{"action":"Upgrade org.apache.tomcat:tomcat-coyote to 9.0.113 (9.x), 10.1.50 (10.x) or 11.0.15 (11.x) or later.","affected":[{"fixed":"11.0.15","introduced":"11.0.0-M1"},{"fixed":"10.1.50","introduced":"10.1.0-M1"},{"fixed":"9.0.113","introduced":"9.0.0-M1"},{"introduced":"8.5.0","last_affected":"8.5.100"}],"component":"org.apache.tomcat:tomcat-coyote","cve_ids":["CVE-2025-66614"],"ecosystem":"Maven","epss":0.00274,"exploited":false,"fixed_versions":["11.0.15","10.1.50","9.0.113"],"ghsa_id":"GHSA-fpj8-gq4v-p354","id":"tcs_01M5N8WG4AFSC8T0CRMAKACYRG","modified_at":"2026-09-11T08:25:48.825991702Z","published_at":"2026-02-17T21:31:13Z","references":["https://osv.dev/vulnerability/GHSA-fpj8-gq4v-p354","https://nvd.nist.gov/vuln/detail/CVE-2025-66614","https://github.com/apache/tomcat/commit/152c14885d45f5e0a8b59bd9f93c289cfe20ce30","https://github.com/apache/tomcat/commit/258a591b61f8cf5c22109e21e5a2a38b63454fd2","https://github.com/apache/tomcat/commit/5053fa82a1b2b52756810601227984a8b71888a4","https://github.com/apache/tomcat/commit/9276b5e783c8cd5b3fe2bb716306b65004bdd940","https://github.com/apache/tomcat/commit/972f9a5e2a07674d92610c478aac1b205d60724e","https://github.com/apache/tomcat/commit/a4aa74232e826028cd2f7ba0445caf8a8b52c509","https://github.com/apache/tomcat","https://lists.apache.org/thread/vw6lxtlh2qbqwpb61wd3sv1flm2nttw7","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-fpj8-gq4v-p354#Maven/org.apache.tomcat:tomcat-coyote","url":"https://osv.dev/vulnerability/GHSA-fpj8-gq4v-p354"}],"summary":"Apache Tomcat - Client certificate verification bypass"}