CVE-2026-34483

EUVD-2026-21053
Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 37.88%
Affected Products (NVD)
VendorProductVersion
apachetomcat
9.0.40 ≤
𝑥
< 9.0.117
apachetomcat
10.1.0 ≤
𝑥
< 10.1.54
apachetomcat
11.0.0 ≤
𝑥
< 11.0.21
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
tomcat10
bookworm
10.1.55-1~deb12u1
fixed
bookworm (security)
10.1.55-1~deb12u1
fixed
forky
10.1.60-1
fixed
sid
10.1.60-1
fixed
trixie
10.1.55-1~deb13u1
fixed
trixie (security)
10.1.55-1~deb13u1
fixed
tomcat11
forky
11.0.24-1
fixed
sid
11.0.24-1
fixed
trixie
11.0.22-1~deb13u1
fixed
trixie (security)
11.0.22-1~deb13u1
fixed
tomcat9
bookworm
9.0.70-2
fixed
forky
9.0.122-1
fixed
sid
9.0.122-1
fixed
trixie
9.0.95-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tomcat6
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
not-affected
xenial
not-affected
tomcat7
bionic
not-affected
jammy
dne
noble
dne
questing
dne
resolute
dne
trusty
not-affected
xenial
not-affected
tomcat9
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
questing
ignored
resolute
needed
tomcat10
jammy
dne
noble
needed
questing
ignored
resolute
needed
tomcat11
jammy
dne
noble
dne
questing
ignored
resolute
needed
tomcat8
bionic
not-affected
jammy
dne
noble
dne
questing
dne
resolute
dne
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
tomcat
suse enterprise sap 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP7
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP7
9.0.117-150200.105.1
fixed
tomcat-admin-webapps
suse enterprise sap 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP7
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP7
9.0.117-150200.105.1
fixed
tomcat-el-3_0-api
suse enterprise sap 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP7
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP7
9.0.117-150200.105.1
fixed
tomcat-jsp-2_3-api
suse enterprise sap 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP7
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP7
9.0.117-150200.105.1
fixed
tomcat-lib
suse enterprise sap 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP7
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP7
9.0.117-150200.105.1
fixed
tomcat-servlet-4_0-api
suse enterprise sap 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP7
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP7
9.0.117-150200.105.1
fixed
tomcat-webapps
suse enterprise sap 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise sap 15 SP7
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP4
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP5
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP6
9.0.117-150200.105.1
fixed
suse enterprise server 15 SP7
9.0.117-150200.105.1
fixed
tomcat10
suse enterprise sap 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP7
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP7
10.1.54-150200.5.64.1
fixed
tomcat10-admin-webapps
suse enterprise sap 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP7
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP7
10.1.54-150200.5.64.1
fixed
tomcat10-el-5_0-api
suse enterprise sap 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP7
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP7
10.1.54-150200.5.64.1
fixed
tomcat10-jsp-3_1-api
suse enterprise sap 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP7
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP7
10.1.54-150200.5.64.1
fixed
tomcat10-lib
suse enterprise sap 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP7
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP7
10.1.54-150200.5.64.1
fixed
tomcat10-servlet-6_0-api
suse enterprise sap 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP7
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP7
10.1.54-150200.5.64.1
fixed
tomcat10-webapps
suse enterprise sap 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise sap 15 SP7
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP5
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP6
