Description
Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | tomcat | 3.3a-4woody.1 | DSA-246 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 3.0, < 3.3.2 | 3.3.2 | GHSA-5hgm-qm5m-5vmw |
Advisories 1
- DSA-246 tomcat - information exposure, cross site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-246 vendor-advisory
- http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/
- 6720 vdb-entry
- HPSBUX0303-249 vendor-advisory
- tomcat-web-app-xss(11196) vdb-entry
- N-060 third-party-advisory government-resource
- 9204 vdb-entry
- 7972 third-party-advisory
- http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt
- 9203 vdb-entry