tomcat-embed-core-9.0.31-CVE-2020-11996

Please see the PoC in testImplicitCloseLargeId unit test of TestHttp2Section51.java: https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996/blob/master/test/org/apache/coyote/http2/TestHttp2Section51.java...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat-Embed-Core

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat-Embed-Core. Apache Tomcat-Embed-Core is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...

com.bbossgroups.boot:bboot-starter-tomcat (6.3.9), com.earldouglas:war-runner (>=5.2.2_4.0, <=5.2.3_4.0) +112 more potentially affected by CVE-2026-101356 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.118, <=9.0.122)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.118, =5.2.24.0, =9.0.118.0, =9.0.118.0, =9.0.118.0, =9.0.118.0, =9.0.118.0, =1.41.0, =3.0.120, =3.0.120, =4.7.12, =4.7.14 and more Source cves: CVE-2026-101356 Source advisory: MEND:CVE-2026-101356...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +9053 more potentially affected by CVE-2026-101296 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.60)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.1.3, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-101296 Source advisory: MEND:CVE-2026-101296...

cc.chensoul.nacos:core-test (2.5.2), cc.chensoul.nacos:nacos-address (2.5.2) +374 more potentially affected by CVE-2026-93446 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.90, <=9.0.122)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.90, =2.4.0, =0.0.6, =0.0.7 and more Source cves: CVE-2026-93446 Source advisory: MEND:CVE-2026-93446...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +6690 more potentially affected by CVE-2026-93446 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.25, <=10.1.60)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.25, =0.0.4, =0.1.3, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-93446 Source advisory: MEND:CVE-2026-93446...

ai.astraform:remote-domain-template-java-spring (>=0.2.0, <=0.4.4), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +3200 more potentially affected by CVE-2026-93446 via org.apache.tomcat.embed:tomcat-embed-core (>=11.0.0-m21, <=11.0.26)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =11.0.0-m21, =0.2.0, =0.0.1, =0.0.1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-93446 Source advisory: MEND:CVE-2026-93446...

cc.chensoul.nacos:core-test (2.5.2), cc.chensoul.nacos:nacos-address (2.5.2) +346 more potentially affected by CVE-2026-88041 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.93, <=9.0.122)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.93, =2.4.0, =0.0.6, =0.0.7 and more Source cves: CVE-2026-88041 Source advisory: MEND:CVE-2026-88041...

cc.chensoul.nacos:core-test (2.5.2), cc.chensoul.nacos:nacos-address (2.5.2) +346 more potentially affected by CVE-2026-74048 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.93, <=9.0.122)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.93, =2.4.0, =0.0.6, =0.0.7 and more Source cves: CVE-2026-74048 Source advisory: MEND:CVE-2026-74048...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses tomcat-embed-core-10.1.57.jar, netty-handler-4.1.135.Final.jar, gitpython 3.1.53, httpclient5-5.6.3.jar, and glibc 2.34-168.el96.23 which are vulnerable to CVE-2025-15281, CVE-2026-0861, CVE-2026-0915, CVE-2026-4046, CVE-2026-4437, CVE-2026-4438, CVE-2026-5435,...

ROOT-APP-MAVEN-CVE-2026-41293 CVE-2026-41293 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-41293 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41284 CVE-2026-41284 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-41284 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-42498 CVE-2026-42498 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-42498 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-43514 CVE-2026-43514 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-43514 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-43512 CVE-2026-43512 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-43512 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-43515 CVE-2026-43515 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-43515 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-65905 CVE-2026-65905 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-65905 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-68525 CVE-2026-68525 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-68525 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-65182 CVE-2026-65182 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-65182 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-43513 CVE-2026-43513 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-43513 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...