[taishikitamura]

Updates

• Affected products
• CVSS v3
• References
• Severity
• Summary

Comments
Add the affected Maven packages. This advisory currently has no affected packages.

• The fix changes org.apache.tomcat.util.net.AprEndpoint. In the binary jars on Maven Central, the changed classes are packaged in tomcat-coyote and tomcat-embed-core (checked in 9.0.122). They are also shipped in the binary distribution org.apache.tomcat:tomcat.
• Patched versions are the first upstream tags containing the fix commits (9.0.123).
• Only 9.0.x is affected, as in the Apache advisory. CVE-2026-65183 covered the NIO connector; this CVE is the incomplete-fix follow-up for the APR connector (AprEndpoint), which exists only in 9.0.x and is not present in the 10.1.x and 11.0.x jars. The lower bound 9.0.47 follows the Apache advisory (Unix domain socket support was added to AprEndpoint in 9.0.47; 9.0.47 itself is not on Maven Central).

Evidence:

• Apache Tomcat security pages: https://tomcat.apache.org/security-11.html , https://tomcat.apache.org/security-10.html , https://tomcat.apache.org/security-9.html
• Fix commits:
  • 9.0.x: apache/tomcat@894158f (first included in 9.0.123)

CVSS (for reference only):

• Apache Tomcat security team rating: low
• The CVE record currently carries no CVSS v3.1 score (no CNA or CISA ADP metrics).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.