{ "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.tomcat:tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote" }, "ranges": [ { "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.18" } ], "type": "ECOSYSTEM" } ], "versions": [ "11.0.0", "11.0.0-M1", "11.0.0-M10", "11.0.0-M11", "11.0.0-M12", "11.0.0-M13", "11.0.0-M14", "11.0.0-M15", "11.0.0-M16", "11.0.0-M17", "11.0.0-M18", "11.0.0-M19", "11.0.0-M20", "11.0.0-M21", "11.0.0-M22", "11.0.0-M24", "11.0.0-M25", "11.0.0-M26", "11.0.0-M3", "11.0.0-M4", "11.0.0-M5", "11.0.0-M6", "11.0.0-M7", "11.0.0-M9", "11.0.1", "11.0.10", "11.0.11", "11.0.12", "11.0.13", "11.0.14", "11.0.15", "11.0.2", "11.0.3", "11.0.4", "11.0.5", "11.0.6", "11.0.7", "11.0.8", "11.0.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.tomcat:tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote" }, "ranges": [ { "events": [ { "introduced": "10.1.0-M7" }, { "fixed": "10.1.52" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.1.0", "10.1.0-M10", "10.1.0-M11", "10.1.0-M12", "10.1.0-M14", "10.1.0-M15", "10.1.0-M16", "10.1.0-M17", "10.1.0-M7", "10.1.0-M8", "10.1.1", "10.1.10", "10.1.11", "10.1.12", "10.1.13", "10.1.14", "10.1.15", "10.1.16", "10.1.17", "10.1.18", "10.1.19", "10.1.2", "10.1.20", "10.1.23", "10.1.24", "10.1.25", "10.1.26", "10.1.28", "10.1.29", "10.1.30", "10.1.31", "10.1.33", "10.1.34", "10.1.35", "10.1.36", "10.1.39", "10.1.4", "10.1.40", "10.1.41", "10.1.42", "10.1.43", "10.1.44", "10.1.45", "10.1.46", "10.1.47", "10.1.48", "10.1.49", "10.1.5", "10.1.50", "10.1.6", "10.1.7", "10.1.8", "10.1.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.tomcat:tomcat-coyote", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote" }, "ranges": [ { "events": [ { "introduced": "9.0.83" }, { "fixed": "9.0.115" } ], "type": "ECOSYSTEM" } ], "versions": [ "9.0.100", "9.0.102", "9.0.104", "9.0.105", "9.0.106", "9.0.107", "9.0.108", "9.0.109", "9.0.110", "9.0.111", "9.0.112", "9.0.113", "9.0.83", "9.0.84", "9.0.85", "9.0.86", "9.0.87", "9.0.88", "9.0.89", "9.0.90", "9.0.91", "9.0.93", "9.0.94", "9.0.95", "9.0.96", "9.0.97", "9.0.98", "9.0.99" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.tomcat.embed:tomcat-embed-core", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.18" } ], "type": "ECOSYSTEM" } ], "versions": [ "11.0.0", "11.0.0-M1", "11.0.0-M10", "11.0.0-M11", "11.0.0-M12", "11.0.0-M13", "11.0.0-M14", "11.0.0-M15", "11.0.0-M16", "11.0.0-M17", "11.0.0-M18", "11.0.0-M19", "11.0.0-M20", "11.0.0-M21", "11.0.0-M22", "11.0.0-M24", "11.0.0-M25", "11.0.0-M26", "11.0.0-M3", "11.0.0-M4", "11.0.0-M5", "11.0.0-M6", "11.0.0-M7", "11.0.0-M9", "11.0.1", "11.0.10", "11.0.11", "11.0.12", "11.0.13", "11.0.14", "11.0.15", "11.0.2", "11.0.3", "11.0.4", "11.0.5", "11.0.6", "11.0.7", "11.0.8", "11.0.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.tomcat.embed:tomcat-embed-core", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "events": [ { "introduced": "10.1.0-M7" }, { "fixed": "10.1.52" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.1.0", "10.1.0-M10", "10.1.0-M11", "10.1.0-M12", "10.1.0-M14", "10.1.0-M15", "10.1.0-M16", "10.1.0-M17", "10.1.0-M7", "10.1.0-M8", "10.1.1", "10.1.10", "10.1.11", "10.1.12", "10.1.13", "10.1.14", "10.1.15", "10.1.16", "10.1.17", "10.1.18", "10.1.19", "10.1.2", "10.1.20", "10.1.23", "10.1.24", "10.1.25", "10.1.26", "10.1.28", "10.1.29", "10.1.30", "10.1.31", "10.1.33", "10.1.34", "10.1.35", "10.1.36", "10.1.39", "10.1.4", "10.1.40", "10.1.41", "10.1.42", "10.1.43", "10.1.44", "10.1.45", "10.1.46", "10.1.47", "10.1.48", "10.1.49", "10.1.5", "10.1.50", "10.1.6", "10.1.7", "10.1.8", "10.1.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.tomcat.embed:tomcat-embed-core", "purl": "pkg:maven/org.apache.tomcat.embed/tomcat-embed-core" }, "ranges": [ { "events": [ { "introduced": "9.0.83" }, { "fixed": "9.0.115" } ], "type": "ECOSYSTEM" } ], "versions": [ "9.0.100", "9.0.102", "9.0.104", "9.0.105", "9.0.106", "9.0.107", "9.0.108", "9.0.109", "9.0.110", "9.0.111", "9.0.112", "9.0.113", "9.0.83", "9.0.84", "9.0.85", "9.0.86", "9.0.87", "9.0.88", "9.0.89", "9.0.90", "9.0.91", "9.0.93", "9.0.94", "9.0.95", "9.0.96", "9.0.97", "9.0.98", "9.0.99" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.tomcat:tomcat-coyote-ffm", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm" }, "ranges": [ { "events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.18" } ], "type": "ECOSYSTEM" } ], "versions": [ "11.0.0", "11.0.0-M22", "11.0.0-M24", "11.0.0-M25", "11.0.0-M26", "11.0.1", "11.0.10", "11.0.11", "11.0.12", "11.0.13", "11.0.14", "11.0.15", "11.0.2", "11.0.3", "11.0.4", "11.0.5", "11.0.6", "11.0.7", "11.0.8", "11.0.9" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.tomcat:tomcat-coyote-ffm", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm" }, "ranges": [ { "events": [ { "introduced": "10.1.0-M7" }, { "fixed": "10.1.52" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.1.26", "10.1.28", "10.1.29", "10.1.30", "10.1.31", "10.1.33", "10.1.34", "10.1.35", "10.1.36", "10.1.39", "10.1.40", "10.1.41", "10.1.42", "10.1.43", "10.1.44", "10.1.45", "10.1.46", "10.1.47", "10.1.48", "10.1.49", "10.1.50" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-mgp5-rv84-w37q/GHSA-mgp5-rv84-w37q.json" }, "package": { "ecosystem": "Maven", "name": "org.apache.tomcat:tomcat-coyote-ffm", "purl": "pkg:maven/org.apache.tomcat/tomcat-coyote-ffm" }, "ranges": [ { "events": [ { "introduced": "9.0.83" }, { "fixed": "9.0.115" } ], "type": "ECOSYSTEM" } ], "versions": [ "9.0.100", "9.0.102", "9.0.104", "9.0.105", "9.0.106", "9.0.107", "9.0.108", "9.0.109", "9.0.110", "9.0.111", "9.0.112", "9.0.113", "9.0.93", "9.0.94", "9.0.95", "9.0.96", "9.0.97", "9.0.98", "9.0.99" ] } ], "aliases": [ "BIT-tomcat-2026-24734", "CVE-2026-24734" ], "database_specific": { "cwe_ids": [ "CWE-20", "CWE-295" ], "github_reviewed": true, "github_reviewed_at": "2026-03-19T19:04:12Z", "nvd_published_at": "2026-02-17T19:21:56Z", "severity": "HIGH" }, "details": "Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.\n\nWhen using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.\n\nThis issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.\n\nApache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.\n\nApache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.", "id": "GHSA-mgp5-rv84-w37q", "modified": "2026-11-04T03:30:50.704997391Z", "published": "2026-02-17T21:31:13Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24734" }, { "type": "WEB", "url": "https://github.com/apache/tomcat-native/commit/69a977dd427ad2a6da0f10aca3872386ee27f681" }, { "type": "WEB", "url": "https://github.com/apache/tomcat/commit/e76e9eaa246f30debd603726d9147a8a8cb5171c" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:19054" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:26323" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:36790" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:5611" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:5612" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:6569" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2026:8334" }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2026-24734" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440426" }, { "type": "PACKAGE", "url": "https://github.com/apache/tomcat" }, { "type": "WEB", "url": "https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml" }, { "type": "WEB", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24734.json" } ], "schema_version": "1.9.2", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "type": "CVSS_V3" } ], "summary": "Apache Tomcat has an Improper Input Validation vulnerability" }