rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-24673 Open eClass Has File Upload Filter Bypass via ZIP Archive Extraction
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a file upload validation bypass vulnerability allows attackers to upload files with prohibited extensions by embedding them inside ZIP archives and extracting them using the application’s built-in decompression functionality. This issue has been patched in version 4.2.
Problem types: cwe_id: CWE-434
description: CWE-434: Unrestricted Upload of File with Dangerous Type
Affected products: vendor: gunet
product: openeclass
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2026-02-03T16:56:59.723Z
CVE-2026-24674 Open eClass is Vulnerable to Reflected Cross-Site Scripting (XSS) in Multiple Endpoints
The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Reflected Cross-Site Scripting (XSS) vulnerability allows remote attackers to execute arbitrary JavaScript in the context of authenticated users by crafting malicious URLs and tricking victims into visiting them. This issue has been patched in version 4.2.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: gunet
product: openeclass
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2026-02-03T16:57:07.664Z
CVE-2026-24675 FreeRDP has a Heap-use-after-free in urb_select_interface
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: FreeRDP
product: FreeRDP
Published: 2026-02-09T18:14:40.667Z
CVE-2026-24676 FreeRDP has a heap-use-after-free in audio_format_compatible
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the active format list while the capture thread continues using audin->format, leading to a use after free in audio_format_compatible. This vulnerability is fixed in 3.22.0.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: FreeRDP
product: FreeRDP
Published: 2026-02-09T18:15:33.646Z
CVE-2026-24677 FreeRDP has a heap-buffer-overflow in ecam_encoder_compress_h264
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, ecam_encoder_compress_h264 trusts server-controlled dimensions and does not validate the source buffer size, leading to an out-of-bounds read in sws_scale. This vulnerability is fixed in 3.22.0.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: FreeRDP
product: FreeRDP
Published: 2026-02-09T18:16:44.715Z
CVE-2026-24678 FreeRDP has a Heap-use-after-free in cam_v4l_stream_capture_thread
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, A capture thread sends sample responses using a freed channel callback after a device channel close, leading to a use after free in ecam_channel_write. This vulnerability is fixed in 3.22.0.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: FreeRDP
product: FreeRDP
Published: 2026-02-09T18:17:27.040Z
CVE-2026-24679 FreeRDP has a heap-buffer-overflow in urb_select_interface
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied interface numbers as array indices without bounds checks, causing an out-of-bounds read in libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: FreeRDP
product: FreeRDP
Published: 2026-02-09T18:19:00.409Z
CVE-2026-24680 FreeRDP has a heap-use-after-free in update_pointer_new(SDL)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure, then pointer_free calls sdl_Pointer_Free and frees it again, triggering ASan UAF. This vulnerability is fixed in 3.22.0.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: FreeRDP
product: FreeRDP
Published: 2026-02-09T18:19:45.222Z
CVE-2026-24681 FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completions can use a freed channel callback after URBDRC channel close, leading to a use after free in urb_write_completion. This vulnerability is fixed in 3.22.0.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: FreeRDP
product: FreeRDP
Published: 2026-02-09T18:20:39.732Z
CVE-2026-24682 FreeRDP has a Heap-buffer-overflow in audio_formats_free
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free. This vulnerability is fixed in 3.22.0.
Problem types: cwe_id: CWE-122
description: CWE-122: Heap-based Buffer Overflow
Affected products: vendor: FreeRDP
product: FreeRDP
Published: 2026-02-09T18:21:39.733Z
CVE-2026-24683 FreeRDP has a heap-use-after-free in ainput_send_input_event
FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a local variable and later uses it without synchronization; a concurrent channel close can free or reinitialize the callback, leading to a use after free. Prior to 3.22.0, This vulnerability is fixed in 3.22.0.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: FreeRDP
product: FreeRDP
Published: 2026-02-09T18:22:17.636Z
CVE-2026-24684 FreeRDP has a Heap-use-after-free in play_thread
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave. This vulnerability is fixed in 3.22.0.
Problem types: cwe_id: CWE-416
description: CWE-416: Use After Free
Affected products: vendor: FreeRDP
product: FreeRDP
Published: 2026-02-09T18:23:02.882Z
CVE-2026-24685 OpenProject has Argument Injection on Repository module that allows Arbitrary File Write
OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenProject’s repository diff download endpoint (`/projects/:project_id/repository/diff.diff`) when rendering a single revision via git show. By supplying a specially crafted rev value (for example, `rev=--output=/tmp/poc.txt)`, an attacker can inject git show command-line options. When OpenProject executes the SCM command, Git interprets the attacker-controlled rev as an option and writes the output to an attacker-chosen path. As a result, any user with the `:browse_repository` permission on the project can create or overwrite arbitrary files that the OpenProject process user is permitted to write. The written contents consist of git show output (commit metadata and patch), but overwriting application or configuration files still leads to data loss and denial of service, impacting integrity and availability. The issue has been fixed in OpenProject 17.0.2 and 16.6.6.
Problem types: cwe_id: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: opf
product: openproject
Published: 2026-01-28T16:47:22.850Z
CVE-2026-24686 go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names
go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g., `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: theupdateframework
product: go-tuf
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2026-01-27T00:45:43.422Z
CVE-2026-24687 Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac
Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authenticated backoffice-user to enumerate and traverse paths/files on the systems filesystem and read their contents, on Mac/Linux Umbraco installations using Forms. As Umbraco Cloud runs in a Windows environment, Cloud users aren't affected. This issue affects versions 16 and 17 of Umbraco Forms and is patched in 16.4.1 and 17.1.1. If upgrading is not immediately possible, users can mitigate this vulnerability by configuring a WAF or reverse proxy to block requests containing path traversal sequences (`../`, `..\`) in the `fileName` parameter of the export endpoint, restricting network access to the Umbraco backoffice to trusted IP ranges, and/or blocking the `/umbraco/forms/api/v1/export` endpoint entirely if the export feature is not required. However, upgrading to the patched version is strongly recommended.
Problem types: cwe_id: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: umbraco
product: Umbraco.Forms.Issues
Published: 2026-01-29T19:57:24.484Z
CVE-2026-24688 pypdf has possible Infinite Loop when processing outlines/bookmarks
pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has been fixed in pypdf 6.6.2. If projects cannot upgrade yet, consider applying the changes from PR #3610 manually.
Problem types: cwe_id: CWE-835
description: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
Affected products: vendor: py-pdf
product: pypdf
Published: 2026-01-27T19:44:06.173Z
CVE-2026-24689 Copeland XWEB and XWEB Pro OS Command Injection
An OS command injection 

vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an 
authenticated attacker to achieve remote code execution on the system by
 injecting malicious input into the devices field of the firmware update
 apply action.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: Copeland
product: Copeland XWEB 300D PRO
default_status: unaffected
vendor: Copeland
product: Copeland XWEB 500D PRO
default_status: unaffected
vendor: Copeland
product: Copeland XWEB 500B PRO
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA.
Published: 2026-02-27T00:47:26.332Z
CVE-2026-24692 Guest users can bypass read permissions via search API
Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly enforce read permissions in search API endpoints which allows guest users without read permissions to access posts and files in channels via search API requests. Mattermost Advisory ID: MMSA-2025-00554
Problem types: cwe_id: CWE-863
description: CWE-863: Incorrect Authorization
Affected products: vendor: Mattermost
product: Mattermost
default_status: unaffected
CVSS v3.1: attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseSeverity: MEDIUM
baseScore: 4.3
Credits: lang: en
value: 0x7oda7123
Published: 2026-03-16T14:56:45.323Z
CVE-2026-24694 
The installer for Roland Cloud Manager ver.3.1.19 and prior insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker to execute arbitrary code with the privileges of the application.
Problem types: cwe_id: CWE-427
description: Uncontrolled Search Path Element
Affected products: vendor: Roland Corporation
product: Roland Cloud Manager
Published: 2026-02-03T05:27:56.739Z
CVE-2026-24695 Copeland XWEB and XWEB Pro OS Command Injection
An OS command injection 




vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an 
authenticated attacker to achieve remote code execution on the system by
 injecting malicious input into OpenSSL argument fields within requests 
sent to the utility route, leading to remote code execution.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: Copeland
product: Copeland XWEB 300D PRO
default_status: unaffected
vendor: Copeland
product: Copeland XWEB 500D PRO
default_status: unaffected
vendor: Copeland
product: Copeland XWEB 500B PRO
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Amir Zaltzman and Noam Moshe of Claroty Team82 reported this vulnerability to CISA.
Published: 2026-02-27T00:51:01.649Z
CVE-2026-24696 Everon api.everon.io Improper Restriction of Excessive Authentication Attempts
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.
Problem types: cwe_id: CWE-307
description: CWE-307
Affected products: vendor: Everon
product: api.everon.io
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA.
Published: 2026-03-06T15:16:59.642Z
CVE-2026-24708 
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
Problem types: cwe_id: CWE-669
description: CWE-669 Incorrect Resource Transfer Between Spheres
Affected products: vendor: OpenStack
product: Nova
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Published: 2026-02-18T00:00:00.000Z
CVE-2026-24710 
Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-14T00:00:00.000Z
CVE-2026-24711 
Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-14T00:00:00.000Z
CVE-2026-24712 
Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-14T00:00:00.000Z
CVE-2026-24713 Apache IoTDB: JEXL Expression Injection Vulnerability
Improper Input Validation vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.

Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache IoTDB
default_status: unaffected
Credits: lang: en
value: Yongzhi Liu of Tencent YunDing Security Lab
Published: 2026-03-09T08:59:59.259Z
CVE-2026-24714 
Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the box.
Problem types: cwe_id: CWE-1242
description: Inclusion of undocumented features or chicken bits
Affected products: vendor: NETGEAR
product: NETGEAR products
Published: 2026-01-30T03:53:30.144Z
CVE-2026-24728 Interinfo DreamMaker - Missing Authentication for Critical Function
A missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker versions before 2025/10/22 allows remote attackers to access exposed administrative functionality without prior authentication.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Internet Information Co., Ltd
product: DreamMaker
default_status: unknown
Published: 2026-01-30T03:48:28.100Z
CVE-2026-24729 Interinfo DreamMaker - Unrestricted Upload of File with Dangerous Type
An unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker versions before 2025/10/22 allows remote attackers to execute arbitrary system commands via a malicious class file.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Internet Information Co., Ltd
product: DreamMaker
default_status: unknown
Published: 2026-01-30T03:50:31.763Z
CVE-2026-24731 EV2GO ev2go.io Missing Authentication for Critical Function
WebSocket endpoints lack proper authentication mechanisms, enabling 
attackers to perform unauthorized station impersonation and manipulate 
data sent to the backend. An unauthenticated attacker can connect to the
 OCPP WebSocket endpoint using a known or discovered charging station 
identifier, then issue or receive OCPP commands as a legitimate charger.
 Given that no authentication is required, this can lead to privilege 
escalation, unauthorized control of charging infrastructure, and 
corruption of charging network data reported to the backend.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: EV2GO
product: ev2go.io
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Khaled Sarieddine and Mohammad Ali Sayed reported this vulnerability to CISA.
Published: 2026-02-26T23:43:51.003Z
CVE-2026-24732 Improper permission checks in Extension:NSFileRepo
Files or Directories Accessible to External Parties, Incorrect Permission Assignment for Critical Resource vulnerability in Hallo Welt! GmbH BlueSpice (Extension:NSFileRepo modules) allows Accessing Functionality Not Properly Constrained by ACLs, Bypassing Electronic Locks and Access Controls.This issue affects BlueSpice: from 5.1 through 5.1.3, from 5.2 through 5.2.0.

HINT: Versions provided apply to BlueSpice MediaWiki releases. For Extension:NSFileRepo the affected versions are 3.0 < 3.0.5
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Hallo Welt! GmbH
product: BlueSpice
default_status: affected
Published: 2026-03-04T12:13:09.918Z
CVE-2026-24733 Apache Tomcat: Security constraint bypass with HTTP/0.9
Improper Input Validation vulnerability in Apache Tomcat.


Tomcat did not limit HTTP/0.9 requests to the GET method. If a security 
constraint was configured to allow HEAD requests to a URI but deny GET 
requests, the user could bypass that constraint on GET requests by 
sending a (specification invalid) HEAD request using HTTP/0.9.


This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0.M1 through 9.0.112.


Older, EOL versions are also affected.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fixes the issue.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
default_status: unaffected
Published: 2026-02-17T18:50:43.871Z
CVE-2026-24734 Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.


The following versions were EOL at the time the CVE was created but are 
known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat Native
default_status: unaffected
vendor: Apache Software Foundation
product: Apache Tomcat
default_status: unaffected
Credits: lang: en
value: Joshua Rogers (@MegaManSec)
Published: 2026-02-17T18:53:12.228Z