{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-9m89-8frq-c98c/GHSA-9m89-8frq-c98c.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0.118"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.0",
        "7.0.100",
        "7.0.103",
        "7.0.104",
        "7.0.105",
        "7.0.106",
        "7.0.107",
        "7.0.108",
        "7.0.109",
        "7.0.11",
        "7.0.12",
        "7.0.14",
        "7.0.16",
        "7.0.19",
        "7.0.2",
        "7.0.20",
        "7.0.21",
        "7.0.22",
        "7.0.23",
        "7.0.25",
        "7.0.26",
        "7.0.27",
        "7.0.28",
        "7.0.29",
        "7.0.30",
        "7.0.32",
        "7.0.33",
        "7.0.34",
        "7.0.35",
        "7.0.37",
        "7.0.39",
        "7.0.4",
        "7.0.40",
        "7.0.41",
        "7.0.42",
        "7.0.47",
        "7.0.5",
        "7.0.50",
        "7.0.52",
        "7.0.53",
        "7.0.54",
        "7.0.55",
        "7.0.56",
        "7.0.57",
        "7.0.59",
        "7.0.6",
        "7.0.61",
        "7.0.62",
        "7.0.63",
        "7.0.64",
        "7.0.65",
        "7.0.67",
        "7.0.68",
        "7.0.69",
        "7.0.70",
        "7.0.72",
        "7.0.73",
        "7.0.75",
        "7.0.76",
        "7.0.77",
        "7.0.78",
        "7.0.79",
        "7.0.8",
        "7.0.81",
        "7.0.82",
        "7.0.84",
        "7.0.85",
        "7.0.86",
        "7.0.88",
        "7.0.90",
        "7.0.91",
        "7.0.92",
        "7.0.93",
        "7.0.94",
        "7.0.96",
        "7.0.99",
        "8.0.0-RC1",
        "8.0.0-RC10",
        "8.0.0-RC3",
        "8.0.0-RC5",
        "8.0.1",
        "8.0.11",
        "8.0.12",
        "8.0.14",
        "8.0.15",
        "8.0.17",
        "8.0.18",
        "8.0.20",
        "8.0.21",
        "8.0.22",
        "8.0.23",
        "8.0.24",
        "8.0.26",
        "8.0.27",
        "8.0.28",
        "8.0.29",
        "8.0.3",
        "8.0.30",
        "8.0.32",
        "8.0.33",
        "8.0.35",
        "8.0.36",
        "8.0.37",
        "8.0.38",
        "8.0.39",
        "8.0.41",
        "8.0.42",
        "8.0.43",
        "8.0.44",
        "8.0.45",
        "8.0.46",
        "8.0.47",
        "8.0.48",
        "8.0.49",
        "8.0.5",
        "8.0.50",
        "8.0.51",
        "8.0.52",
        "8.0.53",
        "8.0.8",
        "8.0.9",
        "8.5.0",
        "8.5.100",
        "8.5.11",
        "8.5.12",
        "8.5.13",
        "8.5.14",
        "8.5.15",
        "8.5.16",
        "8.5.19",
        "8.5.2",
        "8.5.20",
        "8.5.21",
        "8.5.23",
        "8.5.24",
        "8.5.27",
        "8.5.28",
        "8.5.29",
        "8.5.3",
        "8.5.30",
        "8.5.31",
        "8.5.32",
        "8.5.33",
        "8.5.34",
        "8.5.35",
        "8.5.37",
        "8.5.38",
        "8.5.39",
        "8.5.4",
        "8.5.40",
        "8.5.41",
        "8.5.42",
        "8.5.43",
        "8.5.45",
        "8.5.46",
        "8.5.47",
        "8.5.49",
        "8.5.5",
        "8.5.50",
        "8.5.51",
        "8.5.53",
        "8.5.54",
        "8.5.55",
        "8.5.56",
        "8.5.57",
        "8.5.58",
        "8.5.59",
        "8.5.6",
        "8.5.60",
        "8.5.61",
        "8.5.63",
        "8.5.64",
        "8.5.65",
        "8.5.66",
        "8.5.68",
        "8.5.69",
        "8.5.70",
        "8.5.71",
        "8.5.72",
        "8.5.73",
