[kaito-yamaguchi-assured]

Updates

• Affected products
• CVSS v3
• References
• Severity
• Summary

Comments
Add the affected Maven packages. This advisory currently has no affected packages.

• The fix changes org.apache.coyote.http2.HpackDecoder, Http2Parser and Http2UpgradeHandler. In the binary jars on Maven Central, the changed classes are packaged in tomcat-coyote and tomcat-embed-core (checked in 11.0.26 / 10.1.60 / 9.0.122). They are also shipped in the binary distribution org.apache.tomcat:tomcat.
• Patched versions are the first upstream tags containing the fix commits (11.0.27 / 10.1.61 / 9.0.123).
• Lower bounds follow the Apache advisory (11.0.0-M23 / 10.1.27 / 9.0.92).

Evidence:

• Apache Tomcat security pages: https://tomcat.apache.org/security-11.html , https://tomcat.apache.org/security-10.html , https://tomcat.apache.org/security-9.html
• Fix commits:
  • 11.0.x: apache/tomcat@a276dea (first included in 11.0.27)
  • 10.1.x: apache/tomcat@395bcaf (first included in 10.1.61)
  • 9.0.x: apache/tomcat@8859852 (first included in 9.0.123)

CVSS (for reference only):

• Apache Tomcat security team rating: low
• The CVE record currently carries no CVSS v3.1 score (no CNA or CISA ADP metrics).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.