{"action":"Upgrade org.apache.tomcat:tomcat to 8.5.93 (8.x), 9.0.80 (9.x), 10.1.13 (10.x) or 11.0.0-M11 (11.x) or later.","affected":[{"fixed":"11.0.0-M11","introduced":"11.0.0-M1"},{"fixed":"10.1.13","introduced":"10.1.0-M1"},{"fixed":"9.0.80","introduced":"9.0.0-M1"},{"fixed":"8.5.93","introduced":"8.5.0"}],"component":"org.apache.tomcat:tomcat","cve_ids":["CVE-2023-41080"],"ecosystem":"Maven","epss":0.06459,"exploited":false,"fixed_versions":["11.0.0-M11","10.1.13","9.0.80","8.5.93"],"ghsa_id":"GHSA-q3mw-pvr8-9ggc","id":"tcs_01M5N98H1ZTFS5QZADP45BJ8FQ","modified_at":"2026-09-10T03:50:03.488136490Z","published_at":"2023-08-25T21:30:48Z","references":["https://osv.dev/vulnerability/GHSA-q3mw-pvr8-9ggc","https://nvd.nist.gov/vuln/detail/CVE-2023-41080","https://github.com/apache/tomcat/commit/4998ad745b67edeadefe541c94ed029b53933d3b","https://github.com/apache/tomcat/commit/77c0ce2d169efa248b64b992e547aad549ec906b","https://github.com/apache/tomcat/commit/bb4624a9f3e69d495182ebfa68d7983076407a27","https://github.com/apache/tomcat/commit/e3703c9abb8fe0d5602f6ba8a8f11d4b6940815a","https://github.com/apache/tomcat","https://lists.apache.org/thread/71wvwprtx2j2m54fovq9zr7gbm2wow2f","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://security.netapp.com/advisory/ntap-20230921-0006","https://www.debian.org/security/2023/dsa-5521","https://www.debian.org/security/2023/dsa-5522"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-q3mw-pvr8-9ggc","url":"https://osv.dev/vulnerability/GHSA-q3mw-pvr8-9ggc"}],"summary":"Apache Tomcat Open Redirect vulnerability"}