        "8.5.75",
        "8.5.76",
        "8.5.77",
        "8.5.78",
        "8.5.79",
        "8.5.8",
        "8.5.81",
        "8.5.82",
        "8.5.83",
        "8.5.84",
        "8.5.85",
        "8.5.86",
        "8.5.87",
        "8.5.88",
        "8.5.89",
        "8.5.9",
        "8.5.90",
        "8.5.91",
        "8.5.92",
        "8.5.93",
        "8.5.94",
        "8.5.95",
        "8.5.96",
        "8.5.97",
        "8.5.98",
        "8.5.99",
        "9.0.0.M1",
        "9.0.0.M10",
        "9.0.0.M11",
        "9.0.0.M13",
        "9.0.0.M15",
        "9.0.0.M17",
        "9.0.0.M18",
        "9.0.0.M19",
        "9.0.0.M20",
        "9.0.0.M21",
        "9.0.0.M22",
        "9.0.0.M25",
        "9.0.0.M26",
        "9.0.0.M27",
        "9.0.0.M3",
        "9.0.0.M4",
        "9.0.0.M6",
        "9.0.0.M8",
        "9.0.0.M9",
        "9.0.1",
        "9.0.10",
        "9.0.100",
        "9.0.102",
        "9.0.104",
        "9.0.105",
        "9.0.106",
        "9.0.107",
        "9.0.108",
        "9.0.109",
        "9.0.11",
        "9.0.110",
        "9.0.111",
        "9.0.112",
        "9.0.113",
        "9.0.115",
        "9.0.116",
        "9.0.117",
        "9.0.12",
        "9.0.13",
        "9.0.14",
        "9.0.16",
        "9.0.17",
        "9.0.19",
        "9.0.2",
        "9.0.20",
        "9.0.21",
        "9.0.22",
        "9.0.24",
        "9.0.26",
        "9.0.27",
        "9.0.29",
        "9.0.30",
        "9.0.31",
        "9.0.33",
        "9.0.34",
        "9.0.35",
        "9.0.36",
        "9.0.37",
        "9.0.38",
        "9.0.39",
        "9.0.4",
        "9.0.40",
        "9.0.41",
        "9.0.43",
        "9.0.44",
        "9.0.45",
        "9.0.46",
        "9.0.48",
        "9.0.5",
        "9.0.50",
        "9.0.52",
        "9.0.53",
        "9.0.54",
        "9.0.55",
        "9.0.56",
        "9.0.58",
        "9.0.59",
        "9.0.6",
        "9.0.60",
        "9.0.62",
        "9.0.63",
        "9.0.64",
        "9.0.65",
        "9.0.67",
        "9.0.68",
        "9.0.69",
        "9.0.7",
        "9.0.70",
        "9.0.71",
        "9.0.72",
        "9.0.73",
        "9.0.74",
        "9.0.75",
        "9.0.76",
        "9.0.78",
        "9.0.79",
        "9.0.8",
        "9.0.80",
        "9.0.81",
        "9.0.82",
        "9.0.83",
        "9.0.84",
        "9.0.85",
        "9.0.86",
        "9.0.87",
        "9.0.88",
        "9.0.89",
        "9.0.90",
        "9.0.91",
        "9.0.93",
        "9.0.94",
        "9.0.95",
        "9.0.96",
        "9.0.97",
        "9.0.98",
        "9.0.99"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-9m89-8frq-c98c/GHSA-9m89-8frq-c98c.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.1.0-M1"
            },
            {
              "fixed": "10.1.55"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.1.0",
        "10.1.0-M1",
        "10.1.0-M10",
        "10.1.0-M11",
        "10.1.0-M12",
        "10.1.0-M14",
        "10.1.0-M15",
        "10.1.0-M16",
        "10.1.0-M17",
        "10.1.0-M2",
        "10.1.0-M4",
        "10.1.0-M5",
        "10.1.0-M6",
        "10.1.0-M7",
        "10.1.0-M8",
        "10.1.1",
        "10.1.10",
        "10.1.11",
        "10.1.12",
        "10.1.13",
        "10.1.14",
        "10.1.15",
        "10.1.16",
        "10.1.17",
        "10.1.18",
        "10.1.19",
        "10.1.2",
        "10.1.20",
