CVE-2022-30929

CVE-2022-30929 CVE-2022-30929 POC Suggested description Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper. Vulnerability Type Insecure Permissions Vendor of Product github;gitee Affected Product Code Base...

Updated tomcat package fixes security vulnerabilities

OpenSSL-FFM FIPS failure does not prevent start-up. CVE-2026-74048 Jasper JSTL plug-in implementation omits page abort SKIPPAGE. CVE-2026-74049 TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector. CVE-2026-80353 HTTP/2 trailer...

MGASA-2026-0568 Updated tomcat package fixes security vulnerabilities

OpenSSL-FFM FIPS failure does not prevent start-up. CVE-2026-74048 Jasper JSTL plug-in implementation omits page abort SKIPPAGE. CVE-2026-74049 TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector. CVE-2026-80353 HTTP/2 trailer...

BIT-TOMCAT-2026-74049 Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

Execution After Redirect EAR vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0 through 11.0.26, from 10.1.0 through 10.1.60, from 9.0.0 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through...

CLSA-2026-1792566014 jasper: Fix of CVE-2022-2963

CVE-2022-2963: fix memory leak in cmdoptsparse — add cmdoptsdestroy before badusage in the default case and the missing-output-format check...

AlmaLinux 9.2 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils (ALMALINUX9.2:CLSA-2026:1792566014)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792566014 advisory. - A vulnerability found in jasper. This security vulnerability happens because of a memory leak bug in function cmdoptsparse that can cause a...

com.github.psi-probe:psi-probe-tomcat11 (>=5.0.0, <=5.5.0), com.kfyty:k-jte (1.0.0) +28 more potentially affected by CVE-2026-74049 via org.apache.tomcat:tomcat-jasper (>=11.0.0-m16, <=11.0.26)

org.apache.tomcat:tomcat-jasper MAVEN version =11.0.0-m16, =5.0.0, =1.2.0-rc3, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.4 - org.apache.tomee.bom:tomee-webprofile 11.0.0-m1 and more Source cves: CVE-2026-74049 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-21707584...

com.earldouglas:sbt-war_2.12_1.0 (>=5.0.0-m1, <=5.0.0-m4), com.earldouglas:war-runner (>=5.0.0-m4, <=10.1.28.0.0-m2) +60 more potentially affected by CVE-2026-74049 via org.apache.tomcat:tomcat-jasper (>=10.1.0-m6, <=10.1.60)

org.apache.tomcat:tomcat-jasper MAVEN version =10.1.0-m6, =5.0.0-m1, =5.0.0-m4, =3.0.0, =5.0.0, =5.0.0, =10.1.16.0, =10.1.16.0, =10.1.16.0, =10.1.16.0, =10.1.16.0, =3.1.1, =16.1.2, =3.1.1, =13.0.8, =13.1.2 and more Source cves: CVE-2026-74049 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-21707584...

be.dabla:grizzly-spring-boot-jasper (>=2.0, <=2.7), co.cask.tephra:tephra-examples (>=0.6.2, <=0.7.1) +189 more potentially affected by CVE-2026-74049 via org.apache.tomcat:tomcat-jasper (>=9.0.0.m6, <=9.0.122)

org.apache.tomcat:tomcat-jasper MAVEN version =9.0.0.m6, =2.0, =0.6.2, =0.6.0, =5.9.6, =1.10, =1.10, =5.0.0-m54.0, =3.2.1036, =1.0.64, =9.0.8.0, =9.0.27.1 and more Source cves: CVE-2026-74049 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-21707584...

Execution After Redirect (EAR)

Overview org.apache.tomcat:tomcat-jasper is a Tomcats JSP Parser Affected versions of this package are vulnerable to Execution After Redirect EAR in the c:redirect process. An attacker can cause unintended code execution after a redirect by exploiting the omission of the page abort mechanism...

be.dabla:grizzly-spring-boot-jasper (>=2.0, <=2.7), co.cask.tephra:tephra-examples (>=0.6.2, <=0.7.1) +189 more potentially affected by CVE-2026-74049 via org.apache.tomcat:tomcat-jasper (>=9.0.0.m6, <=9.0.122)

org.apache.tomcat:tomcat-jasper MAVEN version =9.0.0.m6, =2.0, =0.6.2, =0.6.0, =5.9.6, =1.10, =1.10, =5.0.0-m54.0, =3.2.1036, =1.0.64, =9.0.8.0, =9.0.27.1 and more Source cves: CVE-2026-74049 Source advisory: MEND:CVE-2026-74049...

