{"url":"http://public2.vulnerablecode.io/api/packages/830?format=json","purl":"pkg:apache/tomcat@9.0.92","type":"apache","namespace":"","name":"tomcat","version":"9.0.92","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"9.0.99","latest_non_vulnerable_version":"11.0.21","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/351079?format=json","vulnerability_id":"VCID-8e1c-rbkg-v7c2","summary":"","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34500.json","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34500.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34500","reference_id":"","reference_type":"","scores":[{"value":"0.0005","scoring_system":"epss","scoring_elements":"0.15605","published_at":"2026-04-12T12:55:00Z"},{"value":"0.0005","scoring_system":"epss","scoring_elements":"0.1564","published_at":"2026-04-11T12:55:00Z"},{"value":"0.0005","scoring_system":"epss","scoring_elements":"0.15542","published_at":"2026-04-13T12:55:00Z"},{"value":"0.00159","scoring_system":"epss","scoring_elements":"0.36473","published_at":"2026-04-26T12:55:00Z"},{"value":"0.00159","scoring_system":"epss","scoring_elements":"0.36804","published_at":"2026-04-16T12:55:00Z"},{"value":"0.00159","scoring_system":"epss","scoring_elements":"0.36727","published_at":"2026-04-21T12:55:00Z"},{"value":"0.00159","scoring_system":"epss","scoring_elements":"0.36504","published_at":"2026-04-24T12:55:00Z"},{"value":"0.00159","scoring_system":"epss","scoring_elements":"0.36343","published_at":"2026-05-07T12:55:00Z"},{"value":"0.00159","scoring_system":"epss","scoring_elements":"0.3627","published_at":"2026-05-05T12:55:00Z"},{"value":"0.00159","scoring_system":"epss","scoring_elements":"0.36384","published_at":"2026-04-29T12:55:00Z"},{"value":"0.00159","scoring_system":"epss","scoring_elements":"0.36787","published_at":"2026-04-18T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34500"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/apache/tomcat","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/tomcat"},{"reference_url":"https://github.com/apache/tomcat/commit/29b56a56ce9e7d044b6162a99af0f38529b3a208","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/tomcat/commit/29b56a56ce9e7d044b6162a99af0f38529b3a208"},{"reference_url":"https://github.com/apache/tomcat/commit/c13e60e732ea6d07087293a41ad1866c20848271","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/tomcat/commit/c13e60e732ea6d07087293a41ad1866c20848271"},{"reference_url":"https://github.com/apache/tomcat/commit/ff589ab26e8250a2ca4286d986305318c033ff9f","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/tomcat/commit/ff589ab26e8250a2ca4286d986305318c033ff9f"},{"reference_url":"https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T14:21:50Z/"}],"url":"https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34500","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34500"},{"reference_url":"http://www.openwall.com/lists/oss-security/2026/04/09/29","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2026/04/09/29"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356","reference_id":"1133356","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356"},{"reference_url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357","reference_id":"1133357","reference_type":"","scores":[],"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457043","reference_id":"2457043","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457043"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34500","reference_id":"CVE-2026-34500","reference_type":"","scores":[{"value":"Moderate","scoring_system":"apache_tomcat","scoring_elements":""}],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34500"},{"reference_url":"https://github.com/advisories/GHSA-24j9-x2wg-9qv6","reference_id":"GHSA-24j9-x2wg-9qv6","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-24j9-x2wg-9qv6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/1059920?format=json","purl":"pkg:apache/tomcat@9.0.117","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:apache/tomcat@9.0.117"},{"url":"http://public2.vulnerablecode.io/api/packages/1059915?format=json","purl":"pkg:apache/tomcat@10.1.54","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:apache/tomcat@10.1.54"},{"url":"http://public2.vulnerablecode.io/api/packages/1059906?format=json","purl":"pkg:apache/tomcat@11.0.21","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:apache/tomcat@11.0.21"}],"aliases":["CVE-2026-34500","GHSA-24j9-x2wg-9qv6"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8e1c-rbkg-v7c2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/4436?format=json","vulnerability_id":"VCID-9qgr-t27j-y7d3","summary":"Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests \ncould lead to request and/or response mix-up between users.\n\nThis issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through 10.1.30, from 9.0.92 through 9.0.95.