        "10.1.23",
        "10.1.24",
        "10.1.25",
        "10.1.26",
        "10.1.28",
        "10.1.29",
        "10.1.30",
        "10.1.31",
        "10.1.33",
        "10.1.34",
        "10.1.35",
        "10.1.36",
        "10.1.39",
        "10.1.4",
        "10.1.40",
        "10.1.41",
        "10.1.42",
        "10.1.43",
        "10.1.44",
        "10.1.45",
        "10.1.46",
        "10.1.47",
        "10.1.48",
        "10.1.49",
        "10.1.5",
        "10.1.50",
        "10.1.52",
        "10.1.53",
        "10.1.54",
        "10.1.6",
        "10.1.7",
        "10.1.8",
        "10.1.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-9m89-8frq-c98c/GHSA-9m89-8frq-c98c.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-M1"
            },
            {
              "fixed": "11.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.0.0",
        "11.0.0-M1",
        "11.0.0-M10",
        "11.0.0-M11",
        "11.0.0-M12",
        "11.0.0-M13",
        "11.0.0-M14",
        "11.0.0-M15",
        "11.0.0-M16",
        "11.0.0-M17",
        "11.0.0-M18",
        "11.0.0-M19",
        "11.0.0-M20",
        "11.0.0-M21",
        "11.0.0-M22",
        "11.0.0-M24",
        "11.0.0-M25",
        "11.0.0-M26",
        "11.0.0-M3",
        "11.0.0-M4",
        "11.0.0-M5",
        "11.0.0-M6",
        "11.0.0-M7",
        "11.0.0-M9",
        "11.0.1",
        "11.0.10",
        "11.0.11",
        "11.0.12",
        "11.0.13",
        "11.0.14",
        "11.0.15",
        "11.0.18",
        "11.0.2",
        "11.0.20",
        "11.0.21",
        "11.0.3",
        "11.0.4",
        "11.0.5",
        "11.0.6",
        "11.0.7",
        "11.0.8",
        "11.0.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-9m89-8frq-c98c/GHSA-9m89-8frq-c98c.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat",
        "purl": "pkg:maven/org.apache.tomcat/tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0.118"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.100",
        "7.0.103",
        "7.0.104",
        "7.0.105",
        "7.0.106",
        "7.0.107",
        "7.0.108",
        "7.0.109",
        "7.0.35",
        "7.0.37",
        "7.0.39",
        "7.0.40",
        "7.0.41",
        "7.0.42",
        "7.0.47",
        "7.0.50",
        "7.0.52",
        "7.0.53",
        "7.0.54",
        "7.0.55",
        "7.0.56",
        "7.0.57",
        "7.0.59",
        "7.0.61",
        "7.0.62",
        "7.0.63",
        "7.0.64",
        "7.0.65",
        "7.0.67",
        "7.0.68",
        "7.0.69",
        "7.0.70",
        "7.0.72",
        "7.0.73",
        "7.0.75",
        "7.0.76",
        "7.0.77",
        "7.0.78",
        "7.0.79",
        "7.0.81",
        "7.0.82",
        "7.0.84",
        "7.0.85",
        "7.0.86",
        "7.0.88",
        "7.0.90",
        "7.0.91",
        "7.0.92",
        "7.0.93",
        "7.0.94",
        "7.0.96",
        "7.0.99",
        "8.0.0-RC1",
        "8.0.0-RC10",
        "8.0.0-RC3",
        "8.0.0-RC5",
        "8.0.1",
        "8.0.11",
        "8.0.12",
        "8.0.14",
        "8.0.15",
        "8.0.17",
        "8.0.18",
        "8.0.20",
        "8.0.21",
        "8.0.22",
        "8.0.23",
        "8.0.24",
        "8.0.26",
        "8.0.27",
        "8.0.28",
        "8.0.29",
        "8.0.3",
        "8.0.30",
        "8.0.32",
        "8.0.33",
        "8.0.35",
        "8.0.36",
