tomcat-embed-core-9.0.31-CVE-2020-11996

Please see the PoC in testImplicitCloseLargeId unit test of TestHttp2Section51.java: https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996/blob/master/test/org/apache/coyote/http2/TestHttp2Section51.java...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses tomcat-embed-core-10.1.57.jar, netty-handler-4.1.135.Final.jar, gitpython 3.1.53, httpclient5-5.6.3.jar, and glibc 2.34-168.el96.23 which are vulnerable to CVE-2025-15281, CVE-2026-0861, CVE-2026-0915, CVE-2026-4046, CVE-2026-4437, CVE-2026-4438, CVE-2026-5435,...

ROOT-APP-MAVEN-CVE-2026-41284 CVE-2026-41284 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-41284 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-43515 CVE-2026-43515 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-43515 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41293 CVE-2026-41293 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-41293 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-43512 CVE-2026-43512 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-43512 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-42498 CVE-2026-42498 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-42498 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-43513 CVE-2026-43513 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-43513 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-43514 CVE-2026-43514 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-43514 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-68525 CVE-2026-68525 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-68525 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-65182 CVE-2026-65182 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-65182 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-65905 CVE-2026-65905 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2026-65905 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in tomcat-embed-core

Summary IBM Watson Discovery Cartridge affected by vulnerability in tomcat-embed-core Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +9032 more potentially affected by CVE-2026-77762 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.59)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.1.3, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-77762 Source advisory: MEND:CVE-2026-77762...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.2, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +9637 more potentially affected by CVE-2026-77762 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.39, <=9.0.121)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.39, =4.4.0.2, =1.4.2, =1.6.6, =j8.2.3.0, =j8.2.3.0, =j8.2.3.0, =1.1.0-rc1, =1.0.0, =5.3.1, =1.13.0, =1.13.0, =2.4.1 and more Source cves: CVE-2026-77762 Source advisory: MEND:CVE-2026-77762...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +9032 more potentially affected by CVE-2026-77756 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.59)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.1.3, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-77756 Source advisory: MEND:CVE-2026-77756...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +9032 more potentially affected by CVE-2026-75973 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.59)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.1.3, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-75973 Source advisory: MEND:CVE-2026-75973...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.apiverse:apipulse (1.0.1) +13605 more potentially affected by CVE-2026-75973 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m4, <=9.0.121)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m4, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =2.1.0 and more Source cves: CVE-2026-75973 Source advisory: MEND:CVE-2026-75973...

ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-operator (>=0.0.4, <=0.6.0) +9032 more potentially affected by CVE-2026-73581 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.59)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =0.2.0, =0.0.4, =0.1.3, =0.5.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.7.5, =0.8.3, =0.7.0, =0.5.0, =0.5.0, =0.9.2 and more Source cves: CVE-2026-73581 Source advisory: MEND:CVE-2026-73581...

Security Bulletin: DEV-EXT - tomcat-embed-core-10.1.57.jar (Publicly disclosed vulnerability found by Scanner)

Summary Multiple vulnerabilities reported in tomcat-embed-core-10.1.57.jar detected by Mend scanner in db2-service-java/pom.xml. The affected version 10.1.57 is vulnerable to 9 CVEs covering improper access control, authentication bypass, TOCTOU race condition, improper authorization, improper...