{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpj8-gq4v-p354/GHSA-fpj8-gq4v-p354.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-M1"
            },
            {
              "fixed": "11.0.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.0.0",
        "11.0.0-M1",
        "11.0.0-M10",
        "11.0.0-M11",
        "11.0.0-M12",
        "11.0.0-M13",
        "11.0.0-M14",
        "11.0.0-M15",
        "11.0.0-M16",
        "11.0.0-M17",
        "11.0.0-M18",
        "11.0.0-M19",
        "11.0.0-M20",
        "11.0.0-M21",
        "11.0.0-M22",
        "11.0.0-M24",
        "11.0.0-M25",
        "11.0.0-M26",
        "11.0.0-M3",
        "11.0.0-M4",
        "11.0.0-M5",
        "11.0.0-M6",
        "11.0.0-M7",
        "11.0.0-M9",
        "11.0.1",
        "11.0.10",
        "11.0.11",
        "11.0.12",
        "11.0.13",
        "11.0.14",
        "11.0.2",
        "11.0.3",
        "11.0.4",
        "11.0.5",
        "11.0.6",
        "11.0.7",
        "11.0.8",
        "11.0.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpj8-gq4v-p354/GHSA-fpj8-gq4v-p354.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.1.0-M1"
            },
            {
              "fixed": "10.1.50"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.1.0",
        "10.1.0-M1",
        "10.1.0-M10",
        "10.1.0-M11",
        "10.1.0-M12",
        "10.1.0-M14",
        "10.1.0-M15",
        "10.1.0-M16",
        "10.1.0-M17",
        "10.1.0-M2",
        "10.1.0-M4",
        "10.1.0-M5",
        "10.1.0-M6",
        "10.1.0-M7",
        "10.1.0-M8",
        "10.1.1",
        "10.1.10",
        "10.1.11",
        "10.1.12",
        "10.1.13",
        "10.1.14",
        "10.1.15",
        "10.1.16",
        "10.1.17",
        "10.1.18",
        "10.1.19",
        "10.1.2",
        "10.1.20",
        "10.1.23",
        "10.1.24",
        "10.1.25",
        "10.1.26",
        "10.1.28",
        "10.1.29",
        "10.1.30",
        "10.1.31",
        "10.1.33",
        "10.1.34",
        "10.1.35",
        "10.1.36",
        "10.1.39",
        "10.1.4",
        "10.1.40",
        "10.1.41",
        "10.1.42",
        "10.1.43",
        "10.1.44",
        "10.1.45",
        "10.1.46",
        "10.1.47",
        "10.1.48",
        "10.1.49",
        "10.1.5",
        "10.1.6",
        "10.1.7",
        "10.1.8",
        "10.1.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpj8-gq4v-p354/GHSA-fpj8-gq4v-p354.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0-M1"
            },
            {
              "fixed": "9.0.113"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.0.0.M1",
        "9.0.0.M10",
        "9.0.0.M11",
        "9.0.0.M13",
        "9.0.0.M15",
        "9.0.0.M17",
        "9.0.0.M18",
        "9.0.0.M19",
        "9.0.0.M20",
        "9.0.0.M21",
        "9.0.0.M22",
        "9.0.0.M25",
        "9.0.0.M26",
        "9.0.0.M27",
        "9.0.0.M3",
        "9.0.0.M4",
        "9.0.0.M6",
        "9.0.0.M8",
        "9.0.0.M9",
        "9.0.1",
        "9.0.10",
        "9.0.100",
        "9.0.102",
        "9.0.104",
        "9.0.105",
        "9.0.106",
        "9.0.107",
        "9.0.108",
        "9.0.109",
        "9.0.11",
        "9.0.110",
        "9.0.111",
        "9.0.112",
        "9.0.12",
        "9.0.13",
        "9.0.14",
        "9.0.16",
        "9.0.17",
        "9.0.19",
        "9.0.2",
        "9.0.20",
        "9.0.21",
        "9.0.22",
        "9.0.24",
        "9.0.26",
        "9.0.27",
        "9.0.29",
        "9.0.30",
        "9.0.31",
        "9.0.33",
        "9.0.34",
        "9.0.35",
        "9.0.36",
