{ "resultsPerPage": 28, "startIndex": 0, "totalResults": 28, "format": "NVD_CVE", "version": "2.0", "timestamp": "2026-09-22T02:56:02.312", "vulnerabilities": [ { "cve": { "id": "CVE-2026-54515", "sourceIdentifier": "security-advisories@github.com", "published": "2026-06-23T21:17:02.597", "lastModified": "2026-06-29T13:38:59.057", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map \u2014 restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4." } ], "affected": [ { "source": "security-advisories@github.com", "affectedData": [ { "vendor": "FasterXML", "product": "jackson-databind", "versions": [ { "version": ">= 2.8.0, < 2.18.9", "status": "affected" }, { "version": ">= 2.19.0, < 2.21.5", "status": "affected" }, { "version": ">= 3.1.0, < 3.1.4", "status": "affected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "security-advisories@github.com", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE" }, "exploitabilityScore": 3.9, "impactScore": 1.4 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-06-24T12:21:39.803339Z", "id": "CVE-2026-54515", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security-advisories@github.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-915" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.8.0", "versionEndExcluding": "2.18.9", "matchCriteriaId": "A70ABD6F-255D-4445-BED6-B3D2BA9CC33C" }, { "vulnerable": true, "criteria": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.19.0", "versionEndExcluding": "2.21.5", "matchCriteriaId": "23684E89-ED14-4060-AD06-E70E32EC3C4D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0.0", "versionEndExcluding": "3.1.4", "matchCriteriaId": "5C0F99DE-1DB7-4873-83F9-6CEF8E91F33C" }, { "vulnerable": true, "criteria": "cpe:2.3:a:fasterxml:jackson-databind:2.22.0:*:*:*:*:*:*:*", "matchCriteriaId": "E32613B1-1FE9-427D-8D4C-A450874E4D0A" } ] } ] } ], "references": [ { "url": "https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa", "source": "security-advisories@github.com", "tags": [ "Patch" ] }, { "url": "https://github.com/FasterXML/jackson-databind/issues/5962", "source": "security-advisories@github.com", "tags": [ "Issue Tracking" ] }, { "url": "https://github.com/FasterXML/jackson-databind/issues/5964", "source": "security-advisories@github.com", "tags": [ "Issue Tracking", "Patch" ] }, { "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v", "source": "security-advisories@github.com", "tags": [ "Third Party Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-50229", "sourceIdentifier": "security@apache.org", "published": "2026-06-29T21:16:44.413", "lastModified": "2026-07-02T19:24:34.983", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.22", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.55", "versionType": "semver", "status": "affected" }, { "version": "9.0.0.M1", "lessThanOrEqual": "9.0.118", "versionType": "semver", "status": "affected" }, { "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "7.0.0", "lessThanOrEqual": "7.0.109", "versionType": "semver", "status": "affected" }, { "version": "0", "lessThan": "7.0.0", "versionType": "semver", "status": "unknown" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE" }, "exploitabilityScore": 2.8, "impactScore": 2.7 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-06-30T12:49:25.834984Z", "id": "CVE-2026-50229", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-80" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionEndIncluding": "7.0.109", "matchCriteriaId": "FBE1DD9D-848F-4FD6-94B8-3F3188A13239" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.0", "versionEndIncluding": "8.5.100", "matchCriteriaId": "FF43D0D7-FBF3-4D7A-84C4-47B65A75A524" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.0.119", "matchCriteriaId": "EA5B1F1F-8593-47C6-B14E-8F60BE7E1199" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.56", "matchCriteriaId": "4A8C20B4-DBE1-4890-AD5E-D5EABB6B739D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.23", "matchCriteriaId": "C43AD2A0-8785-4A37-AAAE-347B1E0463F1" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/06/29/20", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-53404", "sourceIdentifier": "security@apache.org", "published": "2026-06-29T21:16:44.527", "lastModified": "2026-07-02T19:22:23.483", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.22", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.55", "versionType": "semver", "status": "affected" }, { "version": "9.0.0.M1", "lessThanOrEqual": "9.0.118", "versionType": "semver", "status": "affected" }, { "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "0", "lessThan": "8.0.0", "versionType": "semver", "status": "unaffected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW" }, "exploitabilityScore": 3.9, "impactScore": 3.4 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-06-30T12:30:42.750259Z", "id": "CVE-2026-53404", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-670" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.0", "versionEndIncluding": "8.5.100", "matchCriteriaId": "FF43D0D7-FBF3-4D7A-84C4-47B65A75A524" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.0.119", "matchCriteriaId": "EA5B1F1F-8593-47C6-B14E-8F60BE7E1199" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.56", "matchCriteriaId": "4A8C20B4-DBE1-4890-AD5E-D5EABB6B739D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.23", "matchCriteriaId": "C43AD2A0-8785-4A37-AAAE-347B1E0463F1" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/06/29/21", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-53434", "sourceIdentifier": "security@apache.org", "published": "2026-06-29T21:16:44.937", "lastModified": "2026-07-02T19:06:09.643", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.22", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M7", "lessThanOrEqual": "10.1.55", "versionType": "semver", "status": "affected" }, { "version": "9.0.83", "lessThanOrEqual": "9.0.118", "versionType": "semver", "status": "affected" }, { "version": "0", "lessThanOrEqual": "9.0.82", "versionType": "semver", "status": "unaffected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE" }, "exploitabilityScore": 3.9, "impactScore": 5.2 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-06-30T12:28:14.286092Z", "id": "CVE-2026-53434", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-390" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.83", "versionEndExcluding": "9.0.119", "matchCriteriaId": "C19FB4AD-3706-4F58-9E0D-C530561C058C" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.56", "matchCriteriaId": "4A8C20B4-DBE1-4890-AD5E-D5EABB6B739D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.23", "matchCriteriaId": "C43AD2A0-8785-4A37-AAAE-347B1E0463F1" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/06/29/22", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-55276", "sourceIdentifier": "security@apache.org", "published": "2026-06-29T21:16:45.380", "lastModified": "2026-07-02T19:05:18.260", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100.