[GHSA-4x29-79gh-6v8q] Detection of Error Condition Without Action vulnerability...

[vanxa]

Updates

• Affected products
• Summary

Comments
https://nvd.nist.gov/vuln/detail/CVE-2026-55276

[hara-satoshi-ymr]

Thanks for this PR. Based on the fix commits and the binary artifacts published to Maven Central, I'd suggest the following changes.

Correct the affected Maven packages. The fixed class is org.apache.tomcat.util.net.openssl.panama.OpenSSLContext (FFM/Panama connector). Checked against the binary jars on Maven Central:

• tomcat-coyote-ffm contains this class in every release since it was split out (9.0.93 / 10.1.26 / 11.0.0-M22), so it must be added.
• tomcat-embed-core contains it only in 10.1.23-10.1.26 and 11.0.0-M20-M22. It is absent from all 9.0.x jars and from 10.1.28+ / 11.0.0-M24+, so the embed-core ranges should be limited to those versions instead of covering whole branches.
• tomcat-coyote contains it only in 10.1.23-10.1.25 and 11.0.0-M14-M21 (before the split).
• org.apache.tomcat:tomcat (binary distribution) ships the class and should be included.
• Lower bounds are based on the jar contents: the Apache advisory lists 11.0.0-M1 / 10.1.0-M7 / 9.0.83, but the panama OpenSSLContext class is not present in any Maven Central artifact before 11.0.0-M14 / 10.1.23 / 9.0.93.

Suggested affected products:

Ecosystem	Package name	Affected versions	Patched versions
Maven	org.apache.tomcat:tomcat-coyote-ffm	>= 9.0.93, <= 9.0.118	9.0.119
Maven	org.apache.tomcat:tomcat-coyote-ffm	>= 10.1.26, <= 10.1.55	10.1.56
Maven	org.apache.tomcat:tomcat-coyote-ffm	>= 11.0.0-M22, <= 11.0.22	11.0.23
Maven	org.apache.tomcat:tomcat-coyote	>= 10.1.23, <= 10.1.25	10.1.26
Maven	org.apache.tomcat:tomcat-coyote	>= 11.0.0-M14, <= 11.0.0-M21	11.0.0-M22
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 10.1.23, <= 10.1.26
Maven	org.apache.tomcat.embed:tomcat-embed-core	>= 11.0.0-M20, <= 11.0.0-M22
Maven	org.apache.tomcat:tomcat	>= 9.0.93, <= 9.0.118	9.0.119
Maven	org.apache.tomcat:tomcat	>= 10.1.23, <= 10.1.55	10.1.56
Maven	org.apache.tomcat:tomcat	>= 11.0.0-M14, <= 11.0.22	11.0.23

Evidence:

• Apache Tomcat security pages: https://tomcat.apache.org/security-11.html , https://tomcat.apache.org/security-10.html , https://tomcat.apache.org/security-9.html
• Fix commits:
  • 11.0.x: apache/tomcat@7f8ecdb (first included in 11.0.23)
  • 10.1.x: apache/tomcat@feec60d (first included in 10.1.56)
  • 9.0.x: apache/tomcat@c48ac39 (first included in 9.0.119)