{
  "advisories": [
    {
      "id": "GHSA-rv64-5gf8-9qq8",
      "source": "ghsa",
      "title": "Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve",
      "url": "https://github.com/advisories/GHSA-rv64-5gf8-9qq8"
    },
    {
      "id": "DLA-4619-1",
      "source": "dla",
      "title": "tomcat9 security update",
      "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00008.html"
    },
    {
      "id": "DSA-6328-1",
      "source": "dsa",
      "title": "tomcat10 security update",
      "url": "https://lists.debian.org/debian-security-announce/2026/msg00239.html"
    },
    {
      "id": "DSA-6329-1",
      "source": "dsa",
      "title": "tomcat11 security update",
      "url": "https://lists.debian.org/debian-security-announce/2026/msg00240.html"
    }
  ],
  "cve": "CVE-2026-34483",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[11.0.0-M1,11.0.20]"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[10.1.0-M1,10.1.53]"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[9.0.40,9.0.116]"
            }
          },
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[8.5.84,8.5.100]"
            }
          },
          {
            "platform": null,
            "status": "unaffected",
            "versions": {
              "scheme": "generic",
              "value": "[0,8.5.83]"
            }
          }
        ],
        "enrichment": {
          "confidence": 95.0,
          "confidence_source": "inferred",
          "scores": [
            {
              "score": 95.0,
              "source": "inferred"
            },
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Apache Tomcat",
          "source": "cna",
          "vendor": "Apache Software Foundation"
        },
        "product": "tomcat",
        "vendor": "apache"
      }
    ],
    "analysis": {
      "en": {
        "generated_at": "2026-04-14T14:36:48.749177+00:00",
        "value": {
          "mitigation_remediation": [
            "Upgrade Apache Tomcat to the latest supported release: 9.0.117, 10.1.54, or 11.0.21, which contain the fix for JsonAccessLogValve encoding.",
            "If an upgrade is not immediately possible, restrict read/write access to the JSON access log location to trusted administrative users only and avoid exposing log files via the web.",
            "Verify that no untrusted data is being written to logs by disabling or sanitizing verbose logging for untrusted request parameters until a patch can be applied."
          ],
          "summary": {
            "action": "Patch",
            "impact": "Improper Output Encoding"
          },
          "threat_synthesis": {
            "affected_systems": "This flaw affects Apache Tomcat releases 9.0.40 through 9.0.116, 10.1.0‑M1 through 10.1.53, and 11.0.0‑M1 through 11.0.20. The affected component is the JsonAccessLogValve used for writing JSON‑formatted access logs.",
            "description_and_impact": "The vulnerability stems from incomplete escaping of JSON data in the JsonAccessLogValve component of Apache Tomcat. When client requests contain untrusted input that is recorded to JSON access logs, that input is written without proper encoding. An attacker could embed crafted JSON structures or script fragments that, when later viewed by an administrator or through a log‑viewer interface, may trigger cross‑site scripting, injection or even execution of code in the context of the logging application. The impact is primarily information disclosure and potential compromise of the logging platform, and potentially the web tier that displays those logs.",
            "risk_and_exploitability": "The CVSS score of 7.5 indicates high severity. The EPSS score is below 1%, so widespread exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to send crafted requests that are logged and to subsequently gain read access to the log files or to a log‑viewing interface. For environments that expose log files to the web or rely on shared log viewer applications, the risk can be higher. Tier‑1 organizations should monitor for unusual log activity and apply the recommended patch promptly."
          }
        }
      }
    },
    "created": "2026-04-10T08:38:50.654324+00:00",
    "updated": "2026-04-14T16:36:49.233956+00:00",
    "vendors": [
      "apache",
      "apache$PRODUCT$tomcat"
    ]
  },
  "epss": {
    "score": 0.00469
  },
  "mitre": {
    "cpes": [],
    "created": "2026-04-09T19:30:28.874000+00:00",
    "description": "Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/34xxx/CVE-2026-34483.json",
    "references": [
      "https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b"
    ],
    "title": "Apache Tomcat: Incomplete escaping of JSON access logs",
    "updated": "2026-04-10T20:17:38.858000+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-116"
    ]
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-04-09T20:16:24.937000+00:00",
    "description": "Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.5,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-34483.json",
    "references": [
      "http://www.openwall.com/lists/oss-security/2026/04/09/26",
      "https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b"
    ],
    "title": null,
    "updated": "2026-10-26T21:10:00.170000+00:00",
    "vendors": [
      "apache",
      "apache$PRODUCT$tomcat"
    ],
    "weaknesses": [
      "CWE-116"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-04-09T20:00:00+00:00",
        "data": [
          {
            "details": {
              "new": "Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "Apache Tomcat: Incomplete escaping of JSON access logs",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-116"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "5634a744-ad5c-451c-84a9-cd963dc8767d"
      },
      {
        "created": "2026-04-10T00:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "http://www.openwall.com/lists/oss-security/2026/04/09/26"
              ],
              "removed": []
            },
            "type": "references"
          }
        ],
        "id": "1c65c67f-661f-4181-84fa-f708dbfd9f42"
      },
      {
        "created": "2026-04-10T09:00:00+00:00",
        "data": [
          {
            "details": [
              "apache",
              "apache$PRODUCT$tomcat"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "apache",
                "apache$PRODUCT$tomcat"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "ba6cac21-b444-40dc-8ff4-88ce8326497a"
      },
      {
        "created": "2026-04-10T12:15:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "CWE-838"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": [
                "https://nvd.nist.gov/vuln/detail/CVE-2026-34483",
                "https://www.cve.org/CVERecord?id=CVE-2026-34483"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 5.4,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
                }
              },
              "removed": {},
              "updated": {
                "threat_severity": {
                  "new": "Low",
                  "old": null
                }
              }
            },
            "type": "metrics"
          }
        ],
        "id": "c24c25b4-87ff-4972-9caf-c043fc450fff"
      },
      {
        "created": "2026-04-10T21:15:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "yes",
                    "Exploitation": "none",
                    "Technical Impact": "partial"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {
                "cvssV3_1": {
                  "new": {
                    "score": 7.5,
                    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
                  },
                  "old": {
                    "score": 5.4,
                    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
                  }
                }
              }
            },
            "type": "metrics"
          }
        ],
        "id": "082d3552-75a1-463b-badf-76e8be93add4"
      },
      {
        "created": "2026-04-14T13:00:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          }
        ],
        "id": "89a596d8-09ce-4b5f-aced-23d48fa6ca08"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*"
      ],
      "providers": [
        "nvd"
      ]
    },
    "created": {
      "data": "2026-04-09T19:30:28+00:00",
      "provider": "redhat"
    },
    "description": {
      "data": "Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 7.5,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        "provider": "vulnrichment"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00469
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "yes",
            "Exploitation": "none",
            "Technical Impact": "partial"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": "Low",
        "provider": "redhat"
      }
    },
    "references": {
      "data": [
        "http://www.openwall.com/lists/oss-security/2026/04/09/26",
        "https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-34483",
        "https://www.cve.org/CVERecord?id=CVE-2026-34483"
      ],
      "providers": [
        "mitre",
        "nvd",
        "redhat"
      ]
    },
    "title": {
      "data": "Apache Tomcat: Incomplete escaping of JSON access logs",
      "provider": "mitre"
    },
    "updated": {
      "data": "2026-04-14T16:36:49.233956+00:00",
      "provider": "enrichment"
    },
    "vendors": {
      "data": [
        "apache",
        "apache$PRODUCT$tomcat"
      ],
      "providers": [
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-116",
        "CWE-838"
      ],
      "providers": [
        "mitre",
        "nvd",
        "redhat"
      ]
    }
  },
  "redhat": {
    "cpes": [],
    "created": "2026-04-09T19:30:28+00:00",
    "description": "A flaw was found in the JsonAccessLogValve component of Apache Tomcat. This improper encoding or escaping of output vulnerability could allow an attacker to inject specially crafted data into log files. This could lead to information disclosure or other unintended consequences when the logs are processed or viewed.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 5.4,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
      },
      "threat_severity": "Low"
    },
    "redhat_repo_path": "2026/CVE-2026-34483.json",
    "references": [
      "https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b",
      "https://nvd.nist.gov/vuln/detail/CVE-2026-34483",
      "https://www.cve.org/CVERecord?id=CVE-2026-34483"
    ],
    "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve",
    "updated": "2026-04-09T19:30:28+00:00",
    "vendors": [],
    "weaknesses": [
      "CWE-838"
    ]
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-04-09T19:30:28.874000+00:00",
    "description": "Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.5,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
      },
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "yes",
          "Exploitation": "none",
          "Technical Impact": "partial"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": "Apache Tomcat: Incomplete escaping of JSON access logs",
    "updated": "2026-04-10T20:15:20.161000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/34xxx/CVE-2026-34483.json",
    "weaknesses": []
  }
}