{"action":"Upgrade org.apache.tomcat:tomcat to 9.0.116 (9.x), 10.1.53 (10.x) or 11.0.20 (11.x) or later.","affected":[{"fixed":"9.0.116","introduced":"8.5.30"},{"fixed":"10.1.53","introduced":"10.1.0-M1"},{"fixed":"11.0.20","introduced":"11.0.0-M1"}],"component":"org.apache.tomcat:tomcat","cve_ids":["CVE-2026-25854"],"ecosystem":"Maven","exploited":false,"fixed_versions":["9.0.116","10.1.53","11.0.20"],"ghsa_id":"GHSA-9m3c-qcxr-9x87","id":"tcs_01M5N8Q9JJSVSCTM024RX9MDPM","modified_at":"2026-09-11T08:25:31.206255258Z","published_at":"2026-04-09T21:31:29Z","references":["https://osv.dev/vulnerability/GHSA-9m3c-qcxr-9x87","https://nvd.nist.gov/vuln/detail/CVE-2026-25854","https://github.com/apache/tomcat","https://lists.apache.org/thread/ghct3b6o74bp2vm7q875s1zh0dqrz3h0","http://www.openwall.com/lists/oss-security/2026/04/09/21"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-9m3c-qcxr-9x87#Maven/org.apache.tomcat:tomcat","url":"https://osv.dev/vulnerability/GHSA-9m3c-qcxr-9x87"}],"summary":"Apache Tomcat has an Open Redirect vulnerability"}