        "8.0.37",
        "8.0.38",
        "8.0.39",
        "8.0.41",
        "8.0.42",
        "8.0.43",
        "8.0.44",
        "8.0.45",
        "8.0.46",
        "8.0.47",
        "8.0.48",
        "8.0.49",
        "8.0.5",
        "8.0.50",
        "8.0.51",
        "8.0.52",
        "8.0.53",
        "8.0.8",
        "8.0.9",
        "8.5.0",
        "8.5.100",
        "8.5.11",
        "8.5.12",
        "8.5.13",
        "8.5.14",
        "8.5.15",
        "8.5.16",
        "8.5.19",
        "8.5.2",
        "8.5.20",
        "8.5.21",
        "8.5.23",
        "8.5.24",
        "8.5.27",
        "8.5.28",
        "8.5.29",
        "8.5.3",
        "8.5.30",
        "8.5.31",
        "8.5.32",
        "8.5.33",
        "8.5.34",
        "8.5.35",
        "8.5.37",
        "8.5.38",
        "8.5.39",
        "8.5.4",
        "8.5.40",
        "8.5.41",
        "8.5.42",
        "8.5.43",
        "8.5.45",
        "8.5.46",
        "8.5.47",
        "8.5.49",
        "8.5.5",
        "8.5.50",
        "8.5.51",
        "8.5.53",
        "8.5.54",
        "8.5.55",
        "8.5.56",
        "8.5.57",
        "8.5.58",
        "8.5.59",
        "8.5.6",
        "8.5.60",
        "8.5.61",
        "8.5.63",
        "8.5.64",
        "8.5.65",
        "8.5.66",
        "8.5.68",
        "8.5.69",
        "8.5.70",
        "8.5.71",
        "8.5.72",
        "8.5.73",
        "8.5.75",
        "8.5.76",
        "8.5.77",
        "8.5.78",
        "8.5.79",
        "8.5.8",
        "8.5.81",
        "8.5.82",
        "8.5.83",
        "8.5.84",
        "8.5.85",
        "8.5.86",
        "8.5.87",
        "8.5.88",
        "8.5.89",
        "8.5.9",
        "8.5.90",
        "8.5.91",
        "8.5.92",
        "8.5.93",
        "8.5.94",
        "8.5.95",
        "8.5.96",
        "8.5.97",
        "8.5.98",
        "8.5.99",
        "9.0.0.M1",
        "9.0.0.M10",
        "9.0.0.M11",
        "9.0.0.M13",
        "9.0.0.M15",
        "9.0.0.M17",
        "9.0.0.M18",
        "9.0.0.M19",
        "9.0.0.M20",
        "9.0.0.M21",
        "9.0.0.M22",
        "9.0.0.M25",
        "9.0.0.M26",
        "9.0.0.M27",
        "9.0.0.M3",
        "9.0.0.M4",
        "9.0.0.M6",
        "9.0.0.M8",
        "9.0.0.M9",
        "9.0.1",
        "9.0.10",
        "9.0.100",
        "9.0.102",
        "9.0.104",
        "9.0.105",
        "9.0.106",
        "9.0.107",
        "9.0.108",
        "9.0.109",
        "9.0.11",
        "9.0.110",
        "9.0.111",
        "9.0.112",
        "9.0.113",
        "9.0.115",
        "9.0.116",
        "9.0.117",
        "9.0.12",
        "9.0.13",
        "9.0.14",
        "9.0.16",
        "9.0.17",
        "9.0.19",
        "9.0.2",
        "9.0.20",
        "9.0.21",
        "9.0.22",
        "9.0.24",
        "9.0.26",
        "9.0.27",
        "9.0.29",
        "9.0.30",
        "9.0.31",
        "9.0.33",
        "9.0.34",
        "9.0.35",
        "9.0.36",
        "9.0.37",
        "9.0.38",
        "9.0.39",
        "9.0.4",
        "9.0.40",
        "9.0.41",
        "9.0.43",
        "9.0.44",
        "9.0.45",
        "9.0.46",
        "9.0.48",
        "9.0.5",
        "9.0.50",
        "9.0.52",
        "9.0.53",
        "9.0.54",
        "9.0.55",
        "9.0.56",
        "9.0.58",
        "9.0.59",
        "9.0.6",
        "9.0.60",
        "9.0.62",
        "9.0.63",
        "9.0.64",
        "9.0.65",
        "9.0.67",
