deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-wg6q-6289-32hp
Package: org.bouncycastle:bcpkix-debug-jdk14 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 1.49, < 1.84
Patched in: 1.84

Summary: Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

Details:
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).


PKIX draft CompositeVerifier accepts empty signature sequence as valid.


This issue affects BC-JAVA: from 1.49 before 1.84.
GitHub Security Advisory: GHSA-wg6q-6289-32hp
Package: org.bouncycastle:bcpkix-debug-jdk15to18 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 1.49, < 1.84
Patched in: 1.84

Summary: Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

Details:
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).


PKIX draft CompositeVerifier accepts empty signature sequence as valid.


This issue affects BC-JAVA: from 1.49 before 1.84.
GitHub Security Advisory: GHSA-wg6q-6289-32hp
Package: org.bouncycastle:bcpkix-debug-jdk18on (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 1.49, < 1.84
Patched in: 1.84

Summary: Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

Details:
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).


PKIX draft CompositeVerifier accepts empty signature sequence as valid.


This issue affects BC-JAVA: from 1.49 before 1.84.
GitHub Security Advisory: GHSA-wg6q-6289-32hp
Package: org.bouncycastle:bcpkix-jdk14 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 1.49, < 1.84
Patched in: 1.84

Summary: Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

Details:
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).


PKIX draft CompositeVerifier accepts empty signature sequence as valid.


This issue affects BC-JAVA: from 1.49 before 1.84.
GitHub Security Advisory: GHSA-wg6q-6289-32hp
Package: org.bouncycastle:bcpkix-jdk15on (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 1.49, < 1.84
Patched in: 1.84

Summary: Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

Details:
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).


PKIX draft CompositeVerifier accepts empty signature sequence as valid.


This issue affects BC-JAVA: from 1.49 before 1.84.
GitHub Security Advisory: GHSA-wg6q-6289-32hp
Package: org.bouncycastle:bcpkix-jdk15to18 (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 1.49, < 1.84
Patched in: 1.84

Summary: Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

Details:
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).


PKIX draft CompositeVerifier accepts empty signature sequence as valid.


This issue affects BC-JAVA: from 1.49 before 1.84.
GitHub Security Advisory: GHSA-wg6q-6289-32hp
Package: org.bouncycastle:bcpkix-jdk18on (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: >= 1.49, < 1.84
Patched in: 1.84

Summary: Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules

Details:
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix on all (pkix modules).


PKIX draft CompositeVerifier accepts empty signature sequence as valid.


This issue affects BC-JAVA: from 1.49 before 1.84.
GitHub Security Advisory: GHSA-vp6r-9m58-5xv8
Package: org.omnifaces:omnifaces (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: >= 5.0-M1, < 5.2.2
Patched in: 5.2.3

Summary: OmniFaces: EL injection via crafted resource name in wildcard CDN mapping

Details:
### Impact

Server-side EL injection leading to Remote Code Execution (RCE). Affects applications that use `CDNResourceHandler` with a wildcard CDN mapping (e.g. `libraryName:*=https://cdn.example.com/*`). An attacker can craft a resource request
URL containing an EL expression in the resource name, which is evaluated server-side.

The severity depends on the EL implementation and the objects available in the EL context. In the worst case this leads to Remote Code Execution (RCE). At minimum it allows information disclosure and denial of service.

Applications using `CDNResourceHandler` without wildcard mappings (i.e. only explicit resource-to-URL mappings) are **not** affected.

### Patches

Fixed in versions 5.2.3, 4.7.5, 3.14.16, 2.7.32, and 1.14.2. Users should upgrade to the appropriate version for their branch.

