Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.tomcat/tomcat@10.1.24
Typemaven
Namespaceorg.apache.tomcat
Nametomcat
Version10.1.24
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version10.1.55
Latest_non_vulnerable_version11.0.22
Affected_by_vulnerabilities
0
url VCID-2rmy-13ym-3bgm
vulnerability_id VCID-2rmy-13ym-3bgm
summary
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34483.json
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34483.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-34483
reference_id
reference_type
scores
0
value 0.00031
scoring_system epss
scoring_elements 0.08846
published_at 2026-04-12T12:55:00Z
1
value 0.00031
scoring_system epss
scoring_elements 0.08877
published_at 2026-04-11T12:55:00Z
2
value 0.00031
scoring_system epss
scoring_elements 0.08832
published_at 2026-04-13T12:55:00Z
3
value 0.00082
scoring_system epss
scoring_elements 0.23801
published_at 2026-04-29T12:55:00Z
4
value 0.00082
scoring_system epss
scoring_elements 0.23843
published_at 2026-04-26T12:55:00Z
5
value 0.00082
scoring_system epss
scoring_elements 0.23854
published_at 2026-04-24T12:55:00Z
6
value 0.00082
scoring_system epss
scoring_elements 0.23977
published_at 2026-04-21T12:55:00Z
7
value 0.00082
scoring_system epss
scoring_elements 0.23995
published_at 2026-04-18T12:55:00Z
8
value 0.00082
scoring_system epss
scoring_elements 0.24008
published_at 2026-04-16T12:55:00Z
9
value 0.00082
scoring_system epss
scoring_elements 0.23835
published_at 2026-05-09T12:55:00Z
10
value 0.00082
scoring_system epss
scoring_elements 0.23764
published_at 2026-05-07T12:55:00Z
11
value 0.00082
scoring_system epss
scoring_elements 0.2368
published_at 2026-05-05T12:55:00Z
12
value 0.00091
scoring_system epss
scoring_elements 0.25577
published_at 2026-05-14T12:55:00Z
13
value 0.00091
scoring_system epss
scoring_elements 0.25482
published_at 2026-05-11T12:55:00Z
14
value 0.00091
scoring_system epss
scoring_elements 0.25499
published_at 2026-05-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-34483
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/tomcat
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat
4
reference_url https://github.com/apache/tomcat/commit/97566842589d0b80de138ca719378861fd017d68
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/97566842589d0b80de138ca719378861fd017d68
5
reference_url https://github.com/apache/tomcat/commit/f22dc2ce6cfda8609ed86816c0d78e1a9cbadb06
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/f22dc2ce6cfda8609ed86816c0d78e1a9cbadb06
6
reference_url https://github.com/apache/tomcat/commit/f9ddc24fcfcdfaea4a6953198d8636aca3e957bc
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/f9ddc24fcfcdfaea4a6953198d8636aca3e957bc
7
reference_url https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T20:16:32Z/
url https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-34483
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-34483
9
reference_url http://www.openwall.com/lists/oss-security/2026/04/09/26
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2026/04/09/26
10
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356
reference_id 1133356
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356
11
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357
reference_id 1133357
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2457044
reference_id 2457044
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2457044
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34483
reference_id CVE-2026-34483
reference_type
scores
0
value Low
scoring_system apache_tomcat
scoring_elements
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34483
14
reference_url https://github.com/advisories/GHSA-rv64-5gf8-9qq8
reference_id GHSA-rv64-5gf8-9qq8
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rv64-5gf8-9qq8
fixed_packages
0
url pkg:maven/org.apache.tomcat/tomcat@10.1.54
purl pkg:maven/org.apache.tomcat/tomcat@10.1.54
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2b4b-b29n-xqbf
1
vulnerability VCID-2xj4-ez2z-cqcd
2
vulnerability VCID-95ew-nvd2-4uhu
3
vulnerability VCID-f2y6-wdzk-3ugu
4
vulnerability VCID-jgnm-7wnr-j3cy
5
vulnerability VCID-mm1u-x9eu-s3dr
6
vulnerability VCID-qqtd-9qtt-6kee
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.54
1
url pkg:maven/org.apache.tomcat/tomcat@11.0.21
purl pkg:maven/org.apache.tomcat/tomcat@11.0.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2b4b-b29n-xqbf
1
vulnerability VCID-2xj4-ez2z-cqcd
2
vulnerability VCID-95ew-nvd2-4uhu
3
vulnerability VCID-f2y6-wdzk-3ugu
4
vulnerability VCID-jgnm-7wnr-j3cy
5
vulnerability VCID-mm1u-x9eu-s3dr
6
vulnerability VCID-qqtd-9qtt-6kee
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.21
aliases CVE-2026-34483, GHSA-rv64-5gf8-9qq8
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-2rmy-13ym-3bgm
1
url VCID-3vdn-j7sj-dfdn
vulnerability_id VCID-3vdn-j7sj-dfdn
summary 
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89.


The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected.


Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.



Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38286.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-38286.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-38286
reference_id
reference_type
scores
0
value 0.00401
scoring_system epss
scoring_elements 0.60908
published_at 2026-05-14T12:55:00Z
1
value 0.00401
scoring_system epss
scoring_elements 0.60851
published_at 2026-05-12T12:55:00Z
2
value 0.00401
scoring_system epss
scoring_elements 0.60824
published_at 2026-05-11T12:55:00Z
3
value 0.00401
scoring_system epss
scoring_elements 0.60862
published_at 2026-05-09T12:55:00Z
4
value 0.00401
scoring_system epss
scoring_elements 0.60822
published_at 2026-04-16T12:55:00Z
5
value 0.00401
scoring_system epss
scoring_elements 0.60812
published_at 2026-04-21T12:55:00Z
6
value 0.00401
scoring_system epss
scoring_elements 0.6079
published_at 2026-04-09T12:55:00Z
7
value 0.00401
scoring_system epss
scoring_elements 0.60774
published_at 2026-04-08T12:55:00Z
8
value 0.00401
scoring_system epss
scoring_elements 0.60726
published_at 2026-04-07T12:55:00Z
9
value 0.00401
scoring_system epss
scoring_elements 0.60761
published_at 2026-04-04T12:55:00Z
10
value 0.00401
scoring_system epss
scoring_elements 0.60731
published_at 2026-04-02T12:55:00Z
11
value 0.00401
scoring_system epss
scoring_elements 0.60805
published_at 2026-05-07T12:55:00Z
12
value 0.00401
scoring_system epss
scoring_elements 0.60757
published_at 2026-05-05T12:55:00Z
13
value 0.00401
scoring_system epss
scoring_elements 0.60806
published_at 2026-04-29T12:55:00Z
14
value 0.00401
scoring_system epss
scoring_elements 0.60814
published_at 2026-04-26T12:55:00Z
15
value 0.00401
scoring_system epss
scoring_elements 0.60801
published_at 2026-04-24T12:55:00Z
16
value 0.00401
scoring_system epss
scoring_elements 0.60828
published_at 2026-04-18T12:55:00Z
17
value 0.00401
scoring_system epss
scoring_elements 0.60779
published_at 2026-04-13T12:55:00Z
18
value 0.00401
scoring_system epss
scoring_elements 0.60798
published_at 2026-04-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-38286
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/tomcat
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value 7.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat
4
reference_url https://github.com/apache/tomcat/commit/3197862639732e16ec1164557bcd289ebc116c93
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value 7.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat/commit/3197862639732e16ec1164557bcd289ebc116c93
5
reference_url https://github.com/apache/tomcat/commit/3344c17cef094da4bb616f4186ed32039627b543
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value 7.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat/commit/3344c17cef094da4bb616f4186ed32039627b543
6
reference_url https://github.com/apache/tomcat/commit/76c5cce6f0bcef14b0c21c38910371ca7d322d13
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value 7.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat/commit/76c5cce6f0bcef14b0c21c38910371ca7d322d13
7
reference_url https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value 7.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-07T16:33:49Z/
url https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s
8
reference_url https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value 7.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2025/01/msg00009.html
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-38286
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value 7.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-38286
10
reference_url https://security.netapp.com/advisory/ntap-20241101-0010
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value 7.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20241101-0010
11
reference_url http://www.openwall.com/lists/oss-security/2024/09/23/2
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value 7.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
2
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2024/09/23/2
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2314686
reference_id 2314686
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2314686
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38286
reference_id CVE-2024-38286
reference_type
scores
0
value Important
scoring_system apache_tomcat
scoring_elements
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38286
14
reference_url https://github.com/advisories/GHSA-7jqf-v358-p8g7
reference_id GHSA-7jqf-v358-p8g7
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-7jqf-v358-p8g7
15
reference_url https://access.redhat.com/errata/RHSA-2024:4976
reference_id RHSA-2024:4976
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:4976
16
reference_url https://access.redhat.com/errata/RHSA-2024:4977
reference_id RHSA-2024:4977
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:4977
17
reference_url https://access.redhat.com/errata/RHSA-2024:5024
reference_id RHSA-2024:5024
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5024
18
reference_url https://access.redhat.com/errata/RHSA-2024:5025
reference_id RHSA-2024:5025
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5025
19
reference_url https://access.redhat.com/errata/RHSA-2024:5693
reference_id RHSA-2024:5693
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5693
20
reference_url https://access.redhat.com/errata/RHSA-2024:5694
reference_id RHSA-2024:5694
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5694
21
reference_url https://access.redhat.com/errata/RHSA-2024:5695
reference_id RHSA-2024:5695
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5695
22
reference_url https://access.redhat.com/errata/RHSA-2024:5696
reference_id RHSA-2024:5696
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5696
23
reference_url https://access.redhat.com/errata/RHSA-2024:8494
reference_id RHSA-2024:8494
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:8494
24
reference_url https://access.redhat.com/errata/RHSA-2024:8497
reference_id RHSA-2024:8497
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:8497
25
reference_url https://access.redhat.com/errata/RHSA-2024:8528
reference_id RHSA-2024:8528
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:8528
26
reference_url https://access.redhat.com/errata/RHSA-2024:8543
