[GHSA-fccv-jmmp-qg76] Apache Tomcat Improper Input Validation vulnerability

[aruneko]

Updates

• Affected products

Comments
improve affected packages

[Copilot]

Pull request overview

Updates the OSV advisory for GHSA-fccv-jmmp-qg76 (Apache Tomcat improper input validation / request smuggling risk) by expanding the set of affected Maven artifacts and their vulnerable version ranges.

Changes:

• Added org.apache.tomcat:tomcat-coyote as an affected Maven package across the relevant vulnerable/fixed version lines.
• Added org.apache.tomcat:tomcat as an affected Maven package across the relevant vulnerable/fixed version lines.
• Bumped the advisory modified timestamp (but it remains in 2025).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

[aruneko]

How is the status of a review for this pull request?

[JonathanLEvans]

Can you explain how you determined that org.apache.tomcat:tomcat-coyote is affected?

[aruneko]

In this commit, tomcat fixed the vulnerability.

apache/tomcat@6f181e10

The commit includes the files java/org/apache/tomcat/util/http/InvalidParameterException.java and java/org/apache/tomcat/util/http/Parameters.java. They are also included in tomcat-coyote.