CVE-2026-34483

HIGH 7.5

Apache Tomcat: Incomplete escaping of JSON access logs

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

5th

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.

CWE	CWE-116
Vendor	apache software foundation
Product	apache tomcat
Published	Apr 9, 2026
Last Updated	Apr 10, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache tomcat

Be the first to know when new high vulnerabilities affecting apache software foundation apache tomcat are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Tomcat

11.0.0-M1 ≤ 11.0.20 10.1.0-M1 ≤ 10.1.53 9.0.40 ≤ 9.0.116 8.5.84 ≤ 8.5.100

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b openwall.com: http://www.openwall.com/lists/oss-security/2026/04/09/26

Credits

Bartlomiej Dmitruk, striga.ai