reference_id RHSA-2024:8543
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:8543
27
reference_url https://access.redhat.com/errata/RHSA-2024:8567
reference_id RHSA-2024:8567
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:8567
28
reference_url https://access.redhat.com/errata/RHSA-2024:8572
reference_id RHSA-2024:8572
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:8572
29
reference_url https://usn.ubuntu.com/7562-1/
reference_id USN-7562-1
reference_type
scores
url https://usn.ubuntu.com/7562-1/
fixed_packages
0
url pkg:maven/org.apache.tomcat/tomcat@10.1.25
purl pkg:maven/org.apache.tomcat/tomcat@10.1.25
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2rmy-13ym-3bgm
1
vulnerability VCID-74tx-sx8a-guhs
2
vulnerability VCID-8e1c-rbkg-v7c2
3
vulnerability VCID-8war-4v58-eub2
4
vulnerability VCID-d1fm-vbd1-n7au
5
vulnerability VCID-gyed-x6s8-ybhr
6
vulnerability VCID-zw2q-kna8-mqcm
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.25
1
url pkg:maven/org.apache.tomcat/tomcat@11.0.0-M21
purl pkg:maven/org.apache.tomcat/tomcat@11.0.0-M21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2rmy-13ym-3bgm
1
vulnerability VCID-74tx-sx8a-guhs
2
vulnerability VCID-8e1c-rbkg-v7c2
3
vulnerability VCID-8war-4v58-eub2
4
vulnerability VCID-d1fm-vbd1-n7au
5
vulnerability VCID-gyed-x6s8-ybhr
6
vulnerability VCID-yrzk-1dbk-muhy
7
vulnerability VCID-zw2q-kna8-mqcm
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.0-M21
aliases CVE-2024-38286, GHSA-7jqf-v358-p8g7
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3vdn-j7sj-dfdn
2
url VCID-74tx-sx8a-guhs
vulnerability_id VCID-74tx-sx8a-guhs
summary
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-29145.json
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-29145.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-29145
reference_id
reference_type
scores
0
value 0.00035
scoring_system epss
scoring_elements 0.10165
published_at 2026-04-24T12:55:00Z
1
value 0.00035
scoring_system epss
scoring_elements 0.10025
published_at 2026-05-05T12:55:00Z
2
value 0.00035
scoring_system epss
scoring_elements 0.10086
published_at 2026-04-29T12:55:00Z
3
value 0.00035
scoring_system epss
scoring_elements 0.10143
published_at 2026-04-26T12:55:00Z
4
value 0.00035
scoring_system epss
scoring_elements 0.10244
published_at 2026-05-09T12:55:00Z
5
value 0.00035
scoring_system epss
scoring_elements 0.10174
published_at 2026-05-07T12:55:00Z
6
value 0.00039
scoring_system epss
scoring_elements 0.11553
published_at 2026-05-12T12:55:00Z
7
value 0.00039
scoring_system epss
scoring_elements 0.11514
published_at 2026-05-11T12:55:00Z
8
value 0.00039
scoring_system epss
scoring_elements 0.11608
published_at 2026-05-14T12:55:00Z
9
value 0.00063
scoring_system epss
scoring_elements 0.19588
published_at 2026-04-12T12:55:00Z
10
value 0.00063
scoring_system epss
scoring_elements 0.19636
published_at 2026-04-11T12:55:00Z
11
value 0.00063
scoring_system epss
scoring_elements 0.19529
published_at 2026-04-13T12:55:00Z
12
value 0.0012
scoring_system epss
scoring_elements 0.3096
published_at 2026-04-16T12:55:00Z
13
value 0.0012
scoring_system epss
scoring_elements 0.30907
published_at 2026-04-21T12:55:00Z
14
value 0.0012
scoring_system epss
scoring_elements 0.30941
published_at 2026-04-18T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-29145
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/tomcat
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat
4
reference_url https://github.com/apache/tomcat/commit/721591f7bff424c693f26adc18ae9b9abac3655b
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/721591f7bff424c693f26adc18ae9b9abac3655b
5
reference_url https://github.com/apache/tomcat/commit/d1406df5ae0326f39f54c3f64ac30d8fca55cd5b
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/d1406df5ae0326f39f54c3f64ac30d8fca55cd5b
6
reference_url https://github.com/apache/tomcat/commit/fe26667cd2385045ac73f4dea086cc9971209b90
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/fe26667cd2385045ac73f4dea086cc9971209b90
7
reference_url https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T18:10:50Z/
url https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-29145
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-29145
9
reference_url http://www.openwall.com/lists/oss-security/2026/04/09/23
reference_id
reference_type
scores
0
value 9.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2026/04/09/23
10
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356
reference_id 1133356
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356
11
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357
reference_id 1133357
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2457037
reference_id 2457037
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2457037
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29145
reference_id CVE-2026-29145
reference_type
scores
0
value Moderate
scoring_system apache_tomcat
scoring_elements
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29145
14
reference_url https://github.com/advisories/GHSA-95jq-rwvf-vjx4
reference_id GHSA-95jq-rwvf-vjx4
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-95jq-rwvf-vjx4
fixed_packages
0
url pkg:maven/org.apache.tomcat/tomcat@10.1.53
purl pkg:maven/org.apache.tomcat/tomcat@10.1.53
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2rmy-13ym-3bgm
1
vulnerability VCID-8e1c-rbkg-v7c2
2
vulnerability VCID-abt4-b2cv-eygv
3
vulnerability VCID-d1fm-vbd1-n7au
4
vulnerability VCID-yrzk-1dbk-muhy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.53
1
url pkg:maven/org.apache.tomcat/tomcat@11.0.20
purl pkg:maven/org.apache.tomcat/tomcat@11.0.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2rmy-13ym-3bgm
1
vulnerability VCID-8e1c-rbkg-v7c2
2
vulnerability VCID-abt4-b2cv-eygv
3
vulnerability VCID-d1fm-vbd1-n7au
4
vulnerability VCID-yrzk-1dbk-muhy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.20
aliases CVE-2026-29145, GHSA-95jq-rwvf-vjx4
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-74tx-sx8a-guhs
3
url VCID-8e1c-rbkg-v7c2
vulnerability_id VCID-8e1c-rbkg-v7c2
summary
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34500.json
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34500.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-34500
reference_id
reference_type
