[GHSA-fpj8-gq4v-p354] Apache Tomcat - Client certificate verification bypass

[yusuke-koyoshi]

Updates

• Affected products
• CVSS v3

Comments
Updated the GHSA advisory's "Affected packages" field to correctly identify the packages that are actually impacted by this vulnerability. The previous entry did not accurately reflect the real scope of the issue.

[Copilot]

Pull request overview

This PR updates the GitHub-reviewed advisory for GHSA-fpj8-gq4v-p354 (Apache Tomcat client certificate verification bypass) to better reflect the vulnerability’s scope and scoring metadata.

Changes:

• Removed the advisory’s CVSS v3 severity entry, leaving CVSS v4 as the only severity vector.
• Updated the affected Maven package coordinates from org.apache.tomcat:tomcat-catalina to org.apache.tomcat:tomcat-coyote across affected ranges.
• Bumped the advisory modified timestamp.

Comments suppressed due to low confidence (1)

advisories/github-reviewed/2026/02/GHSA-fpj8-gq4v-p354/GHSA-fpj8-gq4v-p354.json:16

• PR description mentions updating “CVSS v3”, but this change removes the CVSS_V3 entry entirely and leaves only CVSS_V4. Please either update the PR description to reflect what actually changed, or re-add/update the CVSS_V3 vector if it’s still expected for this advisory.

  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
    }
  ],

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

[advisory-database]

Hi @yusuke-koyoshi! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!