\u00a0Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.22", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.55", "versionType": "semver", "status": "affected" }, { "version": "9.0.0.M1", "lessThanOrEqual": "9.0.118", "versionType": "semver", "status": "affected" }, { "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "0", "lessThan": "8.0.0", "versionType": "semver", "status": "unaffected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE" }, "exploitabilityScore": 3.9, "impactScore": 5.2 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-06-30T13:59:26.729885Z", "id": "CVE-2026-55276", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-670" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionEndExcluding": "9.0.119", "matchCriteriaId": "5BB3B349-8AB6-4C07-B186-888CAFB1609E" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.56", "matchCriteriaId": "4A8C20B4-DBE1-4890-AD5E-D5EABB6B739D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.23", "matchCriteriaId": "C43AD2A0-8785-4A37-AAAE-347B1E0463F1" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/06/29/23", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-55955", "sourceIdentifier": "security@apache.org", "published": "2026-06-29T21:16:45.490", "lastModified": "2026-07-10T12:22:23.967", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Improper Authentication vulnerability in Apache Tomcat allowed a replay attack against the EncryptionInterceptor in the cluster component.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.13 through 9.0.18, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56, 9.0.119, which fixes the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.22", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.55", "versionType": "semver", "status": "affected" }, { "version": "9.0.13", "lessThanOrEqual": "9.0.118", "versionType": "semver", "status": "affected" }, { "version": "8.5.38", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "7.0.100", "lessThanOrEqual": "7.0.109", "versionType": "semver", "status": "affected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE" }, "exploitabilityScore": 3.9, "impactScore": 2.5 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-06-30T13:21:53.082121Z", "id": "CVE-2026-55955", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-287" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionEndExcluding": "9.0.119", "matchCriteriaId": "5BB3B349-8AB6-4C07-B186-888CAFB1609E" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.56", "matchCriteriaId": "4A8C20B4-DBE1-4890-AD5E-D5EABB6B739D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.23", "matchCriteriaId": "C43AD2A0-8785-4A37-AAAE-347B1E0463F1" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106", "source": "security@apache.org", "tags": [ "Mailing List", "Vendor Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/06/29/24", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-55956", "sourceIdentifier": "security@apache.org", "published": "2026-06-29T21:16:45.597", "lastModified": "2026-07-02T19:03:30.203", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.22", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.55", "versionType": "semver", "status": "affected" }, { "version": "9.0.0.M1", "lessThanOrEqual": "9.0.118", "versionType": "semver", "status": "affected" }, { "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "7.0.0", "lessThanOrEqual": "7.0.109", "versionType": "semver", "status": "affected" }, { "version": "0", "lessThan": "7.0.0", "versionType": "semver", "status": "unknown" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE" }, "exploitabilityScore": 3.9, "impactScore": 2.5 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-06-30T13:23:02.427983Z", "id": "CVE-2026-55956", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-285" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionEndExcluding": "9.0.119", "matchCriteriaId": "5BB3B349-8AB6-4C07-B186-888CAFB1609E" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.56", "matchCriteriaId": "4A8C20B4-DBE1-4890-AD5E-D5EABB6B739D" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.23", "matchCriteriaId": "C43AD2A0-8785-4A37-AAAE-347B1E0463F1" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/06/29/25", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-54291", "sourceIdentifier": "security-advisories@github.com", "published": "2026-07-06T19:17:08.407", "lastModified": "2026-07-09T13:16:25.717", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection can trigger the downgrade with a certificate whose signature algorithm has no tls-server-end-point channel-binding hash, because the bundled com.ongres.scram:scram-client returns an empty byte array instead of failing and pgJDBC ScramAuthenticator checks only that the server advertised a PLUS mechanism, without rejecting the empty binding or checking that the negotiated mechanism uses channel binding. This issue is fixed in version 42.7.12." } ], "affected": [ { "source": "security-advisories@github.com", "affectedData": [ { "vendor": "pgjdbc", "product": "pgjdbc", "versions": [ { "version": ">= 42.7.4, < 42.7.12", "status": "affected" } ] } ] } ], "metrics": { "cvssMetricV40": [ { "source": "security-advisories@github.com", "type": "Secondary", "cvssData": { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED" } } ], "cvssMetricV31": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE" }, "exploitabilityScore": 2.2, "impactScore": 3.6 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-07-06T19:47:12.248185Z", "id": "CVE-2026-54291", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security-advisories@github.