Vulnerability GHSA-5m62-pw8w-7w9f
Critical
CRITICAL RISK
CVSS Score: 9.1
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
5 months ago
May 12, 2026 at 06:30 PM UTC
Apache Tomcat - Security constraints not correctly applied
7.0.0 - 9.0.117 and 10.1.0-M1 - 10.1.54 and 11.0.0-M1 - 11.0.21
7.0.0 - 9.0.117 and 10.1.0-M1 - 10.1.54 and 11.0.0-M1 - 11.0.21
Summary
Apache Tomcat - Security constraints not correctly applied
Details
Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.0.M1 to 9.0.117 Older, unsupported versions may also be affected
Description: When multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied.
Mitigation: Users of the affected versions should apply one of the following mitigations:
- Upgrade to Apache Tomcat 11.0.22 or later
- Upgrade to Apache Tomcat 10.1.55 or later
- Upgrade to Apache Tomcat 9.0.118 or later
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
2 months ago
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
7.0.30 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
7.0.30 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
Critical
2 months ago
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
7.0.30 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
7.0.30 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
Critical
2 months ago
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
7.0.30 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
7.0.30 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-9xv2-5v5q-p794
Critical
2 months ago
Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation
9.0.115 - 9.0.120 and 10.1.53 - 10.1.57 and 11.0.20 - 11.0.24 GHSA-f525-44xv-f2qj
9.0.115 - 9.0.120 and 10.1.53 - 10.1.57 and 11.0.20 - 11.0.24 GHSA-f525-44xv-f2qj
Critical
2 months ago
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
7.0.0 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-gcx9-497g-6cp6
7.0.0 - 7.0.109 and 8.5.0 - 9.0.120 and 10.1.0-M1 - 10.1.57 and 11.0.0-M1 - 11.0.24 GHSA-gcx9-497g-6cp6
Impacted packages
Timeline
Published
5 months ago
May 12, 2026 at 06:30 PM UTC
Fixed (9.0.118)
Unknown
Unknown
Fixed (10.1.55)
Unknown
Unknown
Fixed (11.0.22)
Unknown
Unknown
Fixed (9.0.118)
Unknown
Unknown
Fixed (10.1.55)
Unknown
Unknown
Fixed (11.0.22)
Unknown
Unknown
Fixed (9.0.118)
Unknown
Unknown
Fixed (10.1.55)
Unknown
Unknown
Fixed (11.0.22)
Unknown
Unknown
Last Modified
1 month ago
September 11, 2026 at 08:25 AM UTC