        "9.0.37",
        "9.0.38",
        "9.0.39",
        "9.0.4",
        "9.0.40",
        "9.0.41",
        "9.0.43",
        "9.0.44",
        "9.0.45",
        "9.0.46",
        "9.0.48",
        "9.0.5",
        "9.0.50",
        "9.0.52",
        "9.0.53",
        "9.0.54",
        "9.0.55",
        "9.0.56",
        "9.0.58",
        "9.0.59",
        "9.0.6",
        "9.0.60",
        "9.0.62",
        "9.0.63",
        "9.0.64",
        "9.0.65",
        "9.0.67",
        "9.0.68",
        "9.0.69",
        "9.0.7",
        "9.0.70",
        "9.0.71",
        "9.0.72",
        "9.0.73",
        "9.0.74",
        "9.0.75",
        "9.0.76",
        "9.0.78",
        "9.0.79",
        "9.0.8",
        "9.0.80",
        "9.0.81",
        "9.0.82",
        "9.0.83",
        "9.0.84",
        "9.0.85",
        "9.0.86",
        "9.0.87",
        "9.0.88",
        "9.0.89",
        "9.0.90",
        "9.0.91",
        "9.0.93",
        "9.0.94",
        "9.0.95",
        "9.0.96",
        "9.0.97",
        "9.0.98",
        "9.0.99"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpj8-gq4v-p354/GHSA-fpj8-gq4v-p354.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat",
        "purl": "pkg:maven/org.apache.tomcat/tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-M1"
            },
            {
              "fixed": "11.0.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.0.0",
        "11.0.0-M1",
        "11.0.0-M10",
        "11.0.0-M11",
        "11.0.0-M12",
        "11.0.0-M13",
        "11.0.0-M14",
        "11.0.0-M15",
        "11.0.0-M16",
        "11.0.0-M17",
        "11.0.0-M18",
        "11.0.0-M19",
        "11.0.0-M20",
        "11.0.0-M21",
        "11.0.0-M22",
        "11.0.0-M24",
        "11.0.0-M25",
        "11.0.0-M26",
        "11.0.0-M3",
        "11.0.0-M4",
        "11.0.0-M5",
        "11.0.0-M6",
        "11.0.0-M7",
        "11.0.0-M9",
        "11.0.1",
        "11.0.10",
        "11.0.11",
        "11.0.12",
        "11.0.13",
        "11.0.14",
        "11.0.2",
        "11.0.3",
        "11.0.4",
        "11.0.5",
        "11.0.6",
        "11.0.7",
        "11.0.8",
        "11.0.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpj8-gq4v-p354/GHSA-fpj8-gq4v-p354.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat",
        "purl": "pkg:maven/org.apache.tomcat/tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.1.0-M1"
            },
            {
              "fixed": "10.1.50"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.1.0",
        "10.1.0-M1",
        "10.1.0-M10",
        "10.1.0-M11",
        "10.1.0-M12",
        "10.1.0-M14",
        "10.1.0-M15",
        "10.1.0-M16",
        "10.1.0-M17",
        "10.1.0-M2",
        "10.1.0-M4",
        "10.1.0-M5",
        "10.1.0-M6",
        "10.1.0-M7",
        "10.1.0-M8",
        "10.1.1",
        "10.1.10",
        "10.1.11",
        "10.1.12",
        "10.1.13",
        "10.1.14",
        "10.1.15",
        "10.1.16",
        "10.1.17",
        "10.1.18",
        "10.1.19",
        "10.1.2",
        "10.1.20",
        "10.1.23",
        "10.1.24",
        "10.1.25",
        "10.1.26",
        "10.1.28",
        "10.1.29",
        "10.1.30",
        "10.1.31",
        "10.1.33",
        "10.1.34",
        "10.1.35",
        "10.1.36",
        "10.1.39",
        "10.1.4",
        "10.1.40",
        "10.1.41",
        "10.1.42",
        "10.1.43",
        "10.1.44",
        "10.1.45",
        "10.1.46",
        "10.1.47",
        "10.1.48",
        "10.1.49",
        "10.1.5",
        "10.1.6",
        "10.1.7",
        "10.1.8",
