ghsa-9m3c-qcxr-9x87
CVSS 6.9 osv_maven
Description
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
Weaknesses (CWE)
References
Linked Vulnerabilities
No linked vulnerabilities found.
{
"affected": [
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9m3c-qcxr-9x87/GHSA-9m3c-qcxr-9x87.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-catalina",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"events": [
{
"introduced": "8.5.30"
},
{
"fixed": "9.0.116"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.5.100",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99",
"9.0.0.M1",
"9.0.0.M10",
"9.0.0.M11",
"9.0.0.M13",
"9.0.0.M15",
"9.0.0.M17",
"9.0.0.M18",
"9.0.0.M19",
"9.0.0.M20",
"9.0.0.M21",
"9.0.0.M22",
"9.0.0.M25",
"9.0.0.M26",
"9.0.0.M27",
"9.0.0.M3",
"9.0.0.M4",
"9.0.0.M6",
"9.0.0.M8",
"9.0.0.M9",
"9.0.1",
"9.0.10",
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.11",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.12",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9m3c-qcxr-9x87/GHSA-9m3c-qcxr-9x87.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-catalina",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.53"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9m3c-qcxr-9x87/GHSA-9m3c-qcxr-9x87.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-catalina",
"purl": "pkg:maven/org.apache.tomcat/tomcat-catalina"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.20"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9m3c-qcxr-9x87/GHSA-9m3c-qcxr-9x87.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "8.5.30"
},
{
"fixed": "9.0.116"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.5.100",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99",
"9.0.0.M1",
"9.0.0.M10",
"9.0.0.M11",
"9.0.0.M13",
"9.0.0.M15",
"9.0.0.M17",
"9.0.0.M18",
"9.0.0.M19",
"9.0.0.M20",
"9.0.0.M21",
"9.0.0.M22",
"9.0.0.M25",
"9.0.0.M26",
"9.0.0.M27",
"9.0.0.M3",
"9.0.0.M4",
"9.0.0.M6",
"9.0.0.M8",
"9.0.0.M9",
"9.0.1",
"9.0.10",
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.11",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.12",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9m3c-qcxr-9x87/GHSA-9m3c-qcxr-9x87.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.53"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9m3c-qcxr-9x87/GHSA-9m3c-qcxr-9x87.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat",
"purl": "pkg:maven/org.apache.tomcat/tomcat"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.20"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9m3c-qcxr-9x87/GHSA-9m3c-qcxr-9x87.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "8.5.30"
},
{
"fixed": "9.0.116"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.5.100",
"8.5.30",
"8.5.31",
"8.5.32",
"8.5.33",
"8.5.34",
"8.5.35",
"8.5.37",
"8.5.38",
"8.5.39",
"8.5.40",
"8.5.41",
"8.5.42",
"8.5.43",
"8.5.45",
"8.5.46",
"8.5.47",
"8.5.49",
"8.5.50",
"8.5.51",
"8.5.53",
"8.5.54",
"8.5.55",
"8.5.56",
"8.5.57",
"8.5.58",
"8.5.59",
"8.5.60",
"8.5.61",
"8.5.63",
"8.5.64",
"8.5.65",
"8.5.66",
"8.5.68",
"8.5.69",
"8.5.70",
"8.5.71",
"8.5.72",
"8.5.73",
"8.5.75",
"8.5.76",
"8.5.77",
"8.5.78",
"8.5.79",
"8.5.81",
"8.5.82",
"8.5.83",
"8.5.84",
"8.5.85",
"8.5.86",
"8.5.87",
"8.5.88",
"8.5.89",
"8.5.90",
"8.5.91",
"8.5.92",
"8.5.93",
"8.5.94",
"8.5.95",
"8.5.96",
"8.5.97",
"8.5.98",
"8.5.99",
"9.0.0.M1",
"9.0.0.M10",
"9.0.0.M11",
"9.0.0.M13",
"9.0.0.M15",
"9.0.0.M17",
"9.0.0.M18",
"9.0.0.M19",
"9.0.0.M20",
"9.0.0.M21",
"9.0.0.M22",
