Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-8e1c-rbkg-v7c2
Vulnerability ID VCID-8e1c-rbkg-v7c2
Aliases CVE-2026-34500
GHSA-24j9-x2wg-9qv6
Summary
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-287 Improper Authentication
CWE-303 Incorrect Implementation of Authentication Algorithm
System Score Found at
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34500.json
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2026-34500
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2026-34500
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2026-34500
apache_tomcat Moderate https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34500
cvssv3.1 4.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-24j9-x2wg-9qv6
cvssv3.1 6.5 https://github.com/apache/tomcat
generic_textual MODERATE https://github.com/apache/tomcat
cvssv3.1 6.5 https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2
generic_textual MODERATE https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2
ssvc Track https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2026-34500
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-34500
cvssv3.1 6.5 http://www.openwall.com/lists/oss-security/2026/04/09/29
generic_textual MODERATE http://www.openwall.com/lists/oss-security/2026/04/09/29
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34500.json
https://api.first.org/data/v1/epss?cve=CVE-2026-34500
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/apache/tomcat
https://github.com/apache/tomcat/commit/29b56a56ce9e7d044b6162a99af0f38529b3a208
https://github.com/apache/tomcat/commit/c13e60e732ea6d07087293a41ad1866c20848271
https://github.com/apache/tomcat/commit/ff589ab26e8250a2ca4286d986305318c033ff9f
https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2
https://nvd.nist.gov/vuln/detail/CVE-2026-34500
http://www.openwall.com/lists/oss-security/2026/04/09/29
1133356 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133356
1133357 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133357
2457043 https://bugzilla.redhat.com/show_bug.cgi?id=2457043
CVE-2026-34500 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34500
GHSA-24j9-x2wg-9qv6 https://github.com/advisories/GHSA-24j9-x2wg-9qv6
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34500.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N Found at https://github.com/apache/tomcat
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N Found at https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T14:21:50Z/ Found at https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-34500
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N Found at http://www.openwall.com/lists/oss-security/2026/04/09/29
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.1564
EPSS Score 0.0005
Published At April 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-10T00:03:25.704885+00:00 Apache Tomcat Importer Import https://tomcat.apache.org/security-11.html 38.1.0