        "10.1.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpj8-gq4v-p354/GHSA-fpj8-gq4v-p354.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat",
        "purl": "pkg:maven/org.apache.tomcat/tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0-M1"
            },
            {
              "fixed": "9.0.113"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.0.0.M1",
        "9.0.0.M10",
        "9.0.0.M11",
        "9.0.0.M13",
        "9.0.0.M15",
        "9.0.0.M17",
        "9.0.0.M18",
        "9.0.0.M19",
        "9.0.0.M20",
        "9.0.0.M21",
        "9.0.0.M22",
        "9.0.0.M25",
        "9.0.0.M26",
        "9.0.0.M27",
        "9.0.0.M3",
        "9.0.0.M4",
        "9.0.0.M6",
        "9.0.0.M8",
        "9.0.0.M9",
        "9.0.1",
        "9.0.10",
        "9.0.100",
        "9.0.102",
        "9.0.104",
        "9.0.105",
        "9.0.106",
        "9.0.107",
        "9.0.108",
        "9.0.109",
        "9.0.11",
        "9.0.110",
        "9.0.111",
        "9.0.112",
        "9.0.12",
        "9.0.13",
        "9.0.14",
        "9.0.16",
        "9.0.17",
        "9.0.19",
        "9.0.2",
        "9.0.20",
        "9.0.21",
        "9.0.22",
        "9.0.24",
        "9.0.26",
        "9.0.27",
        "9.0.29",
        "9.0.30",
        "9.0.31",
        "9.0.33",
        "9.0.34",
        "9.0.35",
        "9.0.36",
        "9.0.37",
        "9.0.38",
        "9.0.39",
        "9.0.4",
        "9.0.40",
        "9.0.41",
        "9.0.43",
        "9.0.44",
        "9.0.45",
        "9.0.46",
        "9.0.48",
        "9.0.5",
        "9.0.50",
        "9.0.52",
        "9.0.53",
        "9.0.54",
        "9.0.55",
        "9.0.56",
        "9.0.58",
        "9.0.59",
        "9.0.6",
        "9.0.60",
        "9.0.62",
        "9.0.63",
        "9.0.64",
        "9.0.65",
        "9.0.67",
        "9.0.68",
        "9.0.69",
        "9.0.7",
        "9.0.70",
        "9.0.71",
        "9.0.72",
        "9.0.73",
        "9.0.74",
        "9.0.75",
        "9.0.76",
        "9.0.78",
        "9.0.79",
        "9.0.8",
        "9.0.80",
        "9.0.81",
        "9.0.82",
        "9.0.83",
        "9.0.84",
        "9.0.85",
        "9.0.86",
        "9.0.87",
        "9.0.88",
        "9.0.89",
        "9.0.90",
        "9.0.91",
        "9.0.93",
        "9.0.94",
        "9.0.95",
        "9.0.96",
        "9.0.97",
        "9.0.98",
        "9.0.99"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpj8-gq4v-p354/GHSA-fpj8-gq4v-p354.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-coyote",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "11.0.0-M1"
            },
            {
              "fixed": "11.0.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.0.0",
        "11.0.0-M1",
        "11.0.0-M10",
        "11.0.0-M11",
        "11.0.0-M12",
        "11.0.0-M13",
        "11.0.0-M14",
        "11.0.0-M15",
        "11.0.0-M16",
        "11.0.0-M17",
        "11.0.0-M18",
        "11.0.0-M19",
        "11.0.0-M20",
        "11.0.0-M21",
        "11.0.0-M22",
        "11.0.0-M24",
        "11.0.0-M25",
        "11.0.0-M26",
        "11.0.0-M3",
        "11.0.0-M4",
        "11.0.0-M5",
        "11.0.0-M6",
        "11.0.0-M7",
        "11.0.0-M9",
        "11.0.1",
        "11.0.10",
        "11.0.11",
        "11.0.12",
        "11.0.13",
        "11.0.14",
        "11.0.2",
        "11.0.3",
        "11.0.4",
        "11.0.5",
        "11.0.6",
        "11.0.7",
        "11.0.8",
        "11.0.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpj8-gq4v-p354/GHSA-fpj8-gq4v-p354.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-coyote",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "10.1.0-M1"