scores
0
value 0.0005
scoring_system epss
scoring_elements 0.15605
published_at 2026-04-12T12:55:00Z
1
value 0.0005
scoring_system epss
scoring_elements 0.1564
published_at 2026-04-11T12:55:00Z
2
value 0.0005
scoring_system epss
scoring_elements 0.15542
published_at 2026-04-13T12:55:00Z
3
value 0.00159
scoring_system epss
scoring_elements 0.36384
published_at 2026-04-29T12:55:00Z
4
value 0.00159
scoring_system epss
scoring_elements 0.36473
published_at 2026-04-26T12:55:00Z
5
value 0.00159
scoring_system epss
scoring_elements 0.36504
published_at 2026-04-24T12:55:00Z
6
value 0.00159
scoring_system epss
scoring_elements 0.36727
published_at 2026-04-21T12:55:00Z
7
value 0.00159
scoring_system epss
scoring_elements 0.36787
published_at 2026-04-18T12:55:00Z
8
value 0.00159
scoring_system epss
scoring_elements 0.36804
published_at 2026-04-16T12:55:00Z
9
value 0.00159
scoring_system epss
scoring_elements 0.36371
published_at 2026-05-09T12:55:00Z
10
value 0.00159
scoring_system epss
scoring_elements 0.36343
published_at 2026-05-07T12:55:00Z
11
value 0.00159
scoring_system epss
scoring_elements 0.3627
published_at 2026-05-05T12:55:00Z
12
value 0.00202
scoring_system epss
scoring_elements 0.421
published_at 2026-05-14T12:55:00Z
13
value 0.00202
scoring_system epss
scoring_elements 0.42001
published_at 2026-05-11T12:55:00Z
14
value 0.00202
scoring_system epss
scoring_elements 0.42028
published_at 2026-05-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-34500
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/tomcat
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat
4
reference_url https://github.com/apache/tomcat/commit/29b56a56ce9e7d044b6162a99af0f38529b3a208
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/29b56a56ce9e7d044b6162a99af0f38529b3a208
5
reference_url https://github.com/apache/tomcat/commit/c13e60e732ea6d07087293a41ad1866c20848271
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/c13e60e732ea6d07087293a41ad1866c20848271
6
reference_url https://github.com/apache/tomcat/commit/ff589ab26e8250a2ca4286d986305318c033ff9f
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/ff589ab26e8250a2ca4286d986305318c033ff9f
7
reference_url https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T14:21:50Z/
url https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-34500
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-34500
9
reference_url http://www.openwall.com/lists/oss-security/2026/04/09/29
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2026/04/09/29
10
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356
reference_id 1133356
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356
11
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357
reference_id 1133357
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2457043
reference_id 2457043
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2457043
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34500
reference_id CVE-2026-34500
reference_type
scores
0
value Moderate
scoring_system apache_tomcat
scoring_elements
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34500
14
reference_url https://github.com/advisories/GHSA-24j9-x2wg-9qv6
reference_id GHSA-24j9-x2wg-9qv6
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-24j9-x2wg-9qv6
fixed_packages
0
url pkg:maven/org.apache.tomcat/tomcat@10.1.54
purl pkg:maven/org.apache.tomcat/tomcat@10.1.54
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2b4b-b29n-xqbf
1
vulnerability VCID-2xj4-ez2z-cqcd
2
vulnerability VCID-95ew-nvd2-4uhu
3
vulnerability VCID-f2y6-wdzk-3ugu
4
vulnerability VCID-jgnm-7wnr-j3cy
5
vulnerability VCID-mm1u-x9eu-s3dr
6
vulnerability VCID-qqtd-9qtt-6kee
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.54
1
url pkg:maven/org.apache.tomcat/tomcat@11.0.21
purl pkg:maven/org.apache.tomcat/tomcat@11.0.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2b4b-b29n-xqbf
1
vulnerability VCID-2xj4-ez2z-cqcd
2
vulnerability VCID-95ew-nvd2-4uhu
3
vulnerability VCID-f2y6-wdzk-3ugu
4
vulnerability VCID-jgnm-7wnr-j3cy
5
vulnerability VCID-mm1u-x9eu-s3dr
6
vulnerability VCID-qqtd-9qtt-6kee
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.21
aliases CVE-2026-34500, GHSA-24j9-x2wg-9qv6
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8e1c-rbkg-v7c2
4
url VCID-8myk-ac5b-huh8
vulnerability_id VCID-8myk-ac5b-huh8
summary 
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other EOL versions may also be affected.


Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-34750.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-34750.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-34750
reference_id
reference_type
scores
0
value 0.17245
scoring_system epss
scoring_elements 0.95015
published_at 2026-04-08T12:55:00Z
1
value 0.17245
scoring_system epss
scoring_elements 0.95004
published_at 2026-04-04T12:55:00Z
2
value 0.17245
scoring_system epss
scoring_elements 0.95002
published_at 2026-04-02T12:55:00Z
3
value 0.17245
scoring_system epss
scoring_elements 0.95019
published_at 2026-04-09T12:55:00Z
4
value 0.17245
scoring_system epss
scoring_elements 0.95029
published_at 2026-04-13T12:55:00Z
5
value 0.17245
scoring_system epss
scoring_elements 0.95026
published_at 2026-04-12T12:55:00Z
6
value 0.17245
scoring_system epss
scoring_elements 0.95007
published_at 2026-04-07T12:55:00Z
7
value 0.17245
scoring_system epss
scoring_elements 0.95025
published_at 2026-04-11T12:55:00Z
8
value 0.21539
scoring_system epss
scoring_elements 0.95727
published_at 2026-04-16T12:55:00Z
9
value 0.21539
scoring_system epss
scoring_elements 0.9573
published_at 2026-04-18T12:55:00Z
10
value 0.21539
scoring_system epss
scoring_elements 0.95778
published_at 2026-05-14T12:55:00Z
11
value 0.21539
scoring_system epss
scoring_elements 0.95765
published_at 2026-05-12T12:55:00Z
12
value 0.21539
scoring_system epss
scoring_elements 0.9576
published_at 2026-05-11T12:55:00Z
13
value 0.21539
scoring_system epss
scoring_elements 0.95755
published_at 2026-05-09T12:55:00Z
14
value 0.21539
scoring_system epss
scoring_elements 0.95749
published_at 2026-05-07T12:55:00Z
15
value 0.21539
scoring_system epss
scoring_elements 0.95747
published_at 2026-05-05T12:55:00Z
16
value 0.21539
scoring_system epss
scoring_elements 0.95733
published_at 2026-04-26T12:55:00Z
17
value 0.21539
scoring_system epss