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-636" }, { "lang": "en", "value": "CWE-757" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:postgresql:postgresql_jdbc_driver:*:*:*:*:*:*:*:*", "versionStartIncluding": "42.7.4", "versionEndExcluding": "42.7.12", "matchCriteriaId": "A4316240-4F4D-4E4B-80A6-E6EACEFFF161" } ] } ] } ], "references": [ { "url": "https://github.com/ongres/scram/releases/tag/3.3", "source": "security-advisories@github.com", "tags": [ "Not Applicable" ] }, { "url": "https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99", "source": "security-advisories@github.com", "tags": [ "Patch" ] }, { "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867", "source": "security-advisories@github.com", "tags": [ "Patch", "Vendor Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-49844", "sourceIdentifier": "security@apache.org", "published": "2026-07-10T22:16:42.540", "lastModified": "2026-07-14T20:03:09.910", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.\n\nThe fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.\n\nThe defect is reachable only when both of the following conditions hold:\n\n * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{\"JSON\"}).\n * The application logs a MapMessage that contains an attacker-controlled floating-point value.\n\n\nAn attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.\n\nUsers are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Log4j API", "defaultStatus": "unaffected", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "org.apache.logging.log4j:log4j-api", "cpes": [ "cpe:2.3:a:apache:log4j_api:*:*:*:*:*:*:*:*" ], "packageURL": "pkg:maven/org.apache.logging.log4j/log4j-api", "versions": [ { "version": "2.13.1", "lessThan": "2.25.5", "versionType": "maven", "status": "affected" }, { "version": "2.26.0", "lessThan": "2.26.1", "versionType": "maven", "status": "affected" }, { "version": "3.0.0-alpha1", "lessThanOrEqual": "3.0.0-beta2", "versionType": "maven", "status": "affected" } ] } ] } ], "metrics": { "cvssMetricV40": [ { "source": "security@apache.org", "type": "Secondary", "cvssData": { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED" } } ], "cvssMetricV31": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE" }, "exploitabilityScore": 2.2, "impactScore": 3.6 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-07-14T13:56:31.652710Z", "id": "CVE-2026-49844", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-116" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.13.1", "versionEndExcluding": "2.25.5", "matchCriteriaId": "12E4C571-03B3-4E5D-9DC8-6384F942F8F0" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:log4j:2.26.0:*:*:*:*:*:*:*", "matchCriteriaId": "B90905D1-1381-4057-8AE1-726CF445974A" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "5EE518C3-2F43-40FF-B754-C340B7003FC7" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*", "matchCriteriaId": "6D2A01C1-D56C-4198-8ADB-11739F791E2B" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*", "matchCriteriaId": "D6F8BD61-DD30-4D64-842C-850E5B117036" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "ED00C38D-27EA-489C-9A2B-3594ACA8A3C5" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "8794D719-1D90-4378-B48B-698EA40FBFB2" } ] } ] } ], "references": [ { "url": "https://github.com/apache/logging-log4j2/pull/4163", "source": "security@apache.org", "tags": [ "Issue Tracking", "Patch" ] }, { "url": "https://logging.apache.org/cyclonedx/vdr.xml", "source": "security@apache.org", "tags": [ "Vendor Advisory" ] }, { "url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message", "source": "security@apache.org", "tags": [ "Product" ] }, { "url": "https://logging.apache.org/security.html#CVE-2026-49844", "source": "security@apache.org", "tags": [ "Vendor Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-59083", "sourceIdentifier": "security@apache.org", "published": "2026-07-14T09:16:41.483", "lastModified": "2026-07-14T16:57:31.103", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100.\u00a0Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120, which fix the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.23", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.56", "versionType": "semver", "status": "affected" }, { "version": "9.0.0.M1", "lessThanOrEqual": "9.0.119", "versionType": "semver", "status": "affected" }, { "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "0", "lessThan": "8.0.0", "versionType": "semver", "status": "unaffected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE" }, "exploitabilityScore": 3.9, "impactScore": 5.2 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-07-14T12:19:49.962916Z", "id": "CVE-2026-59083", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-177" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionEndIncluding": "8.0.0", "matchCriteriaId": "6626CE25-E8F0-4F67-ACEB-363F6D2BDEEC" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.0", "versionEndIncluding": "8.5.100", "matchCriteriaId": "FF43D0D7-FBF3-4D7A-84C4-47B65A75A524" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndIncluding": "9.0.119", "matchCriteriaId": "C8665E8D-D2A4-46FF-A126-75EDE95FCA35" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndIncluding": "10.1.56", "matchCriteriaId": "1B3DEC2A-7E4A-4851-8466-AFCC4B249748" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndIncluding": "11.0.23", "matchCriteriaId": "30943912-13A4-40D8-A9E3-9DE3C0008258" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/3g63zos2gkjo5vgnrk8kxmosv47w6wbq", "source": "security@apache.org", "tags": [ "Mitigation", "Vendor Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/14/7", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-59084", "sourceIdentifier": "security@apache.org", "published": "2026-07-14T09:16:41.607", "lastModified": "2026-07-14T16:57:03.830", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.