[GHSA-wrvx-pxxf-g8fg] Insufficient Session Expiration vulnerability in Apache...

[hara-satoshi-ymr]

Updates

• Affected products
• Summary

Comments
Add missing packages and patched versions.

• Add org.apache.tomcat.embed:tomcat-embed-websocket. The fix changes org.apache.tomcat.websocket.WsSession and org.apache.tomcat.websocket.server.* classes, which are packaged in both tomcat-websocket and tomcat-embed-websocket.
• Add org.apache.tomcat:tomcat-catalina-ha. The fix also changes org.apache.catalina.ha.session.DeltaSession, which is packaged in tomcat-catalina-ha.
• Add patched versions 11.0.25 / 10.1.58 / 9.0.121 (the current entries only have an upper bound).
• Add 8.5.0-8.5.100 and 7.0.43-7.0.109 (per the CVE record, which lists them as affected) for tomcat, tomcat-embed-websocket and tomcat-catalina-ha, and 8.5.0-8.5.100 for tomcat-websocket (there is no 7.0.x release of tomcat-websocket on Maven Central). 8.5.x and 7.0.x are EOL, so there are no patched versions.

Evidence:

• Apache Tomcat security pages: https://tomcat.apache.org/security-11.html , https://tomcat.apache.org/security-10.html , https://tomcat.apache.org/security-9.html
• Fix commits:
  • 11.0.x: apache/tomcat@e617a5d (first included in 11.0.25)
  • 10.1.x: apache/tomcat@83427cb (first included in 10.1.58)
  • 9.0.x: apache/tomcat@4b41a73 (first included in 9.0.121)
• Related open PR: [GHSA-wrvx-pxxf-g8fg] Insufficient Session Expiration vulnerability in Apache T... #9293

[Copilot]

🟡 Changes recommended

Affected-package mappings and the advisory title need correction before publication.

3 open findings

• Add the missing Tomcat 7 WebSocket artifact · New
• Use a vulnerability-specific advisory summary · New
• Remove incorrectly affected tomcat-catalina-ha entries · New

What changed in this PR

Updates the Apache Tomcat session-expiration advisory to improve Maven dependency coverage.

Changes:

• Adds affected packages and version ranges.
• Records patched releases and end-of-life affected versions.
• Adds an advisory summary.

File	Description
advisories/​unreviewed/​2026/​08/​GHSA-wrvx-pxxf-g8fg/​GHSA-wrvx-pxxf-g8fg.json	Expands package coverage, version boundaries, and advisory metadata.

🧠 Review effort: Max

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.