scoring_elements 0.95732
published_at 2026-04-29T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-34750
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/tomcat
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat
4
reference_url https://github.com/apache/tomcat/commit/2344a4c0d03e307ba6b8ab6dc8b894cc8bac63f2
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat/commit/2344a4c0d03e307ba6b8ab6dc8b894cc8bac63f2
5
reference_url https://github.com/apache/tomcat/commit/2afae300c9ac9c0e516e2e9de580847d925365c3
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat/commit/2afae300c9ac9c0e516e2e9de580847d925365c3
6
reference_url https://github.com/apache/tomcat/commit/9fec9a82887853402833a80b584e3762c7423f5f
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat/commit/9fec9a82887853402833a80b584e3762c7423f5f
7
reference_url https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-08T16:51:20Z/
url https://lists.apache.org/thread/4kqf0bc9gxymjc2x7v3p7dvplnl77y8l
8
reference_url https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-34750
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-34750
10
reference_url https://security.netapp.com/advisory/ntap-20240816-0004
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20240816-0004
11
reference_url https://tomcat.apache.org/security-10.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://tomcat.apache.org/security-10.html
12
reference_url https://tomcat.apache.org/security-11.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://tomcat.apache.org/security-11.html
13
reference_url https://tomcat.apache.org/security-9.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
1
value 8.7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://tomcat.apache.org/security-9.html
14
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2295651
reference_id 2295651
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2295651
15
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34750
reference_id CVE-2024-34750
reference_type
scores
0
value Important
scoring_system apache_tomcat
scoring_elements
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34750
16
reference_url https://github.com/advisories/GHSA-wm9w-rjj3-j356
reference_id GHSA-wm9w-rjj3-j356
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-wm9w-rjj3-j356
17
reference_url https://access.redhat.com/errata/RHSA-2024:4976
reference_id RHSA-2024:4976
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:4976
18
reference_url https://access.redhat.com/errata/RHSA-2024:4977
reference_id RHSA-2024:4977
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:4977
19
reference_url https://access.redhat.com/errata/RHSA-2024:5024
reference_id RHSA-2024:5024
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5024
20
reference_url https://access.redhat.com/errata/RHSA-2024:5025
reference_id RHSA-2024:5025
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5025
21
reference_url https://access.redhat.com/errata/RHSA-2024:5693
reference_id RHSA-2024:5693
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5693
22
reference_url https://access.redhat.com/errata/RHSA-2024:5694
reference_id RHSA-2024:5694
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5694
23
reference_url https://access.redhat.com/errata/RHSA-2024:5695
reference_id RHSA-2024:5695
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5695
24
reference_url https://access.redhat.com/errata/RHSA-2024:5696
reference_id RHSA-2024:5696
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:5696
25
reference_url https://usn.ubuntu.com/7562-1/
reference_id USN-7562-1
reference_type
scores
url https://usn.ubuntu.com/7562-1/
fixed_packages
0
url pkg:maven/org.apache.tomcat/tomcat@10.1.25
purl pkg:maven/org.apache.tomcat/tomcat@10.1.25
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2rmy-13ym-3bgm
1
vulnerability VCID-74tx-sx8a-guhs
2
vulnerability VCID-8e1c-rbkg-v7c2
3
vulnerability VCID-8war-4v58-eub2
4
vulnerability VCID-d1fm-vbd1-n7au
5
vulnerability VCID-gyed-x6s8-ybhr
6
vulnerability VCID-zw2q-kna8-mqcm
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.25
1
url pkg:maven/org.apache.tomcat/tomcat@11.0.0-M21
purl pkg:maven/org.apache.tomcat/tomcat@11.0.0-M21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2rmy-13ym-3bgm
1
vulnerability VCID-74tx-sx8a-guhs
2
vulnerability VCID-8e1c-rbkg-v7c2
3
vulnerability VCID-8war-4v58-eub2
4
vulnerability VCID-d1fm-vbd1-n7au
5
vulnerability VCID-gyed-x6s8-ybhr
6
vulnerability VCID-yrzk-1dbk-muhy
7
vulnerability VCID-zw2q-kna8-mqcm
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.0-M21
aliases CVE-2024-34750, GHSA-wm9w-rjj3-j356
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8myk-ac5b-huh8
5
url VCID-8war-4v58-eub2
vulnerability_id VCID-8war-4v58-eub2
summary 
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.


The following versions were EOL at the time the CVE was created but are 
known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24734.json
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24734.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-24734
reference_id
reference_type
scores
0
value 0.00094
scoring_system epss
scoring_elements 0.25991
published_at 2026-05-14T12:55:00Z
1
value 0.00094
scoring_system epss
scoring_elements 0.25912
published_at 2026-05-12T12:55:00Z
2
value 0.00094
scoring_system epss
scoring_elements 0.25894
published_at 2026-05-11T12:55:00Z
3
value 0.00094
scoring_system epss
scoring_elements 0.25966
published_at 2026-05-09T12:55:00Z
4
value 0.00094
scoring_system epss
scoring_elements 0.2591
published_at 2026-05-07T12:55:00Z
5
value 0.00094
scoring_system epss
scoring_elements 0.2585
published_at 2026-05-05T12:55:00Z
6
value 0.00094
scoring_system epss
scoring_elements 0.26007
published_at 2026-04-26T12:55:00Z
7
value 0.00094
scoring_system epss
scoring_elements 0.25958
published_at 2026-04-29T12:55:00Z
8
value 0.00109
scoring_system epss
scoring_elements 0.29239
published_at 2026-04-12T12:55:00Z
9
value 0.00109
scoring_system epss
scoring_elements 0.29315
published_at 2026-04-02T12:55:00Z
10
value 0.00109
scoring_system epss
scoring_elements 0.29363
published_at 2026-04-04T12:55:00Z
11
value 0.00109
scoring_system epss
scoring_elements 0.29175
published_at 2026-04-07T12:55:00Z
12
value 0.00109
scoring_system epss
scoring_elements 0.29279
published_at 2026-04-09T12:55:00Z
13
value 0.00109
scoring_system epss
scoring_elements 0.29285
published_at 2026-04-11T12:55:00Z
14
value 0.00109
scoring_system epss
scoring_elements 0.29186
published_at 2026-04-13T12:55:00Z
15
value 0.00109
scoring_system epss
scoring_elements 0.29213
published_at 2026-04-16T12:55:00Z
16
value 0.00109
scoring_system epss
scoring_elements 0.29188
published_at 2026-04-18T12:55:00Z
17
value 0.00109
scoring_system epss
scoring_elements 0.29143
published_at 2026-04-21T12:55:00Z
18
value 0.00109
scoring_system epss
scoring_elements 0.29021
published_at 2026-04-24T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-24734
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/tomcat
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat
4
reference_url https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml
reference_id
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
1
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-21T21:16:49Z/
url https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-24734
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-24734
6
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2440426
reference_id 2440426
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2440426
7
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24734
reference_id CVE-2026-24734
reference_type
scores
0
value Moderate
scoring_system apache_tomcat
scoring_elements
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24734
8
reference_url https://github.com/advisories/GHSA-mgp5-rv84-w37q
reference_id GHSA-mgp5-rv84-w37q
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mgp5-rv84-w37q
9
reference_url https://access.redhat.com/errata/RHSA-2026:5611
reference_id RHSA-2026:5611
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:5611
10
reference_url https://access.redhat.com/errata/RHSA-2026:5612
reference_id RHSA-2026:5612
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:5612
11
reference_url https://access.redhat.com/errata/RHSA-2026:6569
reference_id RHSA-2026:6569
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:6569
12
reference_url https://access.redhat.com/errata/RHSA-2026:8334
reference_id RHSA-2026:8334
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:8334
fixed_packages
0
url pkg:maven/org.apache.tomcat/tomcat@10.1.52
purl pkg:maven/org.apache.tomcat/tomcat@10.1.52
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2rmy-13ym-3bgm
1
vulnerability VCID-35xg-a746-5qgc
2
vulnerability VCID-74tx-sx8a-guhs
3
vulnerability VCID-8e1c-rbkg-v7c2
4
vulnerability VCID-d1fm-vbd1-n7au
5
vulnerability VCID-gyed-x6s8-ybhr
6
vulnerability VCID-maw6-4qs5-ykae
7
vulnerability VCID-rsxs-u5cc-rkgj
8
vulnerability VCID-yrzk-1dbk-muhy
9
vulnerability VCID-zw2q-kna8-mqcm
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.52
1
url pkg:maven/org.apache.tomcat/tomcat@11.0.18
purl pkg:maven/org.apache.tomcat/tomcat@11.0.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2rmy-13ym-3bgm
1
vulnerability VCID-35xg-a746-5qgc
2
vulnerability VCID-74tx-sx8a-guhs
3
vulnerability VCID-8e1c-rbkg-v7c2
4
vulnerability VCID-d1fm-vbd1-n7au
5
vulnerability VCID-gyed-x6s8-ybhr
6
vulnerability VCID-rsxs-u5cc-rkgj
7
vulnerability VCID-yrzk-1dbk-muhy
8
vulnerability VCID-zw2q-kna8-mqcm
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.18
aliases CVE-2026-24734, GHSA-mgp5-rv84-w37q
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-8war-4v58-eub2
6
url VCID-d1fm-vbd1-n7au
vulnerability_id VCID-d1fm-vbd1-n7au
summary
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34487.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34487.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-34487
reference_id
reference_type
scores
0
value 0.00031
scoring_system epss
scoring_elements 0.08846
published_at 2026-04-12T12:55:00Z
1
value 0.00031
scoring_system epss
scoring_elements 0.08877
published_at 2026-04-11T12:55:00Z
2
value 0.00031
scoring_system epss
scoring_elements 0.08832
published_at 2026-04-13T12:55:00Z
3
value 0.00082
scoring_system epss
scoring_elements 0.23801
published_at 2026-04-29T12:55:00Z
4
value 0.00082
scoring_system epss
scoring_elements 0.23843
published_at 2026-04-26T12:55:00Z
5
value 0.00082
scoring_system epss
scoring_elements 0.23854
published_at 2026-04-24T12:55:00Z
6
value 0.00082
scoring_system epss
scoring_elements 0.23977
published_at 2026-04-21T12:55:00Z
7
value 0.00082
scoring_system epss
scoring_elements 0.23995
published_at 2026-04-18T12:55:00Z
8
value 0.00082
scoring_system epss
scoring_elements 0.24008
published_at 2026-04-16T12:55:00Z
9
value 0.00082
scoring_system epss
scoring_elements 0.23835
published_at 2026-05-09T12:55:00Z
10
value 0.00082
scoring_system epss
scoring_elements 0.23764
published_at 2026-05-07T12:55:00Z
11
value 0.00082
scoring_system epss
scoring_elements 0.2368
published_at 2026-05-05T12:55:00Z
12
value 0.00091
scoring_system epss
scoring_elements 0.25577
published_at 2026-05-14T12:55:00Z
13
value 0.00091
scoring_system epss
scoring_elements 0.25482
published_at 2026-05-11T12:55:00Z
14
value 0.00091
scoring_system epss
scoring_elements 0.25499
published_at 2026-05-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-34487
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/tomcat
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat
4
reference_url https://github.com/apache/tomcat/commit/301bc6efbf72feb14dacfdfa3f50372182736150
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/301bc6efbf72feb14dacfdfa3f50372182736150
5
reference_url https://github.com/apache/tomcat/commit/5eff2a773b8b728083e5195b3183df1b9e12a03d
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/5eff2a773b8b728083e5195b3183df1b9e12a03d
6
reference_url https://github.com/apache/tomcat/commit/f593292a082e5ef9336a8db2b4b522f7f3e36976
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/f593292a082e5ef9336a8db2b4b522f7f3e36976
7
reference_url https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:47:28Z/
url https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-34487
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-34487
9
reference_url http://www.openwall.com/lists/oss-security/2026/04/09/28
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2026/04/09/28
10
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356