\u00a0Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.24, 10.1.57 or 9.0.120 which fix the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.23", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.56", "versionType": "semver", "status": "affected" }, { "version": "9.0.13", "lessThanOrEqual": "9.0.119", "versionType": "semver", "status": "affected" }, { "version": "8.5.38", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "7.0.100", "lessThanOrEqual": "7.0.109", "versionType": "semver", "status": "affected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE" }, "exploitabilityScore": 3.9, "impactScore": 5.2 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-07-14T13:51:48.818351Z", "id": "CVE-2026-59084", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-1059" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.100", "versionEndIncluding": "7.0.109", "matchCriteriaId": "21FCAD61-9B9D-4780-9EE2-2F28B3F951F5" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.38", "versionEndIncluding": "8.5.100", "matchCriteriaId": "769FDDAB-B636-43A6-BB06-CCE9185D5EA6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.13", "versionEndIncluding": "9.0.119", "matchCriteriaId": "A332E23F-9A0B-41C6-B00D-8E92BF206791" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndIncluding": "10.1.56", "matchCriteriaId": "1B3DEC2A-7E4A-4851-8466-AFCC4B249748" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndIncluding": "11.0.23", "matchCriteriaId": "30943912-13A4-40D8-A9E3-9DE3C0008258" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/7w9746ootcxo0gvx26xjpw80l31f1qw7", "source": "security@apache.org", "tags": [ "Mitigation", "Vendor Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/14/8", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-59889", "sourceIdentifier": "security-advisories@github.com", "published": "2026-07-14T21:17:06.160", "lastModified": "2026-07-16T16:19:15.790", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1." } ], "affected": [ { "source": "security-advisories@github.com", "affectedData": [ { "vendor": "FasterXML", "product": "jackson-databind", "versions": [ { "version": ">= 2.18.0, < 2.18.9", "status": "affected" }, { "version": ">= 2.21.0, < 2.21.5", "status": "affected" }, { "version": ">= 2.22.0, < 2.22.1", "status": "affected" }, { "version": ">= 3.0.0, < 3.1.5", "status": "affected" }, { "version": ">= 3.2.0, < 3.2.1", "status": "affected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "security-advisories@github.com", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE" }, "exploitabilityScore": 2.8, "impactScore": 3.6 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-07-16T14:50:03.943048Z", "id": "CVE-2026-59889", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security-advisories@github.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-863" } ] } ], "references": [ { "url": "https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b", "source": "security-advisories@github.com" }, { "url": "https://github.com/FasterXML/jackson-databind/issues/6060", "source": "security-advisories@github.com" }, { "url": "https://github.com/FasterXML/jackson-databind/pull/6056", "source": "security-advisories@github.com" }, { "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh", "source": "security-advisories@github.com" } ] } }, { "cve": { "id": "CVE-2026-66299", "sourceIdentifier": "security@apache.org", "published": "2026-07-28T15:17:50.210", "lastModified": "2026-08-27T16:24:41.670", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.\n\nThis issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.\n\nUsers are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M20", "lessThanOrEqual": "11.0.24", "versionType": "semver", "status": "affected" }, { "version": "10.1.24", "lessThanOrEqual": "10.1.57", "versionType": "semver", "status": "affected" }, { "version": "9.0.89", "lessThanOrEqual": "9.0.120", "versionType": "semver", "status": "affected" }, { "version": "0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "unaffected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "nvd@nist.gov", "type": "Primary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW" }, "exploitabilityScore": 3.9, "impactScore": 1.4 }, { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-07-28T17:39:48.240123Z", "id": "CVE-2026-66299", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-400" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.89", "versionEndExcluding": "9.0.121", "matchCriteriaId": "4B8784DF-337E-4955-B7B4-B352E17A51D3" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.24", "versionEndExcluding": "10.1.58", "matchCriteriaId": "603322DF-B852-4112-A8E7-0447A122A894" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.1", "versionEndExcluding": "11.0.25", "matchCriteriaId": "DF30E912-1C80-4AEA-8C14-BB32B416EFEA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*", "matchCriteriaId": "77BA6600-0890-4BA1-B447-EC1746BAB4FD" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*", "matchCriteriaId": "7914D26B-CBD6-4846-9BD3-403708D69319" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*", "matchCriteriaId": "123C6285-03BE-49FC-B821-8BDB25D02863" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*", "matchCriteriaId": "8A28C2E2-B7BC-46CE-94E4-AE3EF172AA47" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*", "matchCriteriaId": "069B0D8E-8223-4C4E-A834-C6235D6C3450" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*", "matchCriteriaId": "E6282085-5716-4874-B0B0-180ECDEE128F" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:*", "matchCriteriaId": "899B6FF0-8701-47E7-8EDA-428A6D48786D" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/8owczcc1o8qw1rxmg9gvfk4w2jnh4l5k", "source": "security@apache.org", "tags": [ "Mailing List", "Vendor Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/28/25", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-71497", "sourceIdentifier": "security-advisories@github.com", "published": "2026-08-06T22:18:32.043", "lastModified": "2026-09-10T20:41:33.140", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [ { "lang": "en", "value": "jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1." } ], "affected": [ { "source": "security-advisories@github.com", "affectedData": [ { "vendor": "jhy", "product": "jsoup", "versions": [ { "version": ">= 1.14.3, < 1.23.1", "status": "affected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "security-advisories@github.com", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 4.7, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE" }, "exploitabilityScore": 1.6, "impactScore": 2.7 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-07T14:37:48.066416Z", "id": "CVE-2026-71497", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security-advisories@github.