CVE-2026-34483
Apache Tomcat: Incomplete escaping of JSON access logs
Résumé
Apache Tomcat: Incomplete escaping of JSON access logs
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0 through 11.0.20, from 10.1.0 through 10.1.53, from 9.0.40 through 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
tomcat
[{"type":"SEMVER","events":[{"introduced":"9.0.40"},{"fixed":"9.0.117"},{"introduced":"10.0.0"},{"fixed":"10.1.54"},{"introduced":"11.0.0"},{"fixed":"11.0.21"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-34483 tomcat10 Corrigé dans: 10.1.55-1~deb12u1
- Ubuntu UBUNTU-CVE-2026-34483 tomcat6
Références
- advisory openwall.com
- advisory lists.apache.org
- web nvd.nist.gov