reference_id 1133356
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356
11
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357
reference_id 1133357
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2457038
reference_id 2457038
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2457038
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34487
reference_id CVE-2026-34487
reference_type
scores
0
value Low
scoring_system apache_tomcat
scoring_elements
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34487
14
reference_url https://github.com/advisories/GHSA-x4m4-345f-5h5g
reference_id GHSA-x4m4-345f-5h5g
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-x4m4-345f-5h5g
fixed_packages
0
url pkg:maven/org.apache.tomcat/tomcat@10.1.54
purl pkg:maven/org.apache.tomcat/tomcat@10.1.54
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2b4b-b29n-xqbf
1
vulnerability VCID-2xj4-ez2z-cqcd
2
vulnerability VCID-95ew-nvd2-4uhu
3
vulnerability VCID-f2y6-wdzk-3ugu
4
vulnerability VCID-jgnm-7wnr-j3cy
5
vulnerability VCID-mm1u-x9eu-s3dr
6
vulnerability VCID-qqtd-9qtt-6kee
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.54
1
url pkg:maven/org.apache.tomcat/tomcat@11.0.21
purl pkg:maven/org.apache.tomcat/tomcat@11.0.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2b4b-b29n-xqbf
1
vulnerability VCID-2xj4-ez2z-cqcd
2
vulnerability VCID-95ew-nvd2-4uhu
3
vulnerability VCID-f2y6-wdzk-3ugu
4
vulnerability VCID-jgnm-7wnr-j3cy
5
vulnerability VCID-mm1u-x9eu-s3dr
6
vulnerability VCID-qqtd-9qtt-6kee
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.21
aliases CVE-2026-34487, GHSA-x4m4-345f-5h5g
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-d1fm-vbd1-n7au
7
url VCID-gyed-x6s8-ybhr
vulnerability_id VCID-gyed-x6s8-ybhr
summary
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24880.json
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24880.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-24880
reference_id
reference_type
scores
0
value 0.00029
scoring_system epss
scoring_elements 0.08199
published_at 2026-04-13T12:55:00Z
1
value 0.00029
scoring_system epss
scoring_elements 0.08216
published_at 2026-04-12T12:55:00Z
2
value 0.00029
scoring_system epss
scoring_elements 0.08236
published_at 2026-04-11T12:55:00Z
3
value 0.00215
scoring_system epss
scoring_elements 0.44021
published_at 2026-04-18T12:55:00Z
4
value 0.00215
scoring_system epss
scoring_elements 0.438
published_at 2026-05-09T12:55:00Z
5
value 0.00215
scoring_system epss
scoring_elements 0.43782
published_at 2026-05-07T12:55:00Z
6
value 0.00215
scoring_system epss
scoring_elements 0.43706
published_at 2026-05-05T12:55:00Z
7
value 0.00215
scoring_system epss
scoring_elements 0.43827
published_at 2026-04-29T12:55:00Z
8
value 0.00215
scoring_system epss
scoring_elements 0.44031
published_at 2026-04-16T12:55:00Z
9
value 0.00215
scoring_system epss
scoring_elements 0.43912
published_at 2026-04-26T12:55:00Z
10
value 0.00215
scoring_system epss
scoring_elements 0.43909
published_at 2026-04-24T12:55:00Z
11
value 0.00215
scoring_system epss
scoring_elements 0.43957
published_at 2026-04-21T12:55:00Z
12
value 0.0024
scoring_system epss
scoring_elements 0.46983
published_at 2026-05-12T12:55:00Z
13
value 0.0024
scoring_system epss
scoring_elements 0.47052
published_at 2026-05-14T12:55:00Z
14
value 0.0024
scoring_system epss
scoring_elements 0.46951
published_at 2026-05-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-24880
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/tomcat
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat
4
reference_url https://github.com/apache/tomcat/commit/1b586d6aa8ae65726da5fa8799427b5d4718478a
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat/commit/1b586d6aa8ae65726da5fa8799427b5d4718478a
5
reference_url https://github.com/apache/tomcat/commit/1e71441a15972f56e661b0b549fb9e5d838b83bb
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat/commit/1e71441a15972f56e661b0b549fb9e5d838b83bb
6
reference_url https://github.com/apache/tomcat/commit/2cb06c34f661ca42f7570bbcc21e99806184bcc5
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat/commit/2cb06c34f661ca42f7570bbcc21e99806184bcc5
7
reference_url https://github.com/apache/tomcat/commit/6d478dbe18b7c4bb671c30fedf130309b0dab77c
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat/commit/6d478dbe18b7c4bb671c30fedf130309b0dab77c
8
reference_url https://github.com/apache/tomcat/commit/f07df938d00f7419b40fa65aa912966d0efac522
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat/commit/f07df938d00f7419b40fa65aa912966d0efac522
9
reference_url https://github.com/apache/tomcat/commit/fde1a8235fb73125217bd41e162aa0a113f33552
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat/commit/fde1a8235fb73125217bd41e162aa0a113f33552
10
reference_url https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T18:33:19Z/
url https://lists.apache.org/thread/2c682qnlg2tv4o5knlggqbl9yc2gb5sn
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-24880
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-24880
12
reference_url https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.53
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.53
13
reference_url https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.20
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.20
14
reference_url https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.116
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.116
15
reference_url http://www.openwall.com/lists/oss-security/2026/04/09/20
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2026/04/09/20
16
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356
reference_id 1133356
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356
17
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357
reference_id 1133357
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357
18
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2457040
reference_id 2457040
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2457040
19
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24880
reference_id CVE-2026-24880
reference_type
scores
0
value Low
scoring_system apache_tomcat
scoring_elements
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24880
20
reference_url https://www.herodevs.com/vulnerability-directory/cve-2026-24880