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-79" } ] } ], "references": [ { "url": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70", "source": "security-advisories@github.com" }, { "url": "https://github.com/jhy/jsoup/issues/2538", "source": "security-advisories@github.com" }, { "url": "https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1", "source": "security-advisories@github.com" }, { "url": "https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8", "source": "security-advisories@github.com" } ] } }, { "cve": { "id": "CVE-2026-65182", "sourceIdentifier": "security@apache.org", "published": "2026-08-25T22:17:04.900", "lastModified": "2026-08-27T15:27:26.040", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.24", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.57", "versionType": "semver", "status": "affected" }, { "version": "9.0.0.M1", "lessThanOrEqual": "9.0.120", "versionType": "semver", "status": "affected" }, { "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "7.0.0", "lessThanOrEqual": "7.0.109", "versionType": "semver", "status": "affected" }, { "version": "0", "lessThan": "7.0.0", "versionType": "semver", "status": "unknown" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE" }, "exploitabilityScore": 3.9, "impactScore": 5.2 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-26T15:17:14.686440Z", "id": "CVE-2026-65182", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-284" }, { "lang": "en", "value": "CWE-863" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndIncluding": "7.0.109", "matchCriteriaId": "5BE0EC99-5BCD-4F7F-8124-4A1734B7BF6B" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.0", "versionEndExcluding": "9.0.121", "matchCriteriaId": "9F374FF7-8FFF-476A-8F8B-7BD7597FD546" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.58", "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.25", "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/26/1", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "Mailing List" ] } ] } }, { "cve": { "id": "CVE-2026-65183", "sourceIdentifier": "security@apache.org", "published": "2026-08-25T22:17:05.050", "lastModified": "2026-08-27T15:26:04.837", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.24", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.57", "versionType": "semver", "status": "affected" }, { "version": "9.0.42", "lessThanOrEqual": "9.0.120", "versionType": "semver", "status": "affected" }, { "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "unaffected" }, { "version": "7.0.0", "lessThanOrEqual": "7.0.109", "versionType": "semver", "status": "unaffected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" }, "exploitabilityScore": 2.2, "impactScore": 5.9 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-26T15:18:45.492907Z", "id": "CVE-2026-65183", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-367" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.42", "versionEndExcluding": "9.0.121", "matchCriteriaId": "B6149730-D005-45B4-85C5-977EE6D6254C" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.58", "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.25", "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/748o4st6d5dk6n3l7tgzo5yl68gg05c0", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/26/2", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "Mailing List" ] } ] } }, { "cve": { "id": "CVE-2026-65637", "sourceIdentifier": "security@apache.org", "published": "2026-08-25T22:17:05.177", "lastModified": "2026-08-27T15:19:42.247", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.20", "lessThanOrEqual": "11.0.24", "versionType": "semver", "status": "affected" }, { "version": "10.1.53", "lessThanOrEqual": "10.1.57", "versionType": "semver", "status": "affected" }, { "version": "9.0.115", "lessThanOrEqual": "9.0.120", "versionType": "semver", "status": "affected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" }, "exploitabilityScore": 3.9, "impactScore": 5.9 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-26T15:20:15.521688Z", "id": "CVE-2026-65637", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-20" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.115", "versionEndExcluding": "9.0.121", "matchCriteriaId": "0267823D-98C8-4283-B198-185275D06486" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.53", "versionEndExcluding": "10.1.58", "matchCriteriaId": "85549589-C5B3-4093-ABF2-37528529AE65" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.20", "versionEndExcluding": "11.0.25", "matchCriteriaId": "3070A357-ABBD-4CE7-894B-CAB8F8E9F342" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/djog953z1ohsyt25bdvhfzbmsy22vgcj", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] } ] } }, { "cve": { "id": "CVE-2026-65905", "sourceIdentifier": "security@apache.org", "published": "2026-08-25T22:17:05.303", "lastModified": "2026-08-27T15:17:49.277", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST \nauthenticated request with a nonceCount on the upper boundary of the \nreplay window then that request is replayable once only while the \nassociated nonceCount remains within the replay window.\n\n\n\n\u00a0\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected:\u00a0from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.24", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.57", "versionType": "semver", "status": "affected" }, { "version": "9.0.0.M1", "lessThanOrEqual": "9.0.120", "versionType": "semver", "status": "affected" }, { "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "7.0.30", "lessThanOrEqual": "7.0.109", "versionType": "semver", "status": "affected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" }, "exploitabilityScore": 3.9, "impactScore": 5.9 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-26T15:20:56.087834Z", "id": "CVE-2026-65905", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-294" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.30", "versionEndIncluding": "7.0.109", "matchCriteriaId": "35BA6F8E-F0FE-45C1-AD04-576025B89780" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.0", "versionEndExcluding": "9.0.121", "matchCriteriaId": "9F374FF7-8FFF-476A-8F8B-7BD7597FD546" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.58", "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.25", "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/26/4", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "Mailing List" ] } ] } }, { "cve": { "id": "CVE-2026-65927", "sourceIdentifier": "security@apache.org", "published": "2026-08-25T22:17:05.433", "lastModified": "2026-08-27T15:17:08.267", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the second rule rather than the first rule.