        "9.0.68",
        "9.0.69",
        "9.0.7",
        "9.0.70",
        "9.0.71",
        "9.0.72",
        "9.0.73",
        "9.0.74",
        "9.0.75",
        "9.0.76",
        "9.0.78",
        "9.0.79",
        "9.0.8",
        "9.0.80",
        "9.0.81",
        "9.0.82",
        "9.0.83",
        "9.0.84",
        "9.0.85",
        "9.0.86",
        "9.0.87",
        "9.0.88",
        "9.0.89",
        "9.0.90",
        "9.0.91",
        "9.0.93",
        "9.0.94",
        "9.0.95",
        "9.0.96",
        "9.0.97",
        "9.0.98",
        "9.0.99"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-9m89-8frq-c98c/GHSA-9m89-8frq-c98c.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat",
        "purl": "pkg:maven/org.apache.tomcat/tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.1.0-M1"
            },
            {
              "fixed": "10.1.55"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.1.0",
        "10.1.0-M1",
        "10.1.0-M10",
        "10.1.0-M11",
        "10.1.0-M12",
        "10.1.0-M14",
        "10.1.0-M15",
        "10.1.0-M16",
        "10.1.0-M17",
        "10.1.0-M2",
        "10.1.0-M4",
        "10.1.0-M5",
        "10.1.0-M6",
        "10.1.0-M7",
        "10.1.0-M8",
        "10.1.1",
        "10.1.10",
        "10.1.11",
        "10.1.12",
        "10.1.13",
        "10.1.14",
        "10.1.15",
        "10.1.16",
        "10.1.17",
        "10.1.18",
        "10.1.19",
        "10.1.2",
        "10.1.20",
        "10.1.23",
        "10.1.24",
        "10.1.25",
        "10.1.26",
        "10.1.28",
        "10.1.29",
        "10.1.30",
        "10.1.31",
        "10.1.33",
        "10.1.34",
        "10.1.35",
        "10.1.36",
        "10.1.39",
        "10.1.4",
        "10.1.40",
        "10.1.41",
        "10.1.42",
        "10.1.43",
        "10.1.44",
        "10.1.45",
        "10.1.46",
        "10.1.47",
        "10.1.48",
        "10.1.49",
        "10.1.5",
        "10.1.50",
        "10.1.52",
        "10.1.53",
        "10.1.54",
        "10.1.6",
        "10.1.7",
        "10.1.8",
        "10.1.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-9m89-8frq-c98c/GHSA-9m89-8frq-c98c.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat",
        "purl": "pkg:maven/org.apache.tomcat/tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-M1"
            },
            {
              "fixed": "11.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.0.0",
        "11.0.0-M1",
        "11.0.0-M10",
        "11.0.0-M11",
        "11.0.0-M12",
        "11.0.0-M13",
        "11.0.0-M14",
        "11.0.0-M15",
        "11.0.0-M16",
        "11.0.0-M17",
        "11.0.0-M18",
        "11.0.0-M19",
        "11.0.0-M20",
        "11.0.0-M21",
        "11.0.0-M22",
        "11.0.0-M24",
        "11.0.0-M25",
        "11.0.0-M26",
        "11.0.0-M3",
        "11.0.0-M4",
        "11.0.0-M5",
        "11.0.0-M6",
        "11.0.0-M7",
        "11.0.0-M9",
        "11.0.1",
        "11.0.10",
        "11.0.11",
        "11.0.12",
        "11.0.13",
        "11.0.14",
        "11.0.15",
        "11.0.18",
        "11.0.2",
        "11.0.20",
        "11.0.21",
        "11.0.3",
        "11.0.4",
        "11.0.5",
        "11.0.6",
        "11.0.7",
        "11.0.8",
