{"id":"CVE-2016-8735","published":"2017-04-06T21:59:00Z","modified":"2026-08-25T16:28:27Z","title":"Apache Tomcat Remote Code Execution Vulnerability","vendor":"Apache","product":"Tomcat","tier":"core","eol":null,"description":{"text":"Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is in Apache Tomcat's JmxRemoteLifecycleListener component, which is affected in Tomcat releases before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 because the listener was not updated to match an earlier Oracle credential-type patch. An attacker who can reach the JMX ports over the network, in a deployment where this listener is configured, can execute remote code without needing credentials or any user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:50Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.90338,"percentile":0.99797,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2023-05-12","dueDate":"2023-06-02","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-05-12","exploitedFirstSeen":"2023-05-12","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-05-12"},{"url":"https://thedfirreport.com/2023/12/18/lets-opendir-some-presents-an-analysis-of-a-persistent-actors-activity/","date":"2023-12-18"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2017-0457.html","tags":["Third Party Advisory"]},{"url":"http://seclists.org/oss-sec/2016/q4/502","tags":["Mailing List","Mitigation","Third Party Advisory"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1767644","tags":["Broken Link","Patch"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1767656","tags":["Broken Link","Patch"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1767676","tags":["Broken Link","Patch"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1767684","tags":["Broken Link","Patch"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["Release Notes","Vendor Advisory"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["Release Notes","Vendor Advisory"]},{"url":"http://tomcat.apache.org/security-8.html","tags":["Release Notes","Vendor Advisory"]},{"url":"http://tomcat.apache.org/security-9.html","tags":["Release Notes","Vendor Advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3738","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/94463","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1037331","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0455","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0456","tags":["Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://security.netapp.com/advisory/ntap-20180607-0001/","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4557-1/","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["Patch","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0457.html","tags":["Third Party Advisory"]},{"url":"http://seclists.org/oss-sec/2016/q4/502","tags":["Mailing List","Mitigation","Third Party Advisory"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1767644","tags":["Broken Link","Patch"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1767656","tags":["Broken Link","Patch"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1767676","tags":["Broken Link","Patch"]},{"url":"http://svn.apache.org/viewvc?view=revision&revision=1767684","tags":["Broken Link","Patch"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["Release Notes","Vendor Advisory"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["Release Notes","Vendor Advisory"]},{"url":"http://tomcat.apache.org/security-8.html","tags":["Release Notes","Vendor Advisory"]},{"url":"http://tomcat.apache.org/security-9.html","tags":["Release Notes","Vendor Advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3738","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/94463","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1037331","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0455","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0456","tags":["Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","tags":["Mailing List","Patch"]},{"url":"https://security.netapp.com/advisory/ntap-20180607-0001/","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4557-1/","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["Patch","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-8735","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Attacker reaches exposed JMX port remotely","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Remote code execution is possible with Apache Tomcat","start":0,"end":52}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Yields arbitrary code execution on server","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Remote code execution is possible with Apache