### Workarounds

Replace wildcard CDN mappings with explicit resource-to-URL mappings. For example, replace:
```
libraryName:*=https://cdn.example.com/*
```
with individual entries:
```
libraryName:resource1.js=https://cdn.example.com/resource1.js,
libraryName:resource2.js=https://cdn.example.com/resource2.js
```
GitHub Security Advisory: GHSA-vp6r-9m58-5xv8
Package: org.omnifaces:omnifaces (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: >= 4.0-M1, < 4.7.5
Patched in: 4.7.5

Summary: OmniFaces: EL injection via crafted resource name in wildcard CDN mapping

Details:
### Impact

Server-side EL injection leading to Remote Code Execution (RCE). Affects applications that use `CDNResourceHandler` with a wildcard CDN mapping (e.g. `libraryName:*=https://cdn.example.com/*`). An attacker can craft a resource request
URL containing an EL expression in the resource name, which is evaluated server-side.

The severity depends on the EL implementation and the objects available in the EL context. In the worst case this leads to Remote Code Execution (RCE). At minimum it allows information disclosure and denial of service.

Applications using `CDNResourceHandler` without wildcard mappings (i.e. only explicit resource-to-URL mappings) are **not** affected.

### Patches

Fixed in versions 5.2.3, 4.7.5, 3.14.16, 2.7.32, and 1.14.2. Users should upgrade to the appropriate version for their branch.

### Workarounds

Replace wildcard CDN mappings with explicit resource-to-URL mappings. For example, replace:
```
libraryName:*=https://cdn.example.com/*
```
with individual entries:
```
libraryName:resource1.js=https://cdn.example.com/resource1.js,
libraryName:resource2.js=https://cdn.example.com/resource2.js
```
GitHub Security Advisory: GHSA-vp6r-9m58-5xv8
Package: org.omnifaces:omnifaces (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: >= 3.0-RC1, < 3.14.16
Patched in: 3.14.16

Summary: OmniFaces: EL injection via crafted resource name in wildcard CDN mapping

Details:
### Impact

Server-side EL injection leading to Remote Code Execution (RCE). Affects applications that use `CDNResourceHandler` with a wildcard CDN mapping (e.g. `libraryName:*=https://cdn.example.com/*`). An attacker can craft a resource request
URL containing an EL expression in the resource name, which is evaluated server-side.

The severity depends on the EL implementation and the objects available in the EL context. In the worst case this leads to Remote Code Execution (RCE). At minimum it allows information disclosure and denial of service.

Applications using `CDNResourceHandler` without wildcard mappings (i.e. only explicit resource-to-URL mappings) are **not** affected.

### Patches

Fixed in versions 5.2.3, 4.7.5, 3.14.16, 2.7.32, and 1.14.2. Users should upgrade to the appropriate version for their branch.

### Workarounds

Replace wildcard CDN mappings with explicit resource-to-URL mappings. For example, replace:
```
libraryName:*=https://cdn.example.com/*
```
with individual entries:
```
libraryName:resource1.js=https://cdn.example.com/resource1.js,
libraryName:resource2.js=https://cdn.example.com/resource2.js
```
GitHub Security Advisory: GHSA-vp6r-9m58-5xv8
Package: org.omnifaces:omnifaces (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: >= 2.0-RC1, < 2.7.32
Patched in: 2.7.32

Summary: OmniFaces: EL injection via crafted resource name in wildcard CDN mapping

Details:
### Impact

Server-side EL injection leading to Remote Code Execution (RCE). Affects applications that use `CDNResourceHandler` with a wildcard CDN mapping (e.g. `libraryName:*=https://cdn.example.com/*`). An attacker can craft a resource request
URL containing an EL expression in the resource name, which is evaluated server-side.

The severity depends on the EL implementation and the objects available in the EL context. In the worst case this leads to Remote Code Execution (RCE). At minimum it allows information disclosure and denial of service.

Applications using `CDNResourceHandler` without wildcard mappings (i.e. only explicit resource-to-URL mappings) are **not** affected.

### Patches

Fixed in versions 5.2.3, 4.7.5, 3.14.16, 2.7.32, and 1.14.2. Users should upgrade to the appropriate version for their branch.

