[GHSA-4x29-79gh-6v8q] Detection of Error Condition Without Action vulnerability...

[hara-satoshi-ymr]

Updates

• Affected products
• Summary

Comments
Correct the affected Maven packages. The fixed class is org.apache.tomcat.util.net.openssl.panama.OpenSSLContext (FFM/Panama connector). Checked against the binary jars on Maven Central:

• tomcat-coyote-ffm contains this class in every release since it was split out (9.0.93 / 10.1.26 / 11.0.0-M22), so it must be added.
• tomcat-embed-core contains it only in 10.1.23-10.1.26 and 11.0.0-M20-M22. It is absent from all 9.0.x jars and from 10.1.28+ / 11.0.0-M24+, so the embed-core ranges should be limited to those versions instead of covering whole branches.
• tomcat-coyote contains it only in 10.1.23-10.1.25 and 11.0.0-M14-M21 (before the split).
• org.apache.tomcat:tomcat (binary distribution) ships the class and should be included.
• Lower bounds are based on the jar contents: the Apache advisory lists 11.0.0-M1 / 10.1.0-M7 / 9.0.83, but the panama OpenSSLContext class is not present in any Maven Central artifact before 11.0.0-M14 / 10.1.23 / 9.0.93.

Evidence:

• Apache Tomcat security pages: https://tomcat.apache.org/security-11.html , https://tomcat.apache.org/security-10.html , https://tomcat.apache.org/security-9.html
• Fix commits:
  • 11.0.x: apache/tomcat@7f8ecdb (first included in 11.0.23)
  • 10.1.x: apache/tomcat@feec60d (first included in 10.1.56)
  • 9.0.x: apache/tomcat@c48ac39 (first included in 9.0.119)
• Related open PR: [GHSA-4x29-79gh-6v8q] Detection of Error Condition Without Action vulnerability... #9175

[Copilot]

🟡 Changes recommended

The advisory summary describes the metadata edit rather than the vulnerability.

1 open finding

• Apache Tomcat fails to load certificate revocation lists · New

What changed in this PR

Updates the Apache Tomcat FFM connector advisory with Maven artifact-specific vulnerability coverage.

Changes:

• Adds affected ranges for four Maven packages across Tomcat branches.
• Adds an advisory summary and updates modification metadata.

File	Description
advisories/​unreviewed/​2026/​06/​GHSA-4x29-79gh-6v8q/​GHSA-4x29-79gh-6v8q.json	Adds affected package ranges and advisory metadata.

🧠 Review effort: Max

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.