Tomcat","start":0,"end":52}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina-jmx-remote","vulnerableRanges":["<6.0.48",">=7.0.0, <7.0.73",">=8.0.0, <8.0.39",">=8.5.0, <8.5.7",">=9.0.0.M1, <9.0.0.M12"],"patched":["6.0.48","7.0.73","8.0.39","8.5.7","9.0.0.M12"],"from":["GHSA-cw54-59pw-4g8c"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":["<6.0.48",">=7.0.0, <7.0.73",">=8.0.0, <8.0.39",">=8.5.0, <8.5.7",">=9.0.0.M1, <9.0.0.M12"],"patched":["6.0.48","7.0.73","8.0.39","8.5.7","9.0.0.M12"],"from":["GHSA-cw54-59pw-4g8c"],"provenance":"source"}],"advisories":[{"id":"GHSA-cw54-59pw-4g8c","url":"https://github.com/advisories/GHSA-cw54-59pw-4g8c","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina-jmx-remote","vulnerableRanges":["<6.0.48"],"patched":["6.0.48"],"provenance":"source","from":"GHSA"},{"id":"GHSA-cw54-59pw-4g8c","url":"https://github.com/advisories/GHSA-cw54-59pw-4g8c","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina-jmx-remote","vulnerableRanges":[">=7.0.0, <7.0.73"],"patched":["7.0.73"],"provenance":"source","from":"GHSA"},{"id":"GHSA-cw54-59pw-4g8c","url":"https://github.com/advisories/GHSA-cw54-59pw-4g8c","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina-jmx-remote","vulnerableRanges":[">=8.0.0, <8.0.39"],"patched":["8.0.39"],"provenance":"source","from":"GHSA"},{"id":"GHSA-cw54-59pw-4g8c","url":"https://github.com/advisories/GHSA-cw54-59pw-4g8c","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina-jmx-remote","vulnerableRanges":[">=8.5.0, <8.5.7"],"patched":["8.5.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-cw54-59pw-4g8c","url":"https://github.com/advisories/GHSA-cw54-59pw-4g8c","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina-jmx-remote","vulnerableRanges":[">=9.0.0.M1, <9.0.0.M12"],"patched":["9.0.0.M12"],"provenance":"source","from":"GHSA"},{"id":"GHSA-cw54-59pw-4g8c","url":"https://github.com/advisories/GHSA-cw54-59pw-4g8c","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":["<6.0.48"],"patched":["6.0.48"],"provenance":"source","from":"GHSA"},{"id":"GHSA-cw54-59pw-4g8c","url":"https://github.com/advisories/GHSA-cw54-59pw-4g8c","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=7.0.0, <7.0.73"],"patched":["7.0.73"],"provenance":"source","from":"GHSA"},{"id":"GHSA-cw54-59pw-4g8c","url":"https://github.com/advisories/GHSA-cw54-59pw-4g8c","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=8.0.0, <8.0.39"],"patched":["8.0.39"],"provenance":"source","from":"GHSA"},{"id":"GHSA-cw54-59pw-4g8c","url":"https://github.com/advisories/GHSA-cw54-59pw-4g8c","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=8.5.0, <8.5.7"],"patched":["8.5.7"],"provenance":"source","from":"GHSA"},{"id":"GHSA-cw54-59pw-4g8c","url":"https://github.com/advisories/GHSA-cw54-59pw-4g8c","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","vulnerableRanges":[">=9.0.0.M1, <9.0.0.M12"],"patched":["9.0.0.M12"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-3642","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3642","exploited":true,"exploitedSince":"2023-05-12","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2017-04-06","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8735","provenance":"source"},{"date":"2023-05-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2023-05-12","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-05-12","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3642","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":2227},"priority":{"score":64.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1266 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9980"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2014-0096","published":"2014-05-31","fixed":"8.0.6","kev":false},{"cve":"CVE-2014-0119","published":"2014-05-31","fixed":"8.0.6","kev":false},{"cve":"CVE-2016-5388","published":"2016-07-19","fixed":"8.5.5","kev":false,"link":{"from":"CVE-2016-5388","to":"CVE-2016-8735","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"7.0.72","toFixed":"7.0.73","daysApart":261},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"8.5.5","toFixed":"8.5.7","daysApart":261}]}},{"cve":"CVE-2016-8735","published":"2017-04-06","fixed":"9.0.0.M12","kev":true},{"cve":"CVE-2017-5648","published":"2017-04-17","fixed":"9.0.0.M18","kev":false,"link":{"from":"CVE-2016-8735","to":"CVE-2017-5648","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"9.0.0.M12","toFixed":"9.0.0.M18","daysApart":11},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-catalina","fromFixed":"7.0.73","toFixed":"7.0.76","daysApart":11}]}},{"cve":"CVE-2017-12617","published":"2017-10-04","fixed":"9.0.1","kev":true},{"cve":"CVE-2019-0221","published":"2019-05-28","fixed":"9.0.17","kev":false}],"package":"Maven:org.apache.tomcat:tomcat-catalina"}}