당 호출/레이아웃 없음 | + +### Tomcat: 버전 범위와 실제 사용 기능을 분리 + +검토 CVE: `CVE-2026-73180`, `68763`, `68569`, `68525`, `66422`, `66299`, `65927`, `65905`, `65637`, `65183`, `65182`, `59084`, `59083`, `55956`, `55955`, `55276`, `53434`, `53404`, `50229` (각 축약 번호의 접두사는 `CVE-2026-`). + +대표적으로 HTTP/2 메모리 누수 DoS `CVE-2026-68763`은 HTTP/2 활성화 여부가 중요하다. DIGEST/FORM/Realm/서블릿 선언적 제약 관련 권고를 커스텀 `UserController` 로그인 취약점으로 단정하지 않는다. 예제 앱 관련 항목은 WAR에 Tomcat examples가 없어 배포 내용상 해당하지 않는다. 나머지는 각각 외부 WAS/TLS/클러스터 설정과 대조해야 한다. + +공식 권고는 10.1.58 릴리스 투표가 통과하지 않았으므로 실제 배포 수정본으로 10.1.59를 사용하도록 명시한다. OSV의 `fixed=10.1.58`만 보고 배포 버전을 정하면 안 된다. [Apache 공식 권고](https://tomcat.apache.org/security-10.html). + +### Spring: 공급자 공지로 OSV 조회 공백 보완 + +- [CVE-2026-59282](https://spring.io/security/cve-2026-59282/): 외부 property path를 self-populating List에 바인딩하는 조건. 해당 List/DataBinder 구성이 소스에 없다. +- [CVE-2026-59283](https://spring.io/security/cve-2026-59283/): SimpleEvaluationContext와 활성 SpEL compiler 조합. 관련 사용이 없다. +- [CVE-2026-47886](https://spring.io/security/cve-2026-47886/): 외부 SpEL 및 BigInteger/BigDecimal 거듭제곱 조건. 외부 표현식 평가 코드가 없다. +- [CVE-2026-59313](https://spring.io/security/cve-2026-59313/): 함수형 MVC의 텍스트 SSE. RouterFunction/ServerResponse.sse 사용이 없다. + +위 판단은 현재 저장소의 정적 대조이며 런타임에 외부로 주입되는 코드/설정까지 보증하지 않는다. [Boot 3.5.16 공식 발표](https://spring.io/blog/2026/06/25/spring-boot-3-5-16-available-now/)는 이를 3.5 계열의 마지막 OSS 릴리스로 명시한다. Spring jar 하나만 올리는 방식보다 지원되는 Boot 계열로의 이전 또는 상용 패치 경로를 결정해야 한다. + +### 나머지 권고와 소스 근거 + +- Jackson: [CVE-2026-59889](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh), [CVE-2026-54515](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v), [GHSA-mhm7-754m-9p8w](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w). `JamScoringController.java:73`은 `@RequestBody Map`이며 위 권고에 필요한 POJO annotation 조합은 현재 소스에서 검색되지 않았다. +- PostgreSQL: [CVE-2026-54291 공급자 권고](https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867). 영향 버전과 `channelBinding=require`의 실제 사용 여부는 별개다. 운영 설정 값/비밀번호는 수집하거나 보고서에 출력하지 않았다. +- jsoup: [CVE-2026-71497 공급자 권고](https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8). `PostMarkdownService.java:26`은 `basicWithImages()`에 `h1/h2/h3/hr`만 추가한다. style/script 등 raw-text 태그를 허용하지 않으므로 현재 sanitizer 설정에는 해당 조건이 없다. `OgPreviewService.java:52`는 HTML parsing 용도다. +- Log4j API: [CVE-2026-49844 공급자 권고](https://logging.apache.org/security.html#CVE-2026-49844). WAR의 Logback/Log4j-to-SLF4J 구성과 소스 검색에서 MapMessage/JsonTemplateLayout 경로가 없다. Log4Shell 발견으로 표현하지 않는다. + +## NVD 갱신 시도와 제한 + +검증용 POM에서만 `autoUpdate=true`, `skipProvidedScope=false`, JSON/HTML 출력을 설정했다. 원본 `pom.xml`은 수정하지 않았다. 첫 전체 동기화는 네트워크 오류와 `NoDataException`으로 실패했다. 회사 CA를 **이번 실행 전용 truststore**에 로드하고 IPv4를 지정한 재시도는 갱신 단계에 진입했으나 NVD 전체 395,957건 초기 복제를 요구했다. + +필요한 28건의 NVD 실시간 조회와 WAR 전수 OSV 조회가 성공한 뒤 전체 복제 프로세스를 중단했다. 따라서 **최신 NVD DB 기반 Dependency-Check 전체 실행 PASS로 기록하지 않는다.** 그 실행의 캐시도 완전 갱신된 것으로 취급하면 안 된다. TLS 인증서 검증은 끄지 않았다. 