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121 which fix the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.24", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.57", "versionType": "semver", "status": "affected" }, { "version": "9.0.0.M1", "lessThanOrEqual": "9.0.120", "versionType": "semver", "status": "affected" }, { "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "7.0.0", "lessThanOrEqual": "7.0.109", "versionType": "semver", "status": "unaffected" }, { "version": "0", "lessThan": "7.0.0", "versionType": "semver", "status": "unaffected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-26T15:21:40.924718Z", "id": "CVE-2026-65927", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-193" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.0", "versionEndExcluding": "9.0.121", "matchCriteriaId": "9F374FF7-8FFF-476A-8F8B-7BD7597FD546" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.58", "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.25", "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/st1dx1zyn5y7ny2s0sscmh6lrv3worr4", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/26/5", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "Mailing List" ] } ] } }, { "cve": { "id": "CVE-2026-66422", "sourceIdentifier": "security@apache.org", "published": "2026-08-25T22:17:05.560", "lastModified": "2026-08-27T15:16:11.953", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole().\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.46 through 8.5.100, from 7.0.97 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.24", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.57", "versionType": "semver", "status": "affected" }, { "version": "9.0.25", "lessThanOrEqual": "9.0.120", "versionType": "semver", "status": "affected" }, { "version": "8.5.46", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "7.0.97", "lessThanOrEqual": "7.0.109", "versionType": "semver", "status": "affected" }, { "version": "0", "lessThan": "7.0.97", "versionType": "semver", "status": "unaffected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" }, "exploitabilityScore": 2.8, "impactScore": 5.2 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-26T18:52:06.586786Z", "id": "CVE-2026-66422", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-285" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.97", "versionEndIncluding": "7.0.109", "matchCriteriaId": "2B90D4D8-1D4B-44A5-9C99-13C18914F5F4" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.46", "versionEndExcluding": "9.0.121", "matchCriteriaId": "3DD84434-9BE8-40F1-8E6B-CD2BE62A18EB" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.58", "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.25", "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/j5plylz1b2vhqvbkqn7k58nygxhcpk73", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/26/6", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "Mailing List" ] } ] } }, { "cve": { "id": "CVE-2026-68525", "sourceIdentifier": "security@apache.org", "published": "2026-08-25T22:17:05.700", "lastModified": "2026-08-27T15:15:02.453", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.\n\n\n\n\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.24", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.57", "versionType": "semver", "status": "affected" }, { "version": "9.0.0.M1", "lessThanOrEqual": "9.0.120", "versionType": "semver", "status": "affected" }, { "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "7.0.0", "lessThanOrEqual": "7.0.109", "versionType": "semver", "status": "affected" }, { "version": "0", "lessThan": "7.0.0", "versionType": "semver", "status": "unknown" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE" }, "exploitabilityScore": 3.9, "impactScore": 5.2 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-26T18:40:39.554877Z", "id": "CVE-2026-68525", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-863" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndIncluding": "7.0.109", "matchCriteriaId": "5BE0EC99-5BCD-4F7F-8124-4A1734B7BF6B" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.0", "versionEndExcluding": "9.0.121", "matchCriteriaId": "9F374FF7-8FFF-476A-8F8B-7BD7597FD546" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.58", "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.25", "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/26/7", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "Mailing List" ] } ] } }, { "cve": { "id": "CVE-2026-68569", "sourceIdentifier": "security@apache.org", "published": "2026-08-25T22:17:05.837", "lastModified": "2026-09-21T12:17:17.257", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPNEGO) that a user would be authenticated even if the user did not exist in the DataSourceRealm.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\n\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.24", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.57", "versionType": "semver", "status": "affected" }, { "version": "9.0.0.M1", "lessThanOrEqual": "9.0.120", "versionType": "semver", "status": "affected" }, { "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "7.0.0", "lessThanOrEqual": "7.0.109", "versionType": "semver", "status": "affected" }, { "version": "0", "lessThan": "7.0.0", "versionType": "semver", "status": "unknown" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE" }, "exploitabilityScore": 2.8, "impactScore": 5.2 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-26T18:38:39.170628Z", "id": "CVE-2026-68569", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-287" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndIncluding": "7.0.109", "matchCriteriaId": "5BE0EC99-5BCD-4F7F-8124-4A1734B7BF6B" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.0", "versionEndExcluding": "9.0.121", "matchCriteriaId": "9F374FF7-8FFF-476A-8F8B-7BD7597FD546" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.58", "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.25", "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/8robqo76q0osxgw0b5lcwgz0hcf9h4zc", "source": "security@apache.org", "tags": [ "Mailing List", "Vendor Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/26/8", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-68763", "sourceIdentifier": "security@apache.org", "published": "2026-08-25T22:17:05.970", "lastModified": "2026-08-27T13:02:31.670", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat\u00a0via an allocation leak in the HTTP/2 backlog tracking when a stream is reset\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.59 through 8.5.100.