From f37f96a5474917ec65984a86b8e6ad8639562eac Mon Sep 17 00:00:00 2001 From: Satoshi Hara Date: Mon, 19 Oct 2026 17:18:58 +0900 Subject: [PATCH 1/3] Add affected Maven packages and a summary to GHSA-4x29-79gh-6v8q --- .../GHSA-4x29-79gh-6v8q.json | 218 +++++++++++++++++- 1 file changed, 217 insertions(+), 1 deletion(-) diff --git a/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json b/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json index e75838db7329..178db70d298e 100644 --- a/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json +++ b/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json @@ -6,6 +6,7 @@ "aliases": [ "CVE-2026-53434" ], + "summary": "Apache Tomcat has a Detection of Error Condition Without Action vulnerability", "details": "Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.", "severity": [ { @@ -13,7 +14,222 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-coyote-ffm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.93" + }, + { + "fixed": "9.0.119" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 9.0.118" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-coyote-ffm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.26" + }, + { + "fixed": "10.1.56" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 10.1.55" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-coyote-ffm" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M22" + }, + { + "fixed": "11.0.23" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 11.0.22" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-coyote" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.23" + }, + { + "fixed": "10.1.26" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 10.1.25" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat-coyote" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M14" + }, + { + "fixed": "11.0.0-M22" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 11.0.0-M21" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat.embed:tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.23" + }, + { + "last_affected": "10.1.26" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat.embed:tomcat-embed-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M20" + }, + { + "last_affected": "11.0.0-M22" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "9.0.93" + }, + { + "fixed": "9.0.119" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 9.0.118" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "10.1.23" + }, + { + "fixed": "10.1.56" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 10.1.55" + } + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.apache.tomcat:tomcat" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "11.0.0-M14" + }, + { + "fixed": "11.0.23" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "<= 11.0.22" + } + } + ], "references": [ { "type": "ADVISORY", From 27b9431dd143f956df79387b04f08ab8887ed730 Mon Sep 17 00:00:00 2001 From: Satoshi Hara Date: Mon, 19 Oct 2026 17:49:28 +0900 Subject: [PATCH 2/3] Update modified timestamp --- .../2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json b/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json index 178db70d298e..d0f7c19cc4b2 100644 --- a/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json +++ b/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4x29-79gh-6v8q", - "modified": "2026-06-30T15:30:43Z", + "modified": "2026-10-19T08:49:28Z", "published": "2026-06-29T21:32:15Z", "aliases": [ "CVE-2026-53434" From 55276230d1644e39422c37163b4a7b3418f0d54f Mon Sep 17 00:00:00 2001 From: Satoshi Hara Date: Mon, 19 Oct 2026 17:52:40 +0900 Subject: [PATCH 3/3] Add fixed releases for tomcat-embed-core ranges --- .../GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json b/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json index d0f7c19cc4b2..6df4d1a2d73d 100644 --- a/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json +++ b/advisories/unreviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json @@ -138,11 +138,14 @@ "introduced": "10.1.23" }, { - "last_affected": "10.1.26" + "fixed": "10.1.28" } ] } - ] + ], + "database_specific": { + "last_known_affected_version_range": "<= 10.1.26" + } }, { "package": { @@ -157,11 +160,14 @@ "introduced": "11.0.0-M20" }, { - "last_affected": "11.0.0-M22" + "fixed": "11.0.0-M24" } ] } - ] + ], + "database_specific": { + "last_known_affected_version_range": "<= 11.0.0-M22" + } }, { "package": {