{"action":"Upgrade org.apache.tomcat:tomcat-coyote to 9.0.113 (9.x), 10.1.50 (10.x) or 11.0.15 (11.x) or later.","affected":[{"fixed":"11.0.15","introduced":"11.0.0-M1"},{"fixed":"10.1.50","introduced":"10.1.0-M1"},{"fixed":"9.0.113","introduced":"0"}],"component":"org.apache.tomcat:tomcat-coyote","cve_ids":["CVE-2026-24733"],"ecosystem":"Maven","epss":0.00552,"exploited":false,"fixed_versions":["11.0.15","10.1.50","9.0.113"],"ghsa_id":"GHSA-qq5r-98hh-rxc9","id":"tcs_01M5N9A28NNBNMY083PMWG7K2M","modified_at":"2026-09-11T08:25:53.089788485Z","published_at":"2026-02-17T21:31:13Z","references":["https://osv.dev/vulnerability/GHSA-qq5r-98hh-rxc9","https://nvd.nist.gov/vuln/detail/CVE-2026-24733","https://github.com/apache/tomcat/commit/2e2fa23f2635bbb819759576a2f2f5e64ecf7c5f","https://github.com/apache/tomcat/commit/6c73d74ff281260d74c836370ff6b82f1da8048b","https://github.com/apache/tomcat/commit/711b465cf22684a1acf0cb43501cdbbce9b6c5f4","https://github.com/apache/tomcat","https://lists.apache.org/thread/6xk3t65qpn1myp618krtfotbjn1qt90f","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-qq5r-98hh-rxc9","url":"https://osv.dev/vulnerability/GHSA-qq5r-98hh-rxc9"},{"source":"nvd","source_id":"CVE-2026-24733","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24733"}],"summary":"Apache Tomcat - Security constraint bypass with HTTP/0.9"}