CVE-2026-34483

Apache Tomcat: Incomplete escaping of JSON access logs

Description

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117 , which fix the issue.

Scores

Weaknesses (CWE)

• CWE-116

Advisories

• GHSA-rv64-5gf8-9qq8 — Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve

European references

• ENISA EUVD · EUVD-2026-21053
• GCVE · GCVE-0-2026-34483

CERT-FR advisories

• CERTFR-2026-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0933 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0621 — Multiples vulnérabilités dans les produits Atlassian · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0500 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0418 — Multiples vulnérabilités dans Apache Tomcat · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 9.0.40 < 9.0.117
• cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 10.1.0 < 10.1.54
• cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 11.0.0 < 11.0.21

Affected products

References

• https://lists.apache.org/thread/j1w7304yonlr8vo1tkb5nfs7od1y228b
• http://www.openwall.com/lists/oss-security/2026/04/09/26

Sources