"9.0.0.M25",
"9.0.0.M26",
"9.0.0.M27",
"9.0.0.M3",
"9.0.0.M4",
"9.0.0.M6",
"9.0.0.M8",
"9.0.0.M9",
"9.0.1",
"9.0.10",
"9.0.100",
"9.0.102",
"9.0.104",
"9.0.105",
"9.0.106",
"9.0.107",
"9.0.108",
"9.0.109",
"9.0.11",
"9.0.110",
"9.0.111",
"9.0.112",
"9.0.113",
"9.0.115",
"9.0.12",
"9.0.13",
"9.0.14",
"9.0.16",
"9.0.17",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.22",
"9.0.24",
"9.0.26",
"9.0.27",
"9.0.29",
"9.0.30",
"9.0.31",
"9.0.33",
"9.0.34",
"9.0.35",
"9.0.36",
"9.0.37",
"9.0.38",
"9.0.39",
"9.0.4",
"9.0.40",
"9.0.41",
"9.0.43",
"9.0.44",
"9.0.45",
"9.0.46",
"9.0.48",
"9.0.5",
"9.0.50",
"9.0.52",
"9.0.53",
"9.0.54",
"9.0.55",
"9.0.56",
"9.0.58",
"9.0.59",
"9.0.6",
"9.0.60",
"9.0.62",
"9.0.63",
"9.0.64",
"9.0.65",
"9.0.67",
"9.0.68",
"9.0.69",
"9.0.7",
"9.0.70",
"9.0.71",
"9.0.72",
"9.0.73",
"9.0.74",
"9.0.75",
"9.0.76",
"9.0.78",
"9.0.79",
"9.0.8",
"9.0.80",
"9.0.81",
"9.0.82",
"9.0.83",
"9.0.84",
"9.0.85",
"9.0.86",
"9.0.87",
"9.0.88",
"9.0.89",
"9.0.90",
"9.0.91",
"9.0.93",
"9.0.94",
"9.0.95",
"9.0.96",
"9.0.97",
"9.0.98",
"9.0.99"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9m3c-qcxr-9x87/GHSA-9m3c-qcxr-9x87.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.53"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.1.0",
"10.1.0-M1",
"10.1.0-M10",
"10.1.0-M11",
"10.1.0-M12",
"10.1.0-M14",
"10.1.0-M15",
"10.1.0-M16",
"10.1.0-M17",
"10.1.0-M2",
"10.1.0-M4",
"10.1.0-M5",
"10.1.0-M6",
"10.1.0-M7",
"10.1.0-M8",
"10.1.1",
"10.1.10",
"10.1.11",
"10.1.12",
"10.1.13",
"10.1.14",
"10.1.15",
"10.1.16",
"10.1.17",
"10.1.18",
"10.1.19",
"10.1.2",
"10.1.20",
"10.1.23",
"10.1.24",
"10.1.25",
"10.1.26",
"10.1.28",
"10.1.29",
"10.1.30",
"10.1.31",
"10.1.33",
"10.1.34",
"10.1.35",
"10.1.36",
"10.1.39",
"10.1.4",
"10.1.40",
"10.1.41",
"10.1.42",
"10.1.43",
"10.1.44",
"10.1.45",
"10.1.46",
"10.1.47",
"10.1.48",
"10.1.49",
"10.1.5",
"10.1.50",
"10.1.52",
"10.1.6",
"10.1.7",
"10.1.8",
"10.1.9"
]
},
{
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-9m3c-qcxr-9x87/GHSA-9m3c-qcxr-9x87.json"
},
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat.embed:tomcat-embed-core",
"purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"
},
"ranges": [
{
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.20"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"11.0.0",
"11.0.0-M1",
"11.0.0-M10",
"11.0.0-M11",
"11.0.0-M12",
"11.0.0-M13",
"11.0.0-M14",
"11.0.0-M15",
"11.0.0-M16",
"11.0.0-M17",
"11.0.0-M18",
"11.0.0-M19",
"11.0.0-M20",
"11.0.0-M21",
"11.0.0-M22",
"11.0.0-M24",
"11.0.0-M25",
"11.0.0-M26",
"11.0.0-M3",
"11.0.0-M4",
"11.0.0-M5",
"11.0.0-M6",
"11.0.0-M7",
"11.0.0-M9",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.13",
"11.0.14",
"11.0.15",
"11.0.18",
"11.0.2",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9"
]
}
],
"aliases": [
"CVE-2026-25854"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-10T21:25:28Z",
"nvd_published_at": "2026-04-09T20:16:24Z",
"severity": "MODERATE"
},
"details": "Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100.\nOther, unsupported versions may also be affected\n\nUsers are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.",
"id": "GHSA-9m3c-qcxr-9x87",
"modified": "2026-09-10T09:40:56.653622384Z",
"published": "2026-04-09T21:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25854"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/04/09/21"
}
],
"schema_version": "1.9.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Apache Tomcat has an Open Redirect vulnerability"
}