{"action":"Upgrade org.apache.tomcat:tomcat to 9.0.117 (9.x), 10.1.54 (10.x) or 11.0.21 (11.x) or later.","affected":[{"fixed":"9.0.117","introduced":"9.0.13"},{"fixed":"10.1.54","introduced":"10.1.0-M1"},{"fixed":"11.0.21","introduced":"11.0.0-M1"}],"component":"org.apache.tomcat:tomcat","cve_ids":["CVE-2026-34487"],"ecosystem":"Maven","epss":0.00447,"exploited":false,"fixed_versions":["9.0.117","10.1.54","11.0.21"],"ghsa_id":"GHSA-x4m4-345f-5h5g","id":"tcs_01M5N9HQQQB5ZECCCNB458RRAA","modified_at":"2026-09-11T08:25:51.806825759Z","published_at":"2026-04-09T21:31:30Z","references":["https://osv.dev/vulnerability/GHSA-x4m4-345f-5h5g","https://nvd.nist.gov/vuln/detail/CVE-2026-34487","https://github.com/apache/tomcat/commit/301bc6efbf72feb14dacfdfa3f50372182736150","https://github.com/apache/tomcat/commit/5eff2a773b8b728083e5195b3183df1b9e12a03d","https://github.com/apache/tomcat/commit/f593292a082e5ef9336a8db2b4b522f7f3e36976","https://github.com/apache/tomcat","https://lists.apache.org/thread/4xpkwolpkrj8v5xzp5nyovtlqp3y850h","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-9.html","http://www.openwall.com/lists/oss-security/2026/04/09/28"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-x4m4-345f-5h5g#Maven/org.apache.tomcat:tomcat","url":"https://osv.dev/vulnerability/GHSA-x4m4-345f-5h5g"}],"summary":"Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File"}