cc.kkon:tomcat-embed-gmssl (>=9.0.63.x.1, <=9.0.63.x), cn.acooly:acooly-auth-google-authenticator (>=5.2.1, <=5.2.2) +343 more potentially affected by CVE-2026-74049 via org.apache.tomcat.embed:tomcat-embed-jasper (>=9.0.0.m27, <=9.0.122)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =9.0.0.m27, =9.0.63.x.1, =5.2.1, =5.2.1, =1.2.1.aghost-fix.20201109, =1.2.1.aghost-fix.20201109, =1.0.0.release, =0.0.1, =5.2.1, =5.2.1, =5.2.2 and more Source cves: CVE-2026-74049 Source advisory: MEND:CVE-2026-74049...

com.github.psi-probe:psi-probe-tomcat11 (>=5.0.0, <=5.5.0), com.kfyty:k-jte (1.0.0) +28 more potentially affected by CVE-2026-74049 via org.apache.tomcat:tomcat-jasper (>=11.0.0-m16, <=11.0.26)

org.apache.tomcat:tomcat-jasper MAVEN version =11.0.0-m16, =5.0.0, =1.2.0-rc3, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.4 - org.apache.tomee.bom:tomee-webprofile 11.0.0-m1 and more Source cves: CVE-2026-74049 Source advisory: MEND:CVE-2026-74049...

codes.vps:mockta-server (>=0.3, <=0.5), com.axelor:axelor-tomcat (>=8.0.0, <=8.2.5) +125 more potentially affected by CVE-2026-74049 via org.apache.tomcat.embed:tomcat-embed-jasper (>=10.1.0-m6, <=10.1.60)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =10.1.0-m6, =0.3, =8.0.0, =5.0.0-m1, =5.0.0-m4, =0.0.2, =1.3.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.0.0, =13.0, =13.1 and more Source cves: CVE-2026-74049 Source advisory: MEND:CVE-2026-74049...

CVE-2026-74049 Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

Execution After Redirect EAR vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0...

CVE-2026-74049

Apache Tomcat is vulnerable to an Execution After Redirect (EAR) vulnerability. The root cause is that the Jasper JSTL plug-in implementation omits the required page abort (SKIP_PAGE ) action. This issue affects versions 11.0.0-M1 through 11.0.26 , 10.1.0-M1 through 10.1.60 , and 9.0.0.M1 throug...

com.earldouglas:sbt-war_2.12_1.0 (>=5.0.0-m1, <=5.0.0-m4), com.earldouglas:war-runner (>=5.0.0-m4, <=10.1.28.0.0-m2) +60 more potentially affected by CVE-2026-74049 via org.apache.tomcat:tomcat-jasper (>=10.1.0-m6, <=10.1.60)

org.apache.tomcat:tomcat-jasper MAVEN version =10.1.0-m6, =5.0.0-m1, =5.0.0-m4, =3.0.0, =5.0.0, =5.0.0, =10.1.16.0, =10.1.16.0, =10.1.16.0, =10.1.16.0, =10.1.16.0, =3.1.1, =16.1.2, =3.1.1, =13.0.8, =13.1.2 and more Source cves: CVE-2026-74049 Source advisory: MEND:CVE-2026-74049...

com.earldouglas:war-runner (>=5.2.0_6.1, <=5.2.3_6.1), com.gitee.kamismile:stone-common-ex (1.9.0) +33 more potentially affected by CVE-2026-74049 via org.apache.tomcat.embed:tomcat-embed-jasper (>=11.0.0-m15, <=11.0.26)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =11.0.0-m15, =5.2.06.1, =13.2, =1.0.0, =1.9.1, =3.7.0, =2.5.5, =25.08.4 and more Source cves: CVE-2026-74049 Source advisory: MEND:CVE-2026-74049...

CVE-2026-74049 Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

Execution After Redirect EAR vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0...

tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

A flaw was found in Apache Tomcat. The application fails to halt execution after sending an HTTP redirect response, resulting in an Execution After Redirect EAR condition. A remote attacker could exploit this flaw by ignoring the redirect instruction to access responses generated after the...