chore(findings): opensource/apache/tomcat8-openjdk8

CHORE_TOKEN
2025-09-30T13:35:39Z

## Summary

opensource/apache/tomcat8-openjdk8 has 3 new findings discovered during continuous monitoring.

More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=opensource/apache/tomcat8-openjdk8&tag=8.5.100&branch=master

EPSS (Exploit Prediction Scoring System) provides an estimate of the likelihood that a vulnerability will be exploited in the wild.

KEV (Known Exploited Vulnerabilities) indicates whether a vulnerability is actively being exploited according to CISA.

id | source | severity | package | impact | workaround | epss_score | kev
-- | ------ | -------- | ------- | ------ | ---------- | ---------- | ---
CVE-2025-11083 | Anchore CVE | Medium | gdb-gdbserver-8.2-20.el8 | | | 0.00013 | false
CVE-2025-11082 | Anchore CVE | Medium | gdb-gdbserver-8.2-20.el8 | | | 0.00013 | false
CVE-2025-11081 | Anchore CVE | Medium | gdb-gdbserver-8.2-20.el8 | | | 0.00013 | false

More information can be found in the VAT located here: https://vat.dso.mil/vat/image?imageName=opensource/apache/tomcat8-openjdk8&tag=8.5.100&branch=master

### Novel Tidelift Findings (Experimental)

opensource/apache/tomcat8-openjdk8 has 11 novel Tidelift findings discovered during continuous monitoring.

**_NOTE:_** This table is for Iron Bank evaluation and testing purposes. No action required by vendors.
id | cvss score | package | impact | workaround | epss_score | kev
-- | ---------- | ------- | ------ | ---------- | ---------- | ---
CVE-2024-34750 | 7.5 | org.apache.tomcat:tomcat-coyote-8.5.100 | | | 0.16902 | false
CVE-2016-5699 | 6.1 | urllib3-1.24.2 | Its unlikely for an attacker to control URLs. | Reject URLs with rn or encode those characters. | 0.12314 | false
CVE-2019-9740 | 6.1 | urllib3-1.24.2 | Its unlikely for an attacker to control the URL youre fetching. | | 0.09968 | false
CVE-2025-31650 | 6.6 | org.apache.tomcat:tomcat-coyote-8.5.100 | | | 0.03442 | false
CVE-2019-11324 | 7.5 | urllib3-1.24.2 | cacerts is a commonly used parameter. | | 0.01449 | false
CVE-2024-38286 | 7.5 | org.apache.tomcat:tomcat-util-8.5.100 | | | 0.01356 | false
CVE-2019-9947 | 6.1 | urllib3-1.24.2 | Its unlikely for an attacker to control an URL. | Reject URLs with rn or encode those characters. | 0.01017 | false
CVE-2021-33503 | 7.5 | urllib3-1.24.2 | Attackers dont usually control the URLs that urllib3 fetches. | Its possible but inconvenient to filter URLs with many . | 0.00863 | false
CVE-2025-52434 | 6.3 | org.apache.tomcat:tomcat-util-8.5.100 | | | 0.00182 | false
CVE-2025-53506 | 6.3 | org.apache.tomcat:tomcat-coyote-8.5.100 | | | 0.00170 | false
CVE-2025-50182 | 5.3 | urllib3-1.24.2 | Pyodide is extremely rare configuration for users in production. | | 0.00013 | false