            },
            {
              "fixed": "10.1.50"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "10.1.0",
        "10.1.0-M1",
        "10.1.0-M10",
        "10.1.0-M11",
        "10.1.0-M12",
        "10.1.0-M14",
        "10.1.0-M15",
        "10.1.0-M16",
        "10.1.0-M17",
        "10.1.0-M2",
        "10.1.0-M4",
        "10.1.0-M5",
        "10.1.0-M6",
        "10.1.0-M7",
        "10.1.0-M8",
        "10.1.1",
        "10.1.10",
        "10.1.11",
        "10.1.12",
        "10.1.13",
        "10.1.14",
        "10.1.15",
        "10.1.16",
        "10.1.17",
        "10.1.18",
        "10.1.19",
        "10.1.2",
        "10.1.20",
        "10.1.23",
        "10.1.24",
        "10.1.25",
        "10.1.26",
        "10.1.28",
        "10.1.29",
        "10.1.30",
        "10.1.31",
        "10.1.33",
        "10.1.34",
        "10.1.35",
        "10.1.36",
        "10.1.39",
        "10.1.4",
        "10.1.40",
        "10.1.41",
        "10.1.42",
        "10.1.43",
        "10.1.44",
        "10.1.45",
        "10.1.46",
        "10.1.47",
        "10.1.48",
        "10.1.49",
        "10.1.5",
        "10.1.6",
        "10.1.7",
        "10.1.8",
        "10.1.9"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpj8-gq4v-p354/GHSA-fpj8-gq4v-p354.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-coyote",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "9.0.0-M1"
            },
            {
              "fixed": "9.0.113"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.0.0.M1",
        "9.0.0.M10",
        "9.0.0.M11",
        "9.0.0.M13",
        "9.0.0.M15",
        "9.0.0.M17",
        "9.0.0.M18",
        "9.0.0.M19",
        "9.0.0.M20",
        "9.0.0.M21",
        "9.0.0.M22",
        "9.0.0.M25",
        "9.0.0.M26",
        "9.0.0.M27",
        "9.0.0.M3",
        "9.0.0.M4",
        "9.0.0.M6",
        "9.0.0.M8",
        "9.0.0.M9",
        "9.0.1",
        "9.0.10",
        "9.0.100",
        "9.0.102",
        "9.0.104",
        "9.0.105",
        "9.0.106",
        "9.0.107",
        "9.0.108",
        "9.0.109",
        "9.0.11",
        "9.0.110",
        "9.0.111",
        "9.0.112",
        "9.0.12",
        "9.0.13",
        "9.0.14",
        "9.0.16",
        "9.0.17",
        "9.0.19",
        "9.0.2",
        "9.0.20",
        "9.0.21",
        "9.0.22",
        "9.0.24",
        "9.0.26",
        "9.0.27",
        "9.0.29",
        "9.0.30",
        "9.0.31",
        "9.0.33",
        "9.0.34",
        "9.0.35",
        "9.0.36",
        "9.0.37",
        "9.0.38",
        "9.0.39",
        "9.0.4",
        "9.0.40",
        "9.0.41",
        "9.0.43",
        "9.0.44",
        "9.0.45",
        "9.0.46",
        "9.0.48",
        "9.0.5",
        "9.0.50",
        "9.0.52",
        "9.0.53",
        "9.0.54",
        "9.0.55",
        "9.0.56",
        "9.0.58",
        "9.0.59",
        "9.0.6",
        "9.0.60",
        "9.0.62",
        "9.0.63",
        "9.0.64",
        "9.0.65",
        "9.0.67",
        "9.0.68",
        "9.0.69",
        "9.0.7",
        "9.0.70",
        "9.0.71",
        "9.0.72",
        "9.0.73",
        "9.0.74",
        "9.0.75",
        "9.0.76",
        "9.0.78",
        "9.0.79",
        "9.0.8",
        "9.0.80",
        "9.0.81",
        "9.0.82",
        "9.0.83",
        "9.0.84",
        "9.0.85",
        "9.0.86",
        "9.0.87",
        "9.0.88",
        "9.0.89",
        "9.0.90",
        "9.0.91",
        "9.0.93",
        "9.0.94",
        "9.0.95",
        "9.0.96",
        "9.0.97",
        "9.0.98",
        "9.0.99"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpj8-gq4v-p354/GHSA-fpj8-gq4v-p354.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat.embed:tomcat-embed-core",
        "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.5.0"
            },
            {
              "last_affected": "8.5.100"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.5.0",
        "8.5.100",
        "8.5.11",
        "8.5.12",
        "8.5.13",
        "8.5.14",
        "8.5.15",
        "8.5.16",
        "8.5.19",
        "8.5.2",
        "8.5.20",
        "8.5.21",
        "8.5.23",
        "8.5.24",
        "8.5.27",
        "8.5.28",
        "8.5.29",
        "8.5.3",
        "8.5.30",
        "8.5.31",
        "8.5.32",
        "8.5.33",
        "8.5.34",
        "8.5.35",
        "8.5.37",
        "8.5.38",
        "8.5.39",
        "8.5.4",
        "8.5.40",
        "8.5.41",
        "8.5.42",
        "8.5.43",
        "8.5.45",
        "8.5.46",
        "8.5.47",
        "8.5.49",
        "8.5.5",
        "8.5.50",
        "8.5.51",
        "8.5.53",
        "8.5.54",
        "8.5.55",
        "8.5.56",
        "8.5.57",
        "8.5.58",
        "8.5.59",
        "8.5.6",
        "8.5.60",
        "8.5.61",
        "8.5.63",
        "8.5.64",
        "8.5.65",
        "8.5.66",
        "8.5.68",
        "8.5.69",
        "8.5.70",
        "8.5.71",
        "8.5.72",
        "8.5.73",
        "8.5.75",
        "8.5.76",
        "8.5.77",
        "8.5.78",
        "8.5.79",
        "8.5.8",
        "8.5.81",
        "8.5.82",
        "8.5.83",
        "8.5.84",
        "8.5.85",
        "8.5.86",
        "8.5.87",
        "8.5.88",
        "8.5.89",
        "8.5.9",
        "8.5.90",
        "8.5.91",
        "8.5.92",
        "8.5.93",
        "8.5.94",
        "8.5.95",
        "8.5.96",
        "8.5.97",
        "8.5.98",
        "8.5.99"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpj8-gq4v-p354/GHSA-fpj8-gq4v-p354.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat",
        "purl": "pkg:maven/org.apache.tomcat/tomcat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.5.0"
            },
            {
              "last_affected": "8.5.100"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.5.0",
        "8.5.100",
        "8.5.11",
        "8.5.12",
        "8.5.13",
        "8.5.14",
        "8.5.15",
        "8.5.16",
        "8.5.19",
        "8.5.2",
        "8.5.20",
        "8.5.21",
        "8.5.23",
        "8.5.24",
        "8.5.27",
        "8.5.28",
        "8.5.29",
        "8.5.3",
        "8.5.30",
        "8.5.31",
        "8.5.32",
        "8.5.33",
        "8.5.34",
        "8.5.35",
        "8.5.37",
        "8.5.38",
        "8.5.39",
        "8.5.4",
        "8.5.40",
        "8.5.41",
        "8.5.42",
        "8.5.43",
        "8.5.45",
        "8.5.46",
        "8.5.47",
        "8.5.49",
        "8.5.5",
        "8.5.50",
        "8.5.51",
        "8.5.53",
        "8.5.54",
        "8.5.55",
        "8.5.56",
        "8.5.57",
        "8.5.58",
        "8.5.59",
        "8.5.6",
        "8.5.60",
        "8.5.61",
        "8.5.63",
        "8.5.64",
        "8.5.65",
        "8.5.66",
        "8.5.68",
        "8.5.69",
        "8.5.70",
        "8.5.71",
        "8.5.72",
        "8.5.73",
        "8.5.75",
        "8.5.76",
        "8.5.77",
        "8.5.78",
        "8.5.79",
        "8.5.8",
        "8.5.81",
        "8.5.82",
        "8.5.83",
        "8.5.84",
        "8.5.85",
        "8.5.86",
        "8.5.87",
        "8.5.88",
        "8.5.89",
        "8.5.9",
        "8.5.90",
        "8.5.91",
        "8.5.92",