### Workarounds

Replace wildcard CDN mappings with explicit resource-to-URL mappings. For example, replace:
```
libraryName:*=https://cdn.example.com/*
```
with individual entries:
```
libraryName:resource1.js=https://cdn.example.com/resource1.js,
libraryName:resource2.js=https://cdn.example.com/resource2.js
```
GitHub Security Advisory: GHSA-vp6r-9m58-5xv8
Package: org.omnifaces:omnifaces (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Vulnerable versions: < 1.14.2
Patched in: 1.14.2

Summary: OmniFaces: EL injection via crafted resource name in wildcard CDN mapping

Details:
### Impact

Server-side EL injection leading to Remote Code Execution (RCE). Affects applications that use `CDNResourceHandler` with a wildcard CDN mapping (e.g. `libraryName:*=https://cdn.example.com/*`). An attacker can craft a resource request
URL containing an EL expression in the resource name, which is evaluated server-side.

The severity depends on the EL implementation and the objects available in the EL context. In the worst case this leads to Remote Code Execution (RCE). At minimum it allows information disclosure and denial of service.

Applications using `CDNResourceHandler` without wildcard mappings (i.e. only explicit resource-to-URL mappings) are **not** affected.

### Patches

Fixed in versions 5.2.3, 4.7.5, 3.14.16, 2.7.32, and 1.14.2. Users should upgrade to the appropriate version for their branch.

### Workarounds

Replace wildcard CDN mappings with explicit resource-to-URL mappings. For example, replace:
```
libraryName:*=https://cdn.example.com/*
```
with individual entries:
```
libraryName:resource1.js=https://cdn.example.com/resource1.js,
libraryName:resource2.js=https://cdn.example.com/resource2.js
```
GitHub Security Advisory: GHSA-hf5p-q87m-crj7
Package: com.github.junrar:junrar (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 7.5.10
Patched in: 7.5.10

Summary: Junrar: Path Traversal (Zip-Slip) via Sibling Directory Name Prefix

Details:
### Summary

A path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when a crafted RAR archive is extracted.

### Example

Given an extraction directory set to `/tmp/extract`, a crafted archive with an entry with the filename as `../extract_evil/file.txt` would be actually extracted to `/tmp/extract_evil/file.txt`.

### Details

The `createDirectory()` and `createFile()` methods in`LocalFolderExtractor` validate extraction paths using a string prefix.
GitHub Security Advisory: GHSA-hfrg-mcvw-8mch
Package: com.ritense.valtimo:inbox (MAVEN)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 13.0.0.RELEASE, < 13.22.0.RELEASE
Patched in: 13.22.0.RELEASE

Summary: Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService

Details:
### Summary

The `InboxHandlingService` logs the full content of every incoming inbox message at INFO level (`logger.info("Received message: {}", message)`). Inbox messages are wrappers around outbox message data, which can contain highly sensitive information such as personal data (PII), citizen identifiers (BSN), and case details.

### Impact

This data is exposed to:
- Anyone with access to application logs (stdout/log files)
- Any Valtimo user with the admin role, through the logging module in the Admin UI

### Affected Code

`com.ritense.inbox.InboxHandlingService#handle` in the `inbox` module.

### Resolution

Fixed in [13.22.0](https://github.com/valtimo-platform/valtimo/releases/tag/13.22.0) via commit [`f16a1940ba`](https://github.com/valtimo-platform/valtimo/commit/f16a1940ba7b34627c0b966f98ca78655ace9335) (PR [#497](https://github.com/valtimo-platform/valtimo/pull/497), tracking issue [gzac-issues#653](https://github.com/generiekzaakafhandelcomponent/gzac-issues/issues/653)). The log statement was downgraded from INFO to DEBUG and the message payload was removed from the log output.