        "11.0.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-9m89-8frq-c98c/GHSA-9m89-8frq-c98c.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-catalina",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.0.118"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.0.0",
        "7.0.100",
        "7.0.103",
        "7.0.104",
        "7.0.105",
        "7.0.106",
        "7.0.107",
        "7.0.108",
        "7.0.109",
        "7.0.11",
        "7.0.12",
        "7.0.14",
        "7.0.16",
        "7.0.19",
        "7.0.2",
        "7.0.20",
        "7.0.21",
        "7.0.22",
        "7.0.23",
        "7.0.25",
        "7.0.26",
        "7.0.27",
        "7.0.28",
        "7.0.29",
        "7.0.30",
        "7.0.32",
        "7.0.33",
        "7.0.34",
        "7.0.35",
        "7.0.37",
        "7.0.39",
        "7.0.4",
        "7.0.40",
        "7.0.41",
        "7.0.42",
        "7.0.47",
        "7.0.5",
        "7.0.50",
        "7.0.52",
        "7.0.53",
        "7.0.54",
        "7.0.55",
        "7.0.56",
        "7.0.57",
        "7.0.59",
        "7.0.6",
        "7.0.61",
        "7.0.62",
        "7.0.63",
        "7.0.64",
        "7.0.65",
        "7.0.67",
        "7.0.68",
        "7.0.69",
        "7.0.70",
        "7.0.72",
        "7.0.73",
        "7.0.75",
        "7.0.76",
        "7.0.77",
        "7.0.78",
        "7.0.79",
        "7.0.8",
        "7.0.81",
        "7.0.82",
        "7.0.84",
        "7.0.85",
        "7.0.86",
        "7.0.88",
        "7.0.90",
        "7.0.91",
        "7.0.92",
        "7.0.93",
        "7.0.94",
        "7.0.96",
        "7.0.99",
        "8.0.0-RC1",
        "8.0.0-RC10",
        "8.0.0-RC3",
        "8.0.0-RC5",
        "8.0.1",
        "8.0.11",
        "8.0.12",
        "8.0.14",
        "8.0.15",
        "8.0.17",
        "8.0.18",
        "8.0.20",
        "8.0.21",
        "8.0.22",
        "8.0.23",
        "8.0.24",
        "8.0.26",
        "8.0.27",
        "8.0.28",
        "8.0.29",
        "8.0.3",
        "8.0.30",
        "8.0.32",
        "8.0.33",
        "8.0.35",
        "8.0.36",
        "8.0.37",
        "8.0.38",
        "8.0.39",
        "8.0.41",
        "8.0.42",
        "8.0.43",
        "8.0.44",
        "8.0.45",
        "8.0.46",
        "8.0.47",
        "8.0.48",
        "8.0.49",
        "8.0.5",
        "8.0.50",
        "8.0.51",
        "8.0.52",
        "8.0.53",
        "8.0.8",
        "8.0.9",
        "8.5.0",
        "8.5.100",
        "8.5.11",
        "8.5.12",
        "8.5.13",
        "8.5.14",
        "8.5.15",
        "8.5.16",
        "8.5.19",
        "8.5.2",
        "8.5.20",
        "8.5.21",
        "8.5.23",
        "8.5.24",
        "8.5.27",
        "8.5.28",
        "8.5.29",
        "8.5.3",
        "8.5.30",
        "8.5.31",
        "8.5.32",
        "8.5.33",
        "8.5.34",
        "8.5.35",
        "8.5.37",
        "8.5.38",
        "8.5.39",
        "8.5.4",
        "8.5.40",
        "8.5.41",
        "8.5.42",
        "8.5.43",
        "8.5.45",
        "8.5.46",
        "8.5.47",
        "8.5.49",
        "8.5.5",
        "8.5.50",
        "8.5.51",
        "8.5.53",
        "8.5.54",
        "8.5.55",
        "8.5.56",
        "8.5.57",
        "8.5.58",
        "8.5.59",
        "8.5.6",
        "8.5.60",
        "8.5.61",
        "8.5.63",
        "8.5.64",
        "8.5.65",
        "8.5.66",
        "8.5.68",
        "8.5.69",
        "8.5.70",
        "8.5.71",
        "8.5.72",
        "8.5.73",
        "8.5.75",
        "8.5.76",
        "8.5.77",