reference_id CVE-2026-24880
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.herodevs.com/vulnerability-directory/cve-2026-24880
21
reference_url https://github.com/advisories/GHSA-563x-q5rq-57qp
reference_id GHSA-563x-q5rq-57qp
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-563x-q5rq-57qp
fixed_packages
0
url pkg:maven/org.apache.tomcat/tomcat@10.1.52
purl pkg:maven/org.apache.tomcat/tomcat@10.1.52
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2rmy-13ym-3bgm
1
vulnerability VCID-35xg-a746-5qgc
2
vulnerability VCID-74tx-sx8a-guhs
3
vulnerability VCID-8e1c-rbkg-v7c2
4
vulnerability VCID-d1fm-vbd1-n7au
5
vulnerability VCID-gyed-x6s8-ybhr
6
vulnerability VCID-maw6-4qs5-ykae
7
vulnerability VCID-rsxs-u5cc-rkgj
8
vulnerability VCID-yrzk-1dbk-muhy
9
vulnerability VCID-zw2q-kna8-mqcm
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.52
1
url pkg:maven/org.apache.tomcat/tomcat@10.1.53
purl pkg:maven/org.apache.tomcat/tomcat@10.1.53
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2rmy-13ym-3bgm
1
vulnerability VCID-8e1c-rbkg-v7c2
2
vulnerability VCID-abt4-b2cv-eygv
3
vulnerability VCID-d1fm-vbd1-n7au
4
vulnerability VCID-yrzk-1dbk-muhy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.53
2
url pkg:maven/org.apache.tomcat/tomcat@11.0.20
purl pkg:maven/org.apache.tomcat/tomcat@11.0.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2rmy-13ym-3bgm
1
vulnerability VCID-8e1c-rbkg-v7c2
2
vulnerability VCID-abt4-b2cv-eygv
3
vulnerability VCID-d1fm-vbd1-n7au
4
vulnerability VCID-yrzk-1dbk-muhy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.20
aliases CVE-2026-24880, GHSA-563x-q5rq-57qp
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gyed-x6s8-ybhr
8
url VCID-zw2q-kna8-mqcm
vulnerability_id VCID-zw2q-kna8-mqcm
summary
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25854.json
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25854.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-25854
reference_id
reference_type
scores
0
value 0.00026
scoring_system epss
scoring_elements 0.07234
published_at 2026-04-16T12:55:00Z
1
value 0.00026
scoring_system epss
scoring_elements 0.07524
published_at 2026-05-09T12:55:00Z
2
value 0.00026
scoring_system epss
scoring_elements 0.07455
published_at 2026-05-07T12:55:00Z
3
value 0.00033
scoring_system epss
scoring_elements 0.09897
published_at 2026-05-14T12:55:00Z
4
value 0.00033
scoring_system epss
scoring_elements 0.0983
published_at 2026-05-12T12:55:00Z
5
value 0.00033
scoring_system epss
scoring_elements 0.09793
published_at 2026-05-11T12:55:00Z
6
value 0.00035
scoring_system epss
scoring_elements 0.10373
published_at 2026-05-05T12:55:00Z
7
value 0.00035
scoring_system epss
scoring_elements 0.10375
published_at 2026-04-18T12:55:00Z
8
value 0.00035
scoring_system epss
scoring_elements 0.10425
published_at 2026-04-29T12:55:00Z
9
value 0.00035
scoring_system epss
scoring_elements 0.10485
published_at 2026-04-26T12:55:00Z
10
value 0.00035
scoring_system epss
scoring_elements 0.10487
published_at 2026-04-24T12:55:00Z
11
value 0.00035
scoring_system epss
scoring_elements 0.10503
published_at 2026-04-21T12:55:00Z
12
value 9e-05
scoring_system epss
scoring_elements 0.00829
published_at 2026-04-13T12:55:00Z
13
value 9e-05
scoring_system epss
scoring_elements 0.00834
published_at 2026-04-11T12:55:00Z
14
value 9e-05
scoring_system epss
scoring_elements 0.00828
published_at 2026-04-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-25854
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/tomcat
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/tomcat
4
reference_url https://github.com/apache/tomcat/commit/4c5d306001b780c9316aea5ff6502c524fb20695
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/4c5d306001b780c9316aea5ff6502c524fb20695
5
reference_url https://github.com/apache/tomcat/commit/5fb910f9a9dafa37a0c0965a1bd62a21dcf437f2
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/5fb910f9a9dafa37a0c0965a1bd62a21dcf437f2
6
reference_url https://github.com/apache/tomcat/commit/c5a45ae68d07f7a07be2a875e5b6772d66c4e5d0
reference_id
reference_type
scores
url https://github.com/apache/tomcat/commit/c5a45ae68d07f7a07be2a875e5b6772d66c4e5d0
7
reference_url https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T18:21:57Z/
url https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-25854
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-25854
9
reference_url http://www.openwall.com/lists/oss-security/2026/04/09/21
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2026/04/09/21
10
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356
reference_id 1133356
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356
11
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357
reference_id 1133357
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357
12
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2457039
reference_id 2457039
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2457039
13
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25854
reference_id CVE-2026-25854
reference_type
scores
0
value Low
scoring_system apache_tomcat
scoring_elements
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25854
14
reference_url https://github.com/advisories/GHSA-9m3c-qcxr-9x87
reference_id GHSA-9m3c-qcxr-9x87
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-9m3c-qcxr-9x87
fixed_packages
0
url pkg:maven/org.apache.tomcat/tomcat@10.1.53
purl pkg:maven/org.apache.tomcat/tomcat@10.1.53
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2rmy-13ym-3bgm
1
vulnerability VCID-8e1c-rbkg-v7c2
2
vulnerability VCID-abt4-b2cv-eygv
3
vulnerability VCID-d1fm-vbd1-n7au
4
vulnerability VCID-yrzk-1dbk-muhy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.53
1
url pkg:maven/org.apache.tomcat/tomcat@11.0.20
purl pkg:maven/org.apache.tomcat/tomcat@11.0.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2rmy-13ym-3bgm
1
vulnerability VCID-8e1c-rbkg-v7c2
2
vulnerability VCID-abt4-b2cv-eygv
3
vulnerability VCID-d1fm-vbd1-n7au
4
vulnerability VCID-yrzk-1dbk-muhy
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@11.0.20
aliases CVE-2026-25854, GHSA-9m3c-qcxr-9x87
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-zw2q-kna8-mqcm
Fixing_vulnerabilities
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@10.1.24