10.1.54-150200.5.64.1
fixed
suse enterprise server 15 SP7
10.1.54-150200.5.64.1
fixed
tomcat11
suse enterprise sap 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise sap 15 SP7
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP7
11.0.21-150600.13.18.1
fixed
tomcat11-admin-webapps
suse enterprise sap 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise sap 15 SP7
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP7
11.0.21-150600.13.18.1
fixed
tomcat11-el-6_0-api
suse enterprise sap 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise sap 15 SP7
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP7
11.0.21-150600.13.18.1
fixed
tomcat11-jsp-4_0-api
suse enterprise sap 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise sap 15 SP7
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP7
11.0.21-150600.13.18.1
fixed
tomcat11-lib
suse enterprise sap 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise sap 15 SP7
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP7
11.0.21-150600.13.18.1
fixed
tomcat11-servlet-6_1-api
suse enterprise sap 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise sap 15 SP7
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP7
11.0.21-150600.13.18.1
fixed
tomcat11-webapps
suse enterprise sap 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise sap 15 SP7
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP6
11.0.21-150600.13.18.1
fixed
suse enterprise server 15 SP7
11.0.21-150600.13.18.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
tomcat
RHEL 8
1:9.0.120-1.el8_10
fixed
RHEL 8.8 E4S
1:9.0.120-1.el8_8
fixed
RHEL 8.8 TUS
1:9.0.120-1.el8_8
fixed
RHEL 9
1:9.0.117-1.el9_8
fixed
tomcat-admin-webapps
RHEL 8
1:9.0.120-1.el8_10
fixed
RHEL 8.8 E4S
1:9.0.120-1.el8_8
fixed
RHEL 8.8 TUS
1:9.0.120-1.el8_8
fixed
RHEL 9
1:9.0.117-1.el9_8
fixed
tomcat-docs-webapp
RHEL 8
1:9.0.120-1.el8_10
fixed
RHEL 8.8 E4S
1:9.0.120-1.el8_8
fixed
RHEL 8.8 TUS
1:9.0.120-1.el8_8
fixed
RHEL 9
1:9.0.117-1.el9_8
fixed
tomcat-el-3.0-api
RHEL 8
1:9.0.120-1.el8_10
fixed
RHEL 8.8 E4S
1:9.0.120-1.el8_8
fixed
RHEL 8.8 TUS
1:9.0.120-1.el8_8
fixed
RHEL 9
1:9.0.117-1.el9_8
fixed
tomcat-jsp-2.3-api
RHEL 8
1:9.0.120-1.el8_10
fixed
RHEL 8.8 E4S
1:9.0.120-1.el8_8
fixed
RHEL 8.8 TUS
1:9.0.120-1.el8_8
fixed
RHEL 9
1:9.0.117-1.el9_8
fixed
tomcat-lib
RHEL 8
1:9.0.120-1.el8_10
fixed
RHEL 8.8 E4S
1:9.0.120-1.el8_8
fixed
RHEL 8.8 TUS
1:9.0.120-1.el8_8
fixed
RHEL 9
1:9.0.117-1.el9_8
fixed
tomcat-servlet-4.0-api
RHEL 8
1:9.0.120-1.el8_10
fixed
RHEL 8.8 E4S
1:9.0.120-1.el8_8
fixed
RHEL 8.8 TUS
1:9.0.120-1.el8_8
fixed
RHEL 9
1:9.0.117-1.el9_8
fixed
tomcat-webapps
RHEL 8
1:9.0.120-1.el8_10
fixed
RHEL 8.8 E4S
1:9.0.120-1.el8_8
fixed
RHEL 8.8 TUS
1:9.0.120-1.el8_8
fixed
RHEL 9
1:9.0.117-1.el9_8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
tomcat10
Amazon Linux 2023
1:10.1.54-1.amzn2023.0.1
fixed
tomcat10-admin-webapps
Amazon Linux 2023
1:10.1.54-1.amzn2023.0.1
fixed
tomcat10-docs-webapp
Amazon Linux 2023
1:10.1.54-1.amzn2023.0.1
fixed
tomcat10-el-5.0-api
Amazon Linux 2023
1:10.1.54-1.amzn2023.0.1
fixed
tomcat10-jsp-3.1-api
Amazon Linux 2023
1:10.1.54-1.amzn2023.0.1
fixed
tomcat10-lib
Amazon Linux 2023
1:10.1.54-1.amzn2023.0.1
fixed
tomcat10-servlet-6.0-api
Amazon Linux 2023
1:10.1.54-1.amzn2023.0.1
fixed
tomcat10-webapps
Amazon Linux 2023
1:10.1.54-1.amzn2023.0.1
fixed
tomcat9
Amazon Linux 2023
1:9.0.117-1.amzn2023.0.1
fixed
tomcat9-admin-webapps
Amazon Linux 2023
1:9.0.117-1.amzn2023.0.1
fixed
tomcat9-docs-webapp
Amazon Linux 2023
1:9.0.117-1.amzn2023.0.1
fixed
tomcat9-el-3.0-api
Amazon Linux 2023
1:9.0.117-1.amzn2023.0.1
fixed
tomcat9-jsp-2.3-api
Amazon Linux 2023
1:9.0.117-1.amzn2023.0.1
fixed
tomcat9-lib
Amazon Linux 2023
1:9.0.117-1.amzn2023.0.1
fixed
tomcat9-servlet-4.0-api
Amazon Linux 2023
1:9.0.117-1.amzn2023.0.1
fixed
tomcat9-webapps
Amazon Linux 2023
1:9.0.117-1.amzn2023.0.1
fixed
Common Weakness Enumeration
References
https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b
http://www.openwall.com/lists/oss-security/2026/04/09/26