최신 직접 조회 결과와 bulk sync 상태는 별개다. + +OSS Index는 인증정보 미제공으로 사용하지 않았다. OS/JDK/컨테이너 이미지의 시스템 패키지, CDN 리소스, 앱 자체의 미공개 결함은 이번 Maven/WAR 의존성 대조 범위 밖이다. + +## 다음 작업 + +1. 운영 HTTP/2·Realm/Valve·TLS·DB channel binding 설정을 확인하고 미확인 조건을 닫는다. +2. 위 수정 버전 또는 이를 관리하는 지원 Boot BOM을 선택한다. Spring 6.2.20은 공식 권고상 상용 경로이므로 공개 Maven Central에 있다고 가정하지 않는다. +3. 버전 변경 후 전체 테스트, WAR 내부 버전, DB 연결, JSP·WebGL·마크다운·JSON 경로를 재검증하고 동일 온라인 조회를 다시 수행한다. +4. 재현 가능한 정기 검사에는 NVD 갱신 성공/데이터 시각/대상 개수/제외 범위를 종료 조건으로 두고, 갱신 실패 후 캐시 fallback을 출시 PASS로 쓰지 않는다. + +제품 버전 변경이나 배포는 이번 검증에 포함하지 않았다. 현재 확인된 증거는 **업데이트 또는 근거 있는 적용성 예외 검토가 필요한 상태**이며, 즉시 악용 가능한 취약점이 재현됐다는 판정은 아니다. diff --git a/docs/analysis/2026-09-22-release-readiness.md b/docs/analysis/2026-09-22-release-readiness.md index ec4465a..e4fc3f5 100644 --- a/docs/analysis/2026-09-22-release-readiness.md +++ b/docs/analysis/2026-09-22-release-readiness.md @@ -2,6 +2,8 @@ **판정: 현재 산출물 그대로 라이브 출시 보류(NO-GO).** 기본 동작과 빌드는 통과했으나 운영 설정 패키징 결함이 재현됐고, 신규 DB 초기화·운영 환경 검증이 남아 있다. 검증 대상은 `feat/v2`의 `184839434c94d500cdf6e74ae77b4b4c658dcc4c`이다. 코드 수정·운영 배포·원격 push는 수행하지 않았다. +**후속 최신 취약점 확인:** [최신 의존성 권고 대조](./2026-09-22-current-dependency-advisories.md)에서 배포 구성요소 6종의 영향 버전 포함을 확인했다. 아래 캐시 기반 0건은 당시 실행 기록이며 현재 출시 승인 근거로 사용할 수 없다. + ATP Tier B 순차 self-check로 수행했다. 독립 advisor 검토 또는 전체 보안 감사 결과가 아니다. [세션과 증거](../../.atp/work-session/20260922-114058/report.md). ## 실행 결과 diff --git a/docs/analysis/index.md b/docs/analysis/index.md index 602805c..ab956c2 100644 --- a/docs/analysis/index.md +++ b/docs/analysis/index.md @@ -4,6 +4,8 @@ ## 목록 +- [2026-09-22-current-dependency-advisories.md](./2026-09-22-current-dependency-advisories.md) — WAR 43 JAR/81 좌표 온라인 조회, NVD 28 CVE 실시간 대조. 6종 영향 버전과 앱의 악용 전제·지원 버전 경로 분리. + - [2026-09-22-release-readiness.md](./2026-09-22-release-readiness.md) — 362개 테스트·live WAR·실 DB 인증/모집글·공개 화면 16회 검증. 출시 보류: live 설정 패키징 누락, dev 고정 이미지 경로, 신규 DB 카테고리 시드 공백 및 운영 검증 미완료. - [2026-06-16-project-analysis.md](./2026-06-16-project-analysis.md) — bibimbap 전면 코드 분석(D1 아키텍처/D2 보안/D3 품질·기술부채/D4 도메인). 보안 기초는 견고(SQLi 0·PBKDF2·CSRF 더블서밋)하나 프로토타입 잔재 dead code·미완성 기능·서비스 레이어 부재가 주요 부채. `perspective: neutral`, work-session 20260616-111711 distill. diff --git a/docs/security/owasp-dependency-check-guide.md b/docs/security/owasp-dependency-check-guide.md index ff23567..84e2e78 100644 --- a/docs/security/owasp-dependency-check-guide.md +++ b/docs/security/owasp-dependency-check-guide.md @@ -24,6 +24,8 @@ ### 온라인 모드 (NVD 데이터 갱신 포함) +**2026-09-22 정정:** 아래 명령만으로는 이 프로젝트의 `false` 설정이 해제되지 않는다. 검증용 POM/명시적 Maven 프로필에서 `autoUpdate=true`를 적용하고, 실제 로그의 갱신 완료 및 데이터 시각을 확인해야 온라인 갱신으로 판정할 수 있다. 갱신 실패나 캐시 fallback을 출시 검증 PASS로 취급하지 않는다. 실행형 WAR에서는 `WEB-INF/lib-provided`도 로딩되므로 검증 구성에서 `skipProvidedScope=false`로 포함하고 실제 WAR 목록과 대조한다. + ```bash mvn dependency-check:check ``` @@ -39,7 +41,7 @@ mvn dependency-check:check ``` 캐시 위치: `~/.m2/repository/org/owasp/dependency-check-data/` (기본값). -캐시가 없으면 온라인 다운로드가 강제된다. +`autoUpdate=false`에서 캐시가 없거나 불완전하면 검사가 실패할 수 있다. 자동 다운로드나 최신성 보장을 가정하지 않는다. 캐시를 명시적으로 지정하려면: