diff --git a/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json b/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json index e75838db7329..6df4d1a2d73d 100644 --- a/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json +++ b/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-4x29-79gh-6v8q", - "modified": "2026-06-30T15:30:43Z", + "modified": "2026-10-19T08:49:28Z", "published": "2026-06-29T21:32:15Z", "aliases": [ "CVE-2026-53434" ], + "summary": "Apache Tomcat has a Detection of Error Condition Without Action vulnerability", "details": "Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.", "severity": [ { @@ -13,7 +14,228 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-coyote-ffm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.93" + }, + { + "fixed": "9.0.119" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 9.0.118" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-coyote-ffm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.26" + }, + { + "fixed": "10.1.56" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 10.1.55" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-coyote-ffm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M22" + }, + { + "fixed": "11.0.23" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 11.0.22" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-coyote" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.23" + }, + { + "fixed": "10.1.26" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 10.1.25" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-coyote" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M14" + }, + { + "fixed": "11.0.0-M22" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 11.0.0-M21" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat.embed:tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.23" + }, + { + "fixed": "10.1.28" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 10.1.26" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat.embed:tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M20" + }, + { + "fixed": "11.0.0-M24" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 11.0.0-M22" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.93" + }, + { + "fixed": "9.0.119" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 9.0.118" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.23" + }, + { + "fixed": "10.1.56" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 10.1.55" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M14" + }, + { + "fixed": "11.0.23" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 11.0.22" + } + } + ], "references": [ { "type": "ADVISORY",