CVE-2026-34483 Security Details

CVE ID

CVE-2026-34483

CWE

CWE-116

CVE Description

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.

Published

Apr 11, 2026

CVSS Score & Severity

8.7High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.067%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/apache/catalina/valves/AbstractAccessLogValve$RequestElement.addElement(Ljava/io/CharArrayWriter;Ljava/util/Date;Lorg/apache/catalina/connector/Request;Lorg/apache/catalina/connector/Response;J)V

JVMVulnerable params: 0, 2

org/apache/catalina/valves/AbstractAccessLogValve$RequestElement.addElement(Ljava/io/CharArrayWriter;Lorg/apache/catalina/connector/Request;Lorg/apache/catalina/connector/Response;J)V

JVMVulnerable params: 0, 2

org/apache/catalina/valves/AbstractAccessLogValve$RequestURIElement.addElement(Ljava/io/CharArrayWriter;Lorg/apache/catalina/connector/Request;Lorg/apache/catalina/connector/Response;J)V

JVMVulnerable params: 0, 2

org/apache/catalina/valves/AccessLogValve$RequestElement.addElement(Ljava/io/CharArrayWriter;Ljava/util/Date;Lorg/apache/catalina/connector/Request;Lorg/apache/catalina/connector/Response;J)V

JVMVulnerable params: 0, 2

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · Advisory · GHSA-rv64-5gf8-9qq8THIRD_PARTY