CVE-2022-30929

CVE-2022-30929 CVE-2022-30929 POC Suggested description Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper. Vulnerability Type Insecure Permissions Vendor of Product github;gitee Affected Product Code Base...

CLSA-2026-1792566014 jasper: Fix of CVE-2022-2963

CVE-2022-2963: fix memory leak in cmdoptsparse — add cmdoptsdestroy before badusage in the default case and the missing-output-format check...

com.github.psi-probe:psi-probe-tomcat11 (>=5.0.0, <=5.5.0), com.kfyty:k-jte (1.0.0) +28 more potentially affected by CVE-2026-74049 via org.apache.tomcat:tomcat-jasper (>=11.0.0-m16, <=11.0.26)

org.apache.tomcat:tomcat-jasper MAVEN version =11.0.0-m16, =5.0.0, =1.2.0-rc3, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.4 - org.apache.tomee.bom:tomee-webprofile 11.0.0-m1 and more Source cves: CVE-2026-74049 Source advisory: MEND:CVE-2026-74049...

cc.kkon:tomcat-embed-gmssl (>=9.0.63.x.1, <=9.0.63.x), cn.acooly:acooly-auth-google-authenticator (>=5.2.1, <=5.2.2) +343 more potentially affected by CVE-2026-74049 via org.apache.tomcat.embed:tomcat-embed-jasper (>=9.0.0.m27, <=9.0.122)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =9.0.0.m27, =9.0.63.x.1, =5.2.1, =5.2.1, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =1.0.0.release, =0.0.1, =5.2.1, =5.2.1, =5.2.2 and more Source cves: CVE-2026-74049 Source advisory: MEND:CVE-2026-74049...

codes.vps:mockta-server (>=0.3, <=0.5), com.axelor:axelor-tomcat (>=8.0.0, <=8.2.5) +125 more potentially affected by CVE-2026-74049 via org.apache.tomcat.embed:tomcat-embed-jasper (>=10.1.0-m6, <=10.1.60)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =10.1.0-m6, =0.3, =8.0.0, =5.0.0-m1, =5.0.0-m4, =0.0.2, =1.3.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.0.0, =13.0, =13.1 and more Source cves: CVE-2026-74049 Source advisory: MEND:CVE-2026-74049...

com.earldouglas:sbt-war_2.12_1.0 (>=5.0.0-m1, <=5.0.0-m4), com.earldouglas:war-runner (>=5.0.0-m4, <=10.1.28.0.0-m2) +60 more potentially affected by CVE-2026-74049 via org.apache.tomcat:tomcat-jasper (>=10.1.0-m6, <=10.1.60)

org.apache.tomcat:tomcat-jasper MAVEN version =10.1.0-m6, =5.0.0-m1, =5.0.0-m4, =3.0.0, =5.0.0, =5.0.0, =10.1.16.0, =10.1.16.0, =10.1.16.0, =10.1.16.0, =10.1.16.0, =3.1.1, =16.1.2, =3.1.1, =13.0.8, =13.1.2 and more Source cves: CVE-2026-74049 Source advisory: MEND:CVE-2026-74049...

com.earldouglas:war-runner (>=5.2.0_6.1, <=5.2.3_6.1), com.gitee.kamismile:stone-common-ex (1.9.0) +33 more potentially affected by CVE-2026-74049 via org.apache.tomcat.embed:tomcat-embed-jasper (>=11.0.0-m15, <=11.0.26)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =11.0.0-m15, =5.2.06.1, =13.2, =1.0.0, =1.9.1, =3.7.0, =2.5.5, =25.08.4 and more Source cves: CVE-2026-74049 Source advisory: MEND:CVE-2026-74049...

CVE-2026-74049 Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

Execution After Redirect EAR vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0...

be.dabla:grizzly-spring-boot-jasper (>=2.0, <=2.7), co.cask.tephra:tephra-examples (>=0.6.2, <=0.7.1) +189 more potentially affected by CVE-2026-74049 via org.apache.tomcat:tomcat-jasper (>=9.0.0.m6, <=9.0.122)

org.apache.tomcat:tomcat-jasper MAVEN version =9.0.0.m6, =2.0, =0.6.2, =0.6.0, =5.9.6, =1.10, =1.10, =5.0.0-m54.0, =3.2.1036, =1.0.64, =9.0.8.0, =9.0.27.1 and more Source cves: CVE-2026-74049 Source advisory: MEND:CVE-2026-74049...

CVE-2026-74049

Apache Tomcat is vulnerable to an Execution After Redirect (EAR) vulnerability (CWE-698) due to the Jasper JSTL plug-in implementation omitting the page abort (SKIP_PAGE) . This affects versions 11.0.0-M1 through 11.0.26 , 10.1.0-M1 through 10.1.60 , and 9.0.0.M1 through 9.0.122 . End-of-life ve...

tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

A flaw was found in Apache Tomcat. The application fails to halt execution after sending an HTTP redirect response, resulting in an Execution After Redirect EAR condition. A remote attacker could exploit this flaw by ignoring the redirect instruction to access responses generated after the...

tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

A flaw was found in Apache Tomcat. The application fails to halt execution after sending an HTTP redirect response, resulting in an Execution After Redirect EAR condition. A remote attacker could exploit this flaw by ignoring the redirect instruction to access responses generated after the...

Fixed in Apache Tomcat 10.1.61

Important: HTTP/2 request/response mix-up after error during async processing CVE-2026-101356 Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This was fixed with commit 6c7da608. This issue was...

Rocky Linux 9.6 [CIQ] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils Multiple Vulnerabilities (ciqsa-2026_1632)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261632 advisory. This advisory aggregates security fixes for the jasper SRPM in CIQ LTS 9.6. It addresses 37 CVEs: CVE-2008-3522, CVE-2016-1577, CVE-2014-9029,...

CentOS Linux 7 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils (CENTOS7:CLSA-2025:1759864646)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1759864646 advisory. - A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpcdecdump of the file src/libjasper/jpc/jpcdec.c of the...

CentOS Linux 7 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils (CENTOS7:CLSA-2024:1723146304)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1723146304 advisory. - An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code. CVE-2023-51257 No...

AlmaLinux 9.2 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils (ALMALINUX9.2:CLSA-2025:1746187690)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746187690 advisory. - An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code. CVE-2023-5125...

Rocky Linux 8 [CIQ] Security Update: jasper-debuginfo / jasper-devel / jasper-libs / etc Multiple Vulnerabilities (crlsa-2021_4235)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214235 advisory. jasper: Heap-based buffer overflow in cpcreate in jpcenc.c CVE-2020-27828 jasper: Heap-based buffer over-read in jp2decode in jp2dec.c CVE-2021-3272 jasper...

AlmaLinux 9.2 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1760019942)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760019942 advisory. - A vulnerability was found in JasPer up to 4.2.5. Affected by this vulnerability is the function jasimagechclrspc of the file...

CentOS Linux 7 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils Multiple Vulnerabilities (CENTOS7:CLSA-2026:1778227041)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1778227041 advisory. - A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image forma...