        "8.5.78",
        "8.5.79",
        "8.5.8",
        "8.5.81",
        "8.5.82",
        "8.5.83",
        "8.5.84",
        "8.5.85",
        "8.5.86",
        "8.5.87",
        "8.5.88",
        "8.5.89",
        "8.5.9",
        "8.5.90",
        "8.5.91",
        "8.5.92",
        "8.5.93",
        "8.5.94",
        "8.5.95",
        "8.5.96",
        "8.5.97",
        "8.5.98",
        "8.5.99",
        "9.0.0.M1",
        "9.0.0.M10",
        "9.0.0.M11",
        "9.0.0.M13",
        "9.0.0.M15",
        "9.0.0.M17",
        "9.0.0.M18",
        "9.0.0.M19",
        "9.0.0.M20",
        "9.0.0.M21",
        "9.0.0.M22",
        "9.0.0.M25",
        "9.0.0.M26",
        "9.0.0.M27",
        "9.0.0.M3",
        "9.0.0.M4",
        "9.0.0.M6",
        "9.0.0.M8",
        "9.0.0.M9",
        "9.0.1",
        "9.0.10",
        "9.0.100",
        "9.0.102",
        "9.0.104",
        "9.0.105",
        "9.0.106",
        "9.0.107",
        "9.0.108",
        "9.0.109",
        "9.0.11",
        "9.0.110",
        "9.0.111",
        "9.0.112",
        "9.0.113",
        "9.0.115",
        "9.0.116",
        "9.0.117",
        "9.0.12",
        "9.0.13",
        "9.0.14",
        "9.0.16",
        "9.0.17",
        "9.0.19",
        "9.0.2",
        "9.0.20",
        "9.0.21",
        "9.0.22",
        "9.0.24",
        "9.0.26",
        "9.0.27",
        "9.0.29",
        "9.0.30",
        "9.0.31",
        "9.0.33",
        "9.0.34",
        "9.0.35",
        "9.0.36",
        "9.0.37",
        "9.0.38",
        "9.0.39",
        "9.0.4",
        "9.0.40",
        "9.0.41",
        "9.0.43",
        "9.0.44",
        "9.0.45",
        "9.0.46",
        "9.0.48",
        "9.0.5",
        "9.0.50",
        "9.0.52",
        "9.0.53",
        "9.0.54",
        "9.0.55",
        "9.0.56",
        "9.0.58",
        "9.0.59",
        "9.0.6",
        "9.0.60",
        "9.0.62",
        "9.0.63",
        "9.0.64",
        "9.0.65",
        "9.0.67",
        "9.0.68",
        "9.0.69",
        "9.0.7",
        "9.0.70",
        "9.0.71",
        "9.0.72",
        "9.0.73",
        "9.0.74",
        "9.0.75",
        "9.0.76",
        "9.0.78",
        "9.0.79",
        "9.0.8",
        "9.0.80",
        "9.0.81",
        "9.0.82",
        "9.0.83",
        "9.0.84",
        "9.0.85",
        "9.0.86",
        "9.0.87",
        "9.0.88",
        "9.0.89",
        "9.0.90",
        "9.0.91",
        "9.0.93",
        "9.0.94",
        "9.0.95",
        "9.0.96",
        "9.0.97",
        "9.0.98",
        "9.0.99"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-9m89-8frq-c98c/GHSA-9m89-8frq-c98c.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-catalina",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.1.0-M1"
            },
            {
              "fixed": "10.1.55"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.1.0",
        "10.1.0-M1",
        "10.1.0-M10",
        "10.1.0-M11",
        "10.1.0-M12",
        "10.1.0-M14",
        "10.1.0-M15",
        "10.1.0-M16",
        "10.1.0-M17",
        "10.1.0-M2",
        "10.1.0-M4",
        "10.1.0-M5",
        "10.1.0-M6",
        "10.1.0-M7",
        "10.1.0-M8",
        "10.1.1",
        "10.1.10",
        "10.1.11",
        "10.1.12",
        "10.1.13",
        "10.1.14",
        "10.1.15",
        "10.1.16",
        "10.1.17",
        "10.1.18",
        "10.1.19",
        "10.1.2",
        "10.1.20",