\u00a0Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.24", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.57", "versionType": "semver", "status": "affected" }, { "version": "9.0.39", "lessThanOrEqual": "9.0.120", "versionType": "semver", "status": "affected" }, { "version": "8.5.59", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "0", "lessThanOrEqual": "7.0.109", "versionType": "semver", "status": "unaffected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-26T18:36:23.912058Z", "id": "CVE-2026-68763", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-400" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.59", "versionEndExcluding": "9.0.121", "matchCriteriaId": "3C36D2B7-A159-4A7A-B0D3-DB0551E60FEB" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.58", "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.25", "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/tv51ty39ppv41v04hdtkp9dp7tg02nzl", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/26/9", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "Mailing List" ] } ] } }, { "cve": { "id": "CVE-2026-73180", "sourceIdentifier": "security@apache.org", "published": "2026-08-25T22:17:06.107", "lastModified": "2026-08-27T12:40:56.270", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the Jakarta WebSocket specification when the HTTP session ended.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109.\u00a0Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue." } ], "affected": [ { "source": "security@apache.org", "affectedData": [ { "vendor": "Apache Software Foundation", "product": "Apache Tomcat", "defaultStatus": "unaffected", "versions": [ { "version": "11.0.0-M1", "lessThanOrEqual": "11.0.24", "versionType": "semver", "status": "affected" }, { "version": "10.1.0-M1", "lessThanOrEqual": "10.1.57", "versionType": "semver", "status": "affected" }, { "version": "9.0.0.M1", "lessThanOrEqual": "9.0.120", "versionType": "semver", "status": "affected" }, { "version": "8.5.0", "lessThanOrEqual": "8.5.100", "versionType": "semver", "status": "affected" }, { "version": "7.0.43", "lessThanOrEqual": "7.0.109", "versionType": "semver", "status": "affected" }, { "version": "0", "lessThan": "7.0.43", "versionType": "semver", "status": "unaffected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE" }, "exploitabilityScore": 1.6, "impactScore": 5.2 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-26T18:34:56.514848Z", "id": "CVE-2026-73180", "options": [ { "exploitation": "none" }, { "automatable": "no" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "security@apache.org", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-613" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.43", "versionEndIncluding": "7.0.109", "matchCriteriaId": "47D7D0FB-020D-4E2E-ACB3-D926993051ED" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.5.0", "versionEndExcluding": "9.0.121", "matchCriteriaId": "9F374FF7-8FFF-476A-8F8B-7BD7597FD546" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.1.0", "versionEndExcluding": "10.1.58", "matchCriteriaId": "DA02FDED-4F4C-4869-ADE9-03940EFA84FA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.25", "matchCriteriaId": "AAF1D122-DBBD-4352-A9DB-61BC216F2C45" } ] } ] } ], "references": [ { "url": "https://lists.apache.org/thread/3j15vztszpyqss253mjq5v1kp7s6hooq", "source": "security@apache.org", "tags": [ "Vendor Advisory", "Mailing List" ] }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/26/10", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory", "Mailing List" ] } ] } }, { "cve": { "id": "CVE-2026-47886", "sourceIdentifier": "security@vmware.com", "published": "2026-08-27T06:17:19.053", "lastModified": "2026-09-10T14:25:17.517", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19\nSpring Framework 6.1.0 - 6.1.28\nSpring Framework 6.0.0 - 6.0.30\nSpring Framework 5.3.0 - 5.3.49\nSpring Framework 5.2.25.RELEASE and earlier" } ], "affected": [ { "source": "security@vmware.com", "affectedData": [ { "vendor": "Spring", "product": "Spring Framework", "defaultStatus": "unaffected", "versions": [ { "version": "7.0.0", "lessThanOrEqual": "7.0.8", "versionType": "custom", "status": "affected" }, { "version": "6.2.0", "lessThanOrEqual": "6.2.19", "versionType": "custom", "status": "affected" }, { "version": "6.1.0", "lessThanOrEqual": "6.1.28", "versionType": "custom", "status": "affected" }, { "version": "6.0.0", "lessThanOrEqual": "6.0.30", "versionType": "custom", "status": "affected" }, { "version": "5.3.0", "lessThanOrEqual": "5.3.49", "versionType": "custom", "status": "affected" }, { "version": "0", "lessThanOrEqual": "5.2.25.RELEASE", "versionType": "custom", "status": "affected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-27T14:59:39.970725Z", "id": "CVE-2026-47886", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-400" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.2.26", "matchCriteriaId": "30EF6490-8C00-47AA-92FD-20E4B85D2CAE" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3.0", "versionEndExcluding": "5.3.50", "matchCriteriaId": "041DE7D7-3D90-4E6F-B086-63D8E0505527" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.0.31", "matchCriteriaId": "BF7734A6-972B-4AA3-B52F-4CC72AD9DAEA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndExcluding": "6.1.29", "matchCriteriaId": "6E5F1411-93C7-440E-9489-8AFF4AA60784" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2.0", "versionEndExcluding": "6.2.20", "matchCriteriaId": "B93122A2-48F7-4784-AE33-143DB012EC03" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.0.8.1", "matchCriteriaId": "6CB099EC-F3CA-4AB4-AD9F-B3AE73DE5EA5" } ] } ] } ], "references": [ { "url": "https://spring.io/security/cve-2026-47886", "source": "security@vmware.com", "tags": [ "Vendor Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-59282", "sourceIdentifier": "security@vmware.com", "published": "2026-08-27T20:17:54.370", "lastModified": "2026-09-02T17:02:04.760", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19\nSpring Framework 6.1.0 - 6.1.28\nSpring Framework 6.0.0 - 6.0.30\nSpring Framework 5.3.0 - 5.3.49\nSpring Framework 5.2.25.RELEASE and earlier" } ], "affected": [ { "source": "security@vmware.com", "affectedData": [ { "vendor": "Spring", "product": "Spring Framework", "defaultStatus": "unaffected", "versions": [ { "version": "7.0.0", "lessThanOrEqual": "7.0.8", "versionType": "custom", "status": "affected" }, { "version": "6.2.0", "lessThanOrEqual": "6.2.19", "versionType": "custom", "status": "affected" }, { "version": "6.1.0", "lessThanOrEqual": "6.1.28", "versionType": "custom", "status": "affected" }, { "version": "6.0.0", "lessThanOrEqual": "6.0.30", "versionType": "custom", "status": "affected" }, { "version": "5.3.0", "lessThanOrEqual": "5.3.49", "versionType": "custom", "status": "affected" }, { "version": "0", "lessThanOrEqual": "5.2.25.RELEASE", "versionType": "custom", "status": "affected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-28T18:30:35.298446Z", "id": "CVE-2026-59282", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-400" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.2.26", "matchCriteriaId": "30EF6490-8C00-47AA-92FD-20E4B85D2CAE" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3.0", "versionEndExcluding": "5.3.50", "matchCriteriaId": "041DE7D7-3D90-4E6F-B086-63D8E0505527" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.0.31", "matchCriteriaId": "BF7734A6-972B-4AA3-B52F-4CC72AD9DAEA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndExcluding": "6.1.29", "matchCriteriaId": "6E5F1411-93C7-440E-9489-8AFF4AA60784" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2.0", "versionEndExcluding": "6.2.20", "matchCriteriaId": "B93122A2-48F7-4784-AE33-143DB012EC03" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.0.8.1", "matchCriteriaId": "6CB099EC-F3CA-4AB4-AD9F-B3AE73DE5EA5" } ] } ] } ], "references": [ { "url": "https://spring.io/security/cve-2026-59282", "source": "security@vmware.com", "tags": [ "Vendor Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-59283", "sourceIdentifier": "security@vmware.com", "published": "2026-08-27T20:17:54.470", "lastModified": "2026-09-01T13:57:20.427", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard bypass when the SpEL expression compiler is active.\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19\nSpring Framework 6.1.0 - 6.1.28\nSpring Framework 6.0.0 - 6.0.30\nSpring Framework 5.3.0 - 5.3.49\nSpring Framework 5.2.25.RELEASE and earlier" } ], "affected": [ { "source": "security@vmware.com", "affectedData": [ { "vendor": "Spring", "product": "Spring Framework", "defaultStatus": "unaffected", "versions": [ { "version": "7.0.0", "lessThanOrEqual": "7.0.8", "versionType": "custom", "status": "affected" }, { "version": "6.2.0", "lessThanOrEqual": "6.2.19", "versionType": "custom", "status": "affected" }, { "version": "6.1.0", "lessThanOrEqual": "6.1.28", "versionType": "custom", "status": "affected" }, { "version": "6.0.0", "lessThanOrEqual": "6.0.30", "versionType": "custom", "status": "affected" }, { "version": "5.3.0", "lessThanOrEqual": "5.3.49", "versionType": "custom", "status": "affected" }, { "version": "0", "lessThanOrEqual": "5.2.25.RELEASE", "versionType": "custom", "status": "affected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" }, "exploitabilityScore": 3.9, "impactScore": 5.2 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-28T18:40:32.707977Z", "id": "CVE-2026-59283", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-913" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionEndExcluding": "5.2.26", "matchCriteriaId": "30EF6490-8C00-47AA-92FD-20E4B85D2CAE" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3.0", "versionEndExcluding": "5.3.50", "matchCriteriaId": "041DE7D7-3D90-4E6F-B086-63D8E0505527" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.0.31", "matchCriteriaId": "BF7734A6-972B-4AA3-B52F-4CC72AD9DAEA" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndExcluding": "6.1.29", "matchCriteriaId": "6E5F1411-93C7-440E-9489-8AFF4AA60784" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2.0", "versionEndExcluding": "6.2.20", "matchCriteriaId": "B93122A2-48F7-4784-AE33-143DB012EC03" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.0.8.1", "matchCriteriaId": "6CB099EC-F3CA-4AB4-AD9F-B3AE73DE5EA5" } ] } ] } ], "references": [ { "url": "https://spring.io/security/cve-2026-59283", "source": "security@vmware.com", "tags": [ "Vendor Advisory" ] } ] } }, { "cve": { "id": "CVE-2026-59313", "sourceIdentifier": "security@vmware.com", "published": "2026-08-27T20:17:57.343", "lastModified": "2026-08-31T18:04:07.453", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [ { "lang": "en", "value": "Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events (SSE).\nSpring Framework 7.0.0 - 7.0.8\nSpring Framework 6.2.0 - 6.2.19\nSpring Framework 6.1.0 - 6.1.28\nSpring Framework 6.0.0 - 6.0.30\nSpring Framework 5.3.0 - 5.3.49" } ], "affected": [ { "source": "security@vmware.com", "affectedData": [ { "vendor": "Spring", "product": "Spring Framework", "defaultStatus": "unaffected", "versions": [ { "version": "7.0.0", "lessThanOrEqual": "7.0.8", "versionType": "custom", "status": "affected" }, { "version": "6.2.0", "lessThanOrEqual": "6.2.19", "versionType": "custom", "status": "affected" }, { "version": "6.1.0", "lessThanOrEqual": "6.1.28", "versionType": "custom", "status": "affected" }, { "version": "6.0.0", "lessThanOrEqual": "6.0.30", "versionType": "custom", "status": "affected" }, { "version": "5.3.0", "lessThanOrEqual": "5.3.49", "versionType": "custom", "status": "affected" } ] } ] } ], "metrics": { "cvssMetricV31": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH" }, "exploitabilityScore": 3.9, "impactScore": 5.9 } ], "ssvcV203": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": { "timestamp": "2026-08-28T19:58:16.605774Z", "id": "CVE-2026-59313", "options": [ { "exploitation": "none" }, { "automatable": "yes" }, { "technicalImpact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } ] }, "weaknesses": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-93" } ] } ], "configurations": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3.0", "versionEndIncluding": "5.3.49", "matchCriteriaId": "07A1F231-2A12-40D9-BA00-8FD78EA2687A" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndIncluding": "6.0.30", "matchCriteriaId": "49FF6A55-CC96-40FF-956F-6714CE1FA506" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndIncluding": "6.1.28", "matchCriteriaId": "A3EB7E93-6F61-470D-9394-DD4B693802A6" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2.0", "versionEndIncluding": "6.2.19", "matchCriteriaId": "918B9B37-BB57-4A69-8615-E97EF862309A" }, { "vulnerable": true, "criteria": "cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndIncluding": "7.0.8", "matchCriteriaId": "784D50C8-34A2-4C76-91BD-095108C7F58E" } ] } ] } ], "references": [ { "url": "https://spring.io/security/cve-2026-59313", "source": "security@vmware.com", "tags": [ "Vendor Advisory" ] } ] } } ] }