deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-3pxv-7cmr-fjr4
Package: org.apache.logging.log4j:log4j-core (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: >= 3.0.0-alpha1, <= 3.0.0-beta3
Patched in: unpatched

Summary: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

Details:
Apache Log4j Core's [`XmlLayout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout), in versions up to and including 2.25.3, fails to sanitize characters forbidden by the [XML 1.0 specification](https://www.w3.org/TR/xml/#charsets), producing invalid XML output whenever a log message or MDC value contains such characters.

The impact depends on the StAX implementation in use:

  *  **JRE built-in StAX**: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
  *  **Alternative StAX implementations** (e.g., [Woodstox](https://github.com/FasterXML/woodstox), a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
GitHub Security Advisory: GHSA-5qcv-4rpc-jp93
Package: org.apache.kafka:kafka-clients (MAVEN)
Severity: HIGH (CVSS 8.7)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: >= 4.1.0, < 4.1.2
Patched in: 4.1.2

Summary: Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition

Details:
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics.

When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch—potentially destined for a different topic—reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer.


Data Confidentiality:
Messages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic.

Data Integrity:
Consumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data.

This issue affects Apache Kafka versions ≤ 3.9.1, ≤ 4.0.1, and  ≤ 4.1.1.

Kafka users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to address this vulnerability.
GitHub Security Advisory: GHSA-5qcv-4rpc-jp93
Package: org.apache.kafka:kafka-clients (MAVEN)
Severity: HIGH (CVSS 8.7)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: >= 4.0.0, < 4.0.2
Patched in: 4.0.2

Summary: Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition

Details:
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics.

When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch—potentially destined for a different topic—reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer.


Data Confidentiality:
Messages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic.

Data Integrity:
Consumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data.

This issue affects Apache Kafka versions ≤ 3.9.1, ≤ 4.0.1, and  ≤ 4.1.1.

Kafka users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to address this vulnerability.
GitHub Security Advisory: GHSA-5qcv-4rpc-jp93
Package: org.apache.kafka:kafka-clients (MAVEN)
Severity: HIGH (CVSS 8.7)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: >= 2.8.0, < 3.9.2
Patched in: 3.9.2

Summary: Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition

Details:
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics.

When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch—potentially destined for a different topic—reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer.


Data Confidentiality:
Messages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic.

Data Integrity:
Consumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data.

This issue affects Apache Kafka versions ≤ 3.9.1, ≤ 4.0.1, and  ≤ 4.1.1.

Kafka users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to address this vulnerability.
GitHub Security Advisory: GHSA-rxpj-7qvf-xv32
Package: org.apache.activemq:activemq-all (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 6.0.0, < 6.2.3
Patched in: 6.2.3

Summary: Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans

Details:
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). 

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. 
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .

Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.
GitHub Security Advisory: GHSA-rxpj-7qvf-xv32
Package: org.apache.activemq:activemq-all (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 5.19.5
Patched in: 5.19.5

Summary: Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans

Details:
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). 

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. 
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .

Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.
GitHub Security Advisory: GHSA-rxpj-7qvf-xv32
Package: org.apache.activemq:activemq-broker (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 6.0.0, < 6.2.3
Patched in: 6.2.3

Summary: Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans

Details:
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). 

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. 
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .

Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.
GitHub Security Advisory: GHSA-rxpj-7qvf-xv32
Package: org.apache.activemq:activemq-broker (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 5.19.5
Patched in: 5.19.5

Summary: Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans

Details:
Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ.

Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including
BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). 

An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. 
Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().
This issue affects Apache ActiveMQ Broker: before 5.19.4, from 6.0.0 before 6.2.3; Apache ActiveMQ: .

Users are recommended to upgrade to version 5.19.5 or 6.2.3, which fixes the issue.
GitHub Security Advisory: GHSA-4pgc-gfrr-wcmg
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 26.6.0
Patched in: unpatched

Summary: Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false

Details:
A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint. This issue enables unauthorized modification of protected resources, impacting data integrity.
GitHub Security Advisory: GHSA-22rm-wp4x-v5cx
Package: org.keycloak:keycloak-services (MAVEN)
Severity: LOW (CVSS 3.1)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 26.6.0
Patched in: unpatched

Summary: Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation

Details:
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
GitHub Security Advisory: GHSA-rhgq-f8x5-j2jc
Package: org.keycloak:keycloak-services (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: <= 26.4.7
Patched in: unpatched

Summary: Keycloak's  identity-first login flow  exposes user information

Details:
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.
GitHub Security Advisory: GHSA-rhgq-f8x5-j2jc
Package: org.keycloak:keycloak-services (MAVEN)
Severity: LOW (CVSS 3.7)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information
Vulnerable versions: >= 26.5.0, <= 26.5.6
Patched in: 26.6.0

Summary: Keycloak's  identity-first login flow  exposes user information

Details:
A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability allows an attacker to determine the existence of users, leading to information disclosure through user enumeration.
GitHub Security Advisory: GHSA-gxr4-xjj5-5px2
Package: org.webjars.npm:jquery (MAVEN)
Severity: MODERATE (CVSS 6.9)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.12.0, < 3.5.0
Patched in: 3.5.0

Summary: Potential XSS vulnerability in jQuery

Details:
### Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches
This problem is patched in jQuery 3.5.0.

### Workarounds
To workaround the issue without upgrading, adding the following to your code:

```js
jQuery.htmlPrefilter = function( html ) {
	return html;
};
```

You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.

### References
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.
GitHub Security Advisory: GHSA-69r9-qgr7-g2wj
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-311: Missing Encryption of Sensitive Data
Vulnerable versions: = 9.0.116
Patched in: 9.0.117

Summary: Apache Tomcat Missing Encryption of Sensitive Data vulnerability

Details:
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-69r9-qgr7-g2wj
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-311: Missing Encryption of Sensitive Data
Vulnerable versions: = 10.1.53
Patched in: 10.1.54

Summary: Apache Tomcat Missing Encryption of Sensitive Data vulnerability

Details:
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-69r9-qgr7-g2wj
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-311: Missing Encryption of Sensitive Data
Vulnerable versions: = 11.0.20
Patched in: 11.0.21

Summary: Apache Tomcat Missing Encryption of Sensitive Data vulnerability

Details:
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
GitHub Security Advisory: GHSA-8mc5-53m5-3qj2
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 11.0.15, < 11.0.20
Patched in: 11.0.20

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-8mc5-53m5-3qj2
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 10.1.50, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-8mc5-53m5-3qj2
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 9.0.113, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-8mc5-53m5-3qj2
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 10.1.50, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-8mc5-53m5-3qj2
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 9.0.113, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-95jq-rwvf-vjx4
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 11.0.0-M1, < 11.0.20
Patched in: 11.0.20

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-95jq-rwvf-vjx4
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 10.1.0-M7, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-95jq-rwvf-vjx4
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 9.0.83, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details:
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.