CVE-2026-34483

Apache Tomcat: Incomplete escaping of JSON access logs

Summary

Original description

The description as published by the source.

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.20, from 10.1.0 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami tomcat

[{"type":"SEMVER","events":[{"introduced":"9.0.40"},{"fixed":"9.0.117"},{"introduced":"10.0.0"},{"fixed":"10.1.54"},{"introduced":"11.0.0"},{"fixed":"11.0.21"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2026-34483 tomcat10 Fixed in: 10.1.55-1~deb12u1
Ubuntu UBUNTU-CVE-2026-34483 tomcat6

References

advisory openwall.com
advisory lists.apache.org
web nvd.nist.gov