        "10.1.23",
        "10.1.24",
        "10.1.25",
        "10.1.26",
        "10.1.28",
        "10.1.29",
        "10.1.30",
        "10.1.31",
        "10.1.33",
        "10.1.34",
        "10.1.35",
        "10.1.36",
        "10.1.39",
        "10.1.4",
        "10.1.40",
        "10.1.41",
        "10.1.42",
        "10.1.43",
        "10.1.44",
        "10.1.45",
        "10.1.46",
        "10.1.47",
        "10.1.48",
        "10.1.49",
        "10.1.5",
        "10.1.50",
        "10.1.52",
        "10.1.53",
        "10.1.54",
        "10.1.6",
        "10.1.7",
        "10.1.8",
        "10.1.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-9m89-8frq-c98c/GHSA-9m89-8frq-c98c.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-catalina",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-M1"
            },
            {
              "fixed": "11.0.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.0.0",
        "11.0.0-M1",
        "11.0.0-M10",
        "11.0.0-M11",
        "11.0.0-M12",
        "11.0.0-M13",
        "11.0.0-M14",
        "11.0.0-M15",
        "11.0.0-M16",
        "11.0.0-M17",
        "11.0.0-M18",
        "11.0.0-M19",
        "11.0.0-M20",
        "11.0.0-M21",
        "11.0.0-M22",
        "11.0.0-M24",
        "11.0.0-M25",
        "11.0.0-M26",
        "11.0.0-M3",
        "11.0.0-M4",
        "11.0.0-M5",
        "11.0.0-M6",
        "11.0.0-M7",
        "11.0.0-M9",
        "11.0.1",
        "11.0.10",
        "11.0.11",
        "11.0.12",
        "11.0.13",
        "11.0.14",
        "11.0.15",
        "11.0.18",
        "11.0.2",
        "11.0.20",
        "11.0.21",
        "11.0.3",
        "11.0.4",
        "11.0.5",
        "11.0.6",
        "11.0.7",
        "11.0.8",
        "11.0.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-43514"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-19T14:28:51Z",
    "nvd_published_at": "2026-05-12T16:16:18Z",
    "severity": "LOW"
  },
  "details": "Versions Affected:\nApache Tomcat 11.0.0-M1 to 11.0.21\nApache Tomcat 10.1.0-M1 to 10.1.54\nApache Tomcat 9.0.0.M1 to 9.0.117\nOlder, unsupported versions may also be affected\n\nDescription:\nThe AJP secret was compared in non-constant time allowing an attacker on\nthe local network to mount a timing attack to determine the AJP secret.\n\nMitigation:\nUsers of the affected versions should apply one of the following\nmitigations:\n- Upgrade to Apache Tomcat 11.0.22 or later\n- Upgrade to Apache Tomcat 10.1.55 or later\n- Upgrade to Apache Tomcat 9.0.118 or later",
  "id": "GHSA-9m89-8frq-c98c",
  "modified": "2026-09-10T09:40:56.624975082Z",
  "published": "2026-05-12T18:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43514"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/933dcdbf2515972280002929e7e597dead2e9ffa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/a102a2a157868ca51d83eaf5a119ccd9976a113e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/d35d9d23263c8e4af561f615c960c91697ff200e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/tomcat"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-10.html"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-11.html"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-9.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/05/12/10"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Apache Tomcat - AJP secret compared in non-constant time"
}