        "8.5.93",
        "8.5.94",
        "8.5.95",
        "8.5.96",
        "8.5.97",
        "8.5.98",
        "8.5.99"
      ]
    },
    {
      "database_specific": {
        "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-fpj8-gq4v-p354/GHSA-fpj8-gq4v-p354.json"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.tomcat:tomcat-coyote",
        "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.5.0"
            },
            {
              "last_affected": "8.5.100"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.5.0",
        "8.5.100",
        "8.5.11",
        "8.5.12",
        "8.5.13",
        "8.5.14",
        "8.5.15",
        "8.5.16",
        "8.5.19",
        "8.5.2",
        "8.5.20",
        "8.5.21",
        "8.5.23",
        "8.5.24",
        "8.5.27",
        "8.5.28",
        "8.5.29",
        "8.5.3",
        "8.5.30",
        "8.5.31",
        "8.5.32",
        "8.5.33",
        "8.5.34",
        "8.5.35",
        "8.5.37",
        "8.5.38",
        "8.5.39",
        "8.5.4",
        "8.5.40",
        "8.5.41",
        "8.5.42",
        "8.5.43",
        "8.5.45",
        "8.5.46",
        "8.5.47",
        "8.5.49",
        "8.5.5",
        "8.5.50",
        "8.5.51",
        "8.5.53",
        "8.5.54",
        "8.5.55",
        "8.5.56",
        "8.5.57",
        "8.5.58",
        "8.5.59",
        "8.5.6",
        "8.5.60",
        "8.5.61",
        "8.5.63",
        "8.5.64",
        "8.5.65",
        "8.5.66",
        "8.5.68",
        "8.5.69",
        "8.5.70",
        "8.5.71",
        "8.5.72",
        "8.5.73",
        "8.5.75",
        "8.5.76",
        "8.5.77",
        "8.5.78",
        "8.5.79",
        "8.5.8",
        "8.5.81",
        "8.5.82",
        "8.5.83",
        "8.5.84",
        "8.5.85",
        "8.5.86",
        "8.5.87",
        "8.5.88",
        "8.5.89",
        "8.5.9",
        "8.5.90",
        "8.5.91",
        "8.5.92",
        "8.5.93",
        "8.5.94",
        "8.5.95",
        "8.5.96",
        "8.5.97",
        "8.5.98",
        "8.5.99"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66614"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-19T15:06:50Z",
    "nvd_published_at": "2026-02-17T19:21:55Z",
    "severity": "MODERATE"
  },
  "details": "Improper Input Validation vulnerability.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.\n\nThe vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.\n\nUsers are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.",
  "id": "GHSA-fpj8-gq4v-p354",
  "modified": "2026-09-10T09:40:56.856160873Z",
  "published": "2026-02-17T21:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66614"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/152c14885d45f5e0a8b59bd9f93c289cfe20ce30"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/258a591b61f8cf5c22109e21e5a2a38b63454fd2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/5053fa82a1b2b52756810601227984a8b71888a4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/9276b5e783c8cd5b3fe2bb716306b65004bdd940"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/972f9a5e2a07674d92610c478aac1b205d60724e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/tomcat/commit/a4aa74232e826028cd2f7ba0445caf8a8b52c509"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/apache/tomcat"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-10.html"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-11.html"
    },
    {
      "type": "WEB",
      "url": "https://tomcat.apache.org/security-9.html"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Apache Tomcat - Client certificate verification bypass"
}