{"action":"Upgrade org.apache.tomcat.embed:tomcat-embed-core to 9.0.109 (9.x), 10.1.45 (10.x) or 11.0.11 (11.x) or later.","affected":[{"fixed":"11.0.11","introduced":"11.0.0-M1"},{"fixed":"10.1.45","introduced":"10.1.0-M1"},{"fixed":"9.0.109","introduced":"9.0.40"},{"introduced":"8.5.60","last_affected":"8.5.100"}],"component":"org.apache.tomcat.embed:tomcat-embed-core","cve_ids":["CVE-2025-55754"],"ecosystem":"Maven","exploited":false,"fixed_versions":["11.0.11","10.1.45","9.0.109"],"ghsa_id":"GHSA-vfww-5hm6-hx2j","id":"tcs_01M5N9E0YY7Y06MM2RZ4MP6G86","modified_at":"2026-09-10T03:50:30.791118688Z","published_at":"2025-10-27T18:31:13Z","references":["https://osv.dev/vulnerability/GHSA-vfww-5hm6-hx2j","https://nvd.nist.gov/vuln/detail/CVE-2025-55754","https://github.com/apache/tomcat/commit/138d7f5cfaae683078948303333c080e6faa75d2","https://github.com/apache/tomcat/commit/5a3db092982c0c58d4855304167ee757fe5e79bb","https://github.com/apache/tomcat/commit/a03cabf3a36a42d27d8d997ed31f034f50ba6cd5","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://github.com/apache/tomcat","https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd","https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.45","https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.11","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.109","http://www.openwall.com/lists/oss-security/2025/10/27/5"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-vfww-5hm6-hx2j#Maven/org.apache.tomcat.embed:tomcat-embed-core","url":"https://osv.dev/vulnerability/GHSA-vfww-5hm6-hx2j"}],"summary":"Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences"}