Changes.Watch~ upgrade verdicts ~
Free digest
Research1 in 10 popular npm releases needed a hotfix

critical vulnerability

Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability

Partly patchedCritical · CVSS 9.1EPSS 0.61%

Published Jun 29, 2026 · updated Nov 4, 2026

What to do

  1. Upgrade to a fixed version: org.apache.tomcat.embed:tomcat-embed-core 11.0.23, org.apache.tomcat.embed:tomcat-embed-core 10.1.56, org.apache.tomcat.embed:tomcat-embed-core 9.0.119, org.apache.tomcat:tomcat 11.0.23 (see table).
  2. Some affected packages have no fixed version yet: follow the advisory for mitigations and watch this page for the fix.
  3. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenorg.apache.tomcat.embed:tomcat-embed-core

Vulnerable versions
>= 11.0.0-M1, < 11.0.23
Fixed in
11.0.23

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

Mavenorg.apache.tomcat.embed:tomcat-embed-core

Vulnerable versions
>= 10.1.0-M1, < 10.1.56
Fixed in
10.1.56

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

Mavenorg.apache.tomcat.embed:tomcat-embed-core

Vulnerable versions
>= 9.0.0.M1, < 9.0.119
Fixed in
9.0.119

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

Mavenorg.apache.tomcat.embed:tomcat-embed-core

Vulnerable versions
>= 8.5.0, <= 8.5.100
Fixed in
no fix yet

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat.embed:tomcat-embed-core

Mavenorg.apache.tomcat:tomcat

Vulnerable versions
>= 11.0.0-M1, < 11.0.23
Fixed in
11.0.23

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

Mavenorg.apache.tomcat:tomcat

Vulnerable versions
>= 10.1.0-M1, < 10.1.56
Fixed in
10.1.56

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

Mavenorg.apache.tomcat:tomcat

Vulnerable versions
>= 9.0.0.M1, < 9.0.119
Fixed in
9.0.119

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

Mavenorg.apache.tomcat:tomcat

Vulnerable versions
>= 8.5.0, <= 8.5.100
Fixed in
no fix yet

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

Mavenorg.apache.tomcat:tomcat-util-scan

Vulnerable versions
>= 11.0.0-M1, < 11.0.23
Fixed in
11.0.23

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-util-scan

Mavenorg.apache.tomcat:tomcat-util-scan

Vulnerable versions
>= 10.1.0-M1, < 10.1.56
Fixed in
10.1.56

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-util-scan

Mavenorg.apache.tomcat:tomcat-util-scan

Vulnerable versions
>= 9.0.0.M1, < 9.0.119
Fixed in
9.0.119

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-util-scan

Mavenorg.apache.tomcat:tomcat-util-scan

Vulnerable versions
>= 8.5.0, <= 8.5.100
Fixed in
no fix yet

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-util-scan

Sources

CWE-670 Always-Incorrect Control Flow Implementation

← All critical vulnerabilities