Read the docs
TI-2022-22218 Aliases CVE-2022-45143GHSA-rq2w-37h9-vg94

Apache Tomcat: JsonErrorReportValve escaping

Priority LOW 38CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 9 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02669 85th percentileScored 2026-11-07
Fix Partial org.apache.tomcat.embed:tomcat-embed-core (Maven): 8.5.84, 9.0.69, 10.1.2org.apache.tomcat:tomcat-catalina (Maven): 10.1.2+1 more productRed Hat: 7 advisoriesRed Hat: 9 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Tomcat10.1.0-M1 – 10.1.1; 9.0.40 – 9.0.68; 8.5.83 and later—No fix listedCNA
—org.apache.tomcat.embed:tomcat-embed-core (Maven)8.5.83 to before 8.5.848.5.84Patch availableGHSA-rq2w-37h9-vg94
—org.apache.tomcat.embed:tomcat-embed-core (Maven)9.0.40 to before 9.0.699.0.69Patch availableGHSA-rq2w-37h9-vg94
—org.apache.tomcat.embed:tomcat-embed-core (Maven)10.1.0 to before 10.1.210.1.2Patch availableGHSA-rq2w-37h9-vg94
—org.apache.tomcat:tomcat-catalina (Maven)10.1.0 to before 10.1.210.1.2Patch availableGHSA-rq2w-37h9-vg94
—org.apache.tomcat:tomcat-util (Maven)8.5.83 to before 8.5.848.5.84Patch availableGHSA-rq2w-37h9-vg94
—org.apache.tomcat:tomcat-util (Maven)9.0.40 to before 9.0.699.0.69Patch availableGHSA-rq2w-37h9-vg94
  • Apache Tomcat VendorApache Affected 10.1.0-M1 – 10.1.1; 9.0.40 – 9.0.68; 8.5.83 and later Fixed in — No fix listed CNA
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.5.83 to before 8.5.84 Fixed in 8.5.84 Patch available GHSA-rq2w-37h9-vg94
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.40 to before 9.0.69 Fixed in 9.0.69 Patch available GHSA-rq2w-37h9-vg94
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 10.1.0 to before 10.1.2 Fixed in 10.1.2 Patch available GHSA-rq2w-37h9-vg94
  • org.apache.tomcat:tomcat-catalina (Maven) Vendor— Affected 10.1.0 to before 10.1.2 Fixed in 10.1.2 Patch available GHSA-rq2w-37h9-vg94
  • org.apache.tomcat:tomcat-util (Maven) Vendor— Affected 8.5.83 to before 8.5.84 Fixed in 8.5.84 Patch available GHSA-rq2w-37h9-vg94
  • org.apache.tomcat:tomcat-util (Maven) Vendor— Affected 9.0.40 to before 9.0.69 Fixed in 9.0.69 Patch available GHSA-rq2w-37h9-vg94

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*9.0.40 to before 9.0.69VulnerableApache
cpe:2.3:a:apache:tomcat:8.5.83:*:*:*:*:*:*:*8.5.83VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*10.1.0 milestone1VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*10.1.0 milestone10VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*10.1.0 milestone11VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*10.1.0 milestone12VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*10.1.0 milestone13VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*10.1.0 milestone14VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*10.1.0 milestone15VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*10.1.0 milestone16VulnerableApache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 9.0.40 to before 9.0.69 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.5.83:*:*:*:*:*:*:* Versions 8.5.83 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:* Versions 10.1.0 milestone1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:* Versions 10.1.0 milestone10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:* Versions 10.1.0 milestone11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:* Versions 10.1.0 milestone12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:* Versions 10.1.0 milestone13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:* Versions 10.1.0 milestone14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:* Versions 10.1.0 milestone15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:* Versions 10.1.0 milestone16 Vulnerable ·Apache
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*10.1.0 milestone17VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*10.1.0 milestone2VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*10.1.0 milestone3VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*10.1.0 milestone4VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*10.1.0 milestone5VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*10.1.0 milestone6VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*10.1.0 milestone7VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*10.1.0 milestone8VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*10.1.0 milestone9VulnerableApache
cpe:2.3:a:apache:tomcat:10.1.1:*:*:*:*:*:*:*10.1.1VulnerableApache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:* Versions 10.1.0 milestone17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:* Versions 10.1.0 milestone2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:* Versions 10.1.0 milestone3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:* Versions 10.1.0 milestone4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:* Versions 10.1.0 milestone5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:* Versions 10.1.0 milestone6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:* Versions 10.1.0 milestone7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:* Versions 10.1.0 milestone8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:* Versions 10.1.0 milestone9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:10.1.1:*:*:*:*:*:*:* Versions 10.1.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-rq2w-37h9-vg94 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.84 Advisory →
  • Fix · GHSA-rq2w-37h9-vg94 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.69 Advisory →
  • Fix · GHSA-rq2w-37h9-vg94 org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 10.1.2 Advisory →
  • Fix · GHSA-rq2w-37h9-vg94 org.apache.tomcat:tomcat-catalina (Maven) Fixed in 10.1.2 Advisory →
  • Fix · GHSA-rq2w-37h9-vg94 org.apache.tomcat:tomcat-util (Maven) Fixed in 8.5.84 Advisory →
  • Fix · GHSA-rq2w-37h9-vg94 org.apache.tomcat:tomcat-util (Maven) Fixed in 9.0.69 Advisory →