\n\nUsers are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fixes the issue.","references":[{"reference_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-52317.json","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-52317.json"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2024-52317","reference_id":"","reference_type":"","scores":[{"value":"0.1665","scoring_system":"epss","scoring_elements":"0.94904","published_at":"2026-04-02T12:55:00Z"},{"value":"0.1665","scoring_system":"epss","scoring_elements":"0.94917","published_at":"2026-04-08T12:55:00Z"},{"value":"0.1665","scoring_system":"epss","scoring_elements":"0.94908","published_at":"2026-04-07T12:55:00Z"},{"value":"0.1665","scoring_system":"epss","scoring_elements":"0.94906","published_at":"2026-04-04T12:55:00Z"},{"value":"0.21066","scoring_system":"epss","scoring_elements":"0.95662","published_at":"2026-04-21T12:55:00Z"},{"value":"0.21066","scoring_system":"epss","scoring_elements":"0.95661","published_at":"2026-04-18T12:55:00Z"},{"value":"0.21066","scoring_system":"epss","scoring_elements":"0.95657","published_at":"2026-04-16T12:55:00Z"},{"value":"0.21066","scoring_system":"epss","scoring_elements":"0.95648","published_at":"2026-04-13T12:55:00Z"},{"value":"0.21066","scoring_system":"epss","scoring_elements":"0.95646","published_at":"2026-04-12T12:55:00Z"},{"value":"0.21066","scoring_system":"epss","scoring_elements":"0.95647","published_at":"2026-04-11T12:55:00Z"},{"value":"0.21066","scoring_system":"epss","scoring_elements":"0.95642","published_at":"2026-04-09T12:55:00Z"},{"value":"0.21066","scoring_system":"epss","scoring_elements":"0.95682","published_at":"2026-05-07T12:55:00Z"},{"value":"0.21066","scoring_system":"epss","scoring_elements":"0.95679","published_at":"2026-05-05T12:55:00Z"},{"value":"0.21066","scoring_system":"epss","scoring_elements":"0.95664","published_at":"2026-04-26T12:55:00Z"},{"value":"0.21066","scoring_system":"epss","scoring_elements":"0.95663","published_at":"2026-04-29T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-52317"},{"reference_url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"url":"https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml"},{"reference_url":"https://github.com/apache/tomcat","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/tomcat"},{"reference_url":"https://github.com/apache/tomcat/commit/146f94f87ea398fb592c7a20a5ccbef95e9dd72b","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/tomcat/commit/146f94f87ea398fb592c7a20a5ccbef95e9dd72b"},{"reference_url":"https://github.com/apache/tomcat/commit/47307ee27abcdea2ee40e33897aca760083de46a","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/tomcat/commit/47307ee27abcdea2ee40e33897aca760083de46a"},{"reference_url":"https://github.com/apache/tomcat/commit/9e840ccacb40881c03a03b1e0746bfba7369b3bd","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/tomcat/commit/9e840ccacb40881c03a03b1e0746bfba7369b3bd"},{"reference_url":"https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-18T14:44:38Z/"}],"url":"https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52317","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52317"},{"reference_url":"https://security.netapp.com/advisory/ntap-20250124-0004","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://security.netapp.com/advisory/ntap-20250124-0004"},{"reference_url":"http://www.openwall.com/lists/oss-security/2024/11/18/3","reference_id":"","reference_type":"","scores":[{"value":"6.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://www.openwall.com/lists/oss-security/2024/11/18/3"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326973","reference_id":"2326973","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2326973"},{"reference_url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52317","reference_id":"CVE-2024-52317","reference_type":"","scores":[{"value":"Important","scoring_system":"apache_tomcat","scoring_elements":""}],"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52317"},{"reference_url":"https://github.com/advisories/GHSA-qvf5-hvjx-wm27","reference_id":"GHSA-qvf5-hvjx-wm27","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-qvf5-hvjx-wm27"},{"reference_url":"https://usn.ubuntu.com/7705-1/","reference_id":"USN-7705-1","reference_type":"","scores":[],"url":"https://usn.ubuntu.com/7705-1/"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/828?format=json","purl":"pkg:apache/tomcat@9.0.96","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-s24s-sbsx-b3f5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:apache/tomcat@9.0.96"},{"url":"http://public2.vulnerablecode.io/api/packages/676?format=json","purl":"pkg:apache/tomcat@10.1.31","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-s24s-sbsx-b3f5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:apache/tomcat@10.1.31"},{"url":"http://public2.vulnerablecode.io/api/packages/606?format=json","purl":"pkg:apache/tomcat@11.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-56jv-htmt-rkew"},{"vulnerability":"VCID-5732-xnx7-tkfy"},{"vulnerability":"VCID-s24s-sbsx-b3f5"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:apache/tomcat@11.0.0"}],"aliases":["CVE-2024-52317","GHSA-qvf5-hvjx-wm27"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9qgr-t27j-y7d3"}],"fixing_vulnerabilities":[],"risk_score":"4.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:apache/tomcat@9.0.92"}