### Mitigation

For versions before 13.22.0, consider:
- Restricting access to application logs
- Adjusting the log level for `com.ritense.inbox` to WARN or higher in your application configuration
GitHub Security Advisory: GHSA-x4p7-7chp-64hq
Package: org.keycloak:keycloak-server-spi-private (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: <= 26.5.5
Patched in: 26.6.0

Summary: Keycloak: Unauthorized authentication via disabled SAML Identity Provider

Details:
A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.
GitHub Security Advisory: GHSA-x4p7-7chp-64hq
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: <= 26.5.5
Patched in: 26.6.0

Summary: Keycloak: Unauthorized authentication via disabled SAML Identity Provider

Details:
A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication.
GitHub Security Advisory: GHSA-4qqf-hmv6-r6wh
Package: wss4j:wss4j (MAVEN)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Vulnerable versions: < 1.6.5
Patched in: 1.6.5

Summary: Use of a Broken or Risky Cryptographic Algorithm  in Apache WSS4J

Details:
The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
GitHub Security Advisory: GHSA-9342-92gg-6v29
Package: com.sun.mail:jakarta.mail (MAVEN)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-147: Improper Neutralization of Input Terminators
Vulnerable versions: >= 2.0.0, < 2.0.2
Patched in: 2.0.2

Summary: Jakarta Mail vulnerable to SMTP Injection

Details:
In Jakarta Mail 2.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
GitHub Security Advisory: GHSA-9342-92gg-6v29
Package: com.sun.mail:jakarta.mail (MAVEN)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-147: Improper Neutralization of Input Terminators
Vulnerable versions: < 1.6.8
Patched in: 1.6.8

Summary: Jakarta Mail vulnerable to SMTP Injection

Details:
In Jakarta Mail 2.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
GitHub Security Advisory: GHSA-wwcp-26wc-3fxm
Package: net.sf.json-lib:json-lib (MAVEN)
Severity: MODERATE (CVSS 5.3)
Vulnerable versions: <= 2.4
Patched in: unpatched

Summary: JSON-lib mishandles an unbalanced comment string

Details:
util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.
GitHub Security Advisory: GHSA-jwwr-fjgh-cv2x
Package: castor:castor (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: <= 1.0
Patched in: unpatched

Summary: Improper Restriction of XML External Entity Reference in Castor

Details:
The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
GitHub Security Advisory: GHSA-vrh8-27q8-fr8f
Package: org.apache.solr:solr-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 1.3.0, <= 7.6.0
Patched in: 7.7.0

Summary: Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core

Details:
Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.
GitHub Security Advisory: GHSA-m32f-8vh9-2hh3
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 6.9)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 26.5.5
Patched in: unpatched

Summary: Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page

Details:
A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. This flaw occurs because the `organization.alias` is placed into an inline JavaScript `onclick` handler, allowing a crafted JavaScript payload to execute in a user's browser when they view the login page. Successful exploitation enables arbitrary JavaScript execution, potentially leading to session theft, unauthorized account actions, or further attacks against users of the affected realm.
GitHub Security Advisory: GHSA-8mc5-53m5-3qj2
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 11.0.15, <= 11.0.18
Patched in: 11.0.20

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-8mc5-53m5-3qj2
Package: org.apache.tomcat:tomcat-coyote (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 11.0.15, <= 11.0.18
Patched in: 11.0.20

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-8mc5-53m5-3qj2
Package: org.apache.tomcat:tomcat-coyote (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 10.1.50, < 10.1.53
Patched in: 10.1.53

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-8mc5-53m5-3qj2
Package: org.apache.tomcat:tomcat-coyote (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 9.0.113, < 9.0.116
Patched in: 9.0.116

Summary: Apache Tomcat has an Improper Input Validation vulnerability

Details:
Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.

This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-563x-q5rq-57qp
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 11.0.0-M1, <= 11.0.18
Patched in: 11.0.20

Summary: Apache Tomcat has an HTTP Request/Response Smuggling vulnerability

Details:
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.
GitHub Security Advisory: GHSA-563x-q5rq-57qp
Package: org.apache.tomcat:tomcat-tribes (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Vulnerable versions: >= 11.0.0-M1, <= 11.0.18
Patched in: 11.0.20

Summary: Apache Tomcat has an HTTP Request/Response Smuggling vulnerability

Details:
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.