GHSA-8mc5-53m5-3qj2

Quick fix

GHSA-8mc5-53m5-3qj2 — org.apache.tomcat:tomcat-coyote: upgrade to the fixed version with the command below.

# pom.xml: bump <version>9.0.116</version> for org.apache.tomcat:tomcat-coyote

Details

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

Introduced in: 9.0.113Fixed in: 9.0.116

Fix# pom.xml: bump <version>9.0.116</version> for org.apache.tomcat:tomcat-coyote

Introduced in: 10.1.50Fixed in: 10.1.53

Fix# pom.xml: bump <version>10.1.53</version> for org.apache.tomcat:tomcat-coyote

Introduced in: 11.0.15Fixed in: 11.0.20

Fix# pom.xml: bump <version>11.0.20</version> for org.apache.tomcat:tomcat-coyote

Introduced in: 9.0.113Fixed in: 9.0.116

Fix# pom.xml: bump <version>9.0.116</version> for org.apache.tomcat:tomcat

Introduced in: 10.1.50Fixed in: 10.1.53

Fix# pom.xml: bump <version>10.1.53</version> for org.apache.tomcat:tomcat

Introduced in: 11.0.15Fixed in: 11.0.20

Fix# pom.xml: bump <version>11.0.20</version> for org.apache.tomcat:tomcat

Introduced in: 9.0.113Fixed in: 9.0.116

Fix# pom.xml: bump <version>9.0.116</version> for org.apache.tomcat.embed:tomcat-embed-core

Introduced in: 10.1.50Fixed in: 10.1.53

Fix# pom.xml: bump <version>10.1.53</version> for org.apache.tomcat.embed:tomcat-embed-core

Introduced in: 11.0.15Fixed in: 11.0.20

Fix# pom.xml: bump <version>11.0.20</version> for org.apache.tomcat.embed:tomcat-embed-core