Red Hat 7 advisories

  • RHSA-2024:3814 Released 2024-06-11 · Red Hat rating Important
    tomcat security and bug fix update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) tomcat-1:9.0.87-1.el8_8.2, tomcat-admin-webapps-1:9.0.87-1.el8_8.2, tomcat-docs-webapp-1:9.0.87-1.el8_8.2 +5
  • RHSA-2024:3666 Released 2024-06-06 · Red Hat rating Important
    tomcat security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) tomcat-1:9.0.87-1.el8_10.1, tomcat-admin-webapps-1:9.0.87-1.el8_10.1, tomcat-docs-webapp-1:9.0.87-1.el8_10.1 +5
  • RHSA-2024:3307 Released 2024-05-23 · Red Hat rating Important
    tomcat security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) tomcat-1:9.0.87-1.el9_4.1, tomcat-admin-webapps-1:9.0.87-1.el9_4.1, tomcat-docs-webapp-1:9.0.87-1.el9_4.1 +5
Show 4 more Red Hat advisories
  • RHSA-2023:4612 Released 2023-08-16 · Red Hat rating Important
    Red Hat support for Spring Boot 2.7.13 security update
    • Red Hat support for Spring Boot 2.7.13
  • RHSA-2023:3954 Released 2023-06-29 · Red Hat rating Critical
    Red Hat Fuse 7.12 release and security update
    • Red Hat Fuse 7.12
  • RHSA-2023:1664 Released 2023-04-12 · Red Hat rating Low
    Red Hat JBoss Web Server 5.7.2 release and security update
    • Red Hat JBoss Web Server 5
  • RHSA-2023:1663 Released 2023-04-12 · Red Hat rating Low
    Red Hat JBoss Web Server 5.7.2 release and security update
    • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-9.0.62-13.redhat_00011.1.el7jws, jws5-tomcat-admin-webapps-9.0.62-13.redhat_00011.1.el7jws, jws5-tomcat-docs-webapp-9.0.62-13.redhat_00011.1.el7jws +9
    • Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-9.0.62-13.redhat_00011.1.el8jws, jws5-tomcat-admin-webapps-9.0.62-13.redhat_00011.1.el8jws, jws5-tomcat-docs-webapp-9.0.62-13.redhat_00011.1.el8jws +7
    • Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-9.0.62-13.redhat_00011.1.el9jws, jws5-tomcat-admin-webapps-9.0.62-13.redhat_00011.1.el9jws, jws5-tomcat-docs-webapp-9.0.62-13.redhat_00011.1.el9jws +7

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat JBoss Web Server 3AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:3666
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:3307
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:3814
Red Hat Fuse 7.12Fixed RHSA-2023:3954
Red Hat JBoss Web Server 5Fixed RHSA-2023:1664
Red Hat JBoss Web Server 5.7 for RHEL 7 ServerFixed RHSA-2023:1663
Red Hat JBoss Web Server 5.7 for RHEL 8Fixed RHSA-2023:1663
Red Hat JBoss Web Server 5.7 for RHEL 9Fixed RHSA-2023:1663
Red Hat support for Spring Boot 2.7.13Fixed RHSA-2023:4612
Not affected: 8 products
  • Red Hat Data Grid 8
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Web Server 3
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel for Spring Boot 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-45143
  2. 2026-10-03 Alias added: GHSA-rq2w-37h9-vg94

References

Advisory 3

Other 4

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences