🔴 This tool does not compare version numbers to decide whether a fix is present — because the version-number story is exactly where this CVE goes wrong. The verdict table is generated by tools/gen_table.py from primary sources; if any of the seven assertion groups fail, it refuses to emit the table.

Measured results across the seven lines

The four ways "the official statement doesn't hold for you"

① You're on the 8.5 / 7.0 / 8.0 line — none of the three versions Apache gives is on your line, and your line has stopped shipping (8.5.101 / 7.0.110 / 8.0.54 are all 404 on Maven Central). 8.0 is special: Apache marks it as unknown, not even answering whether you're affected.

② You're on the 10.1 line — Apache tells you to upgrade to 10.1.52, and 10.1.52 itself is missing the fix. The previous paragraph of the same advisory lists 10.1.0-M1 through 10.1.52 as affected. Apache's own security-10.html files this CVE under the 10.1.53 section; compare 10.1.52...10.1.53 indeed contains the fix commit f07df938. → Following that statement means upgrading to nothing.

③ You're on the 10.0 line — 10.0. appears 0 times in the official advisory. It's neither in the affected list nor in the two unknown entries; both ranges in the GitHub advisory (>= 7.0.0, < 9.0.116 and >= 10.1.0-M1, < 10.1.52) also fail to cover it. Yet 10.0.27's ChunkedInputFilter members are byte-for-byte identical to 7.0.109 / 8.5.100, and 10.0.28 is 404. → No source has ever answered whether 10.0 is affected.

④ You use Dependabot / OSV — the GitHub advisory collapses 7.0/8.5/9.0 into one range, first_patched_version = 9.0.116, so machines tell 8.5 users to upgrade to 9.0.116. That's a different major line, not a patch.

Boundaries of what this tool says (it doesn't cross them, and neither should you)

• "Missing the fix code" is an artifact fact; "you are affected" is something else, requiring upstream confirmation — and the 10.0 line is precisely the one nobody has confirmed. This tool's wording is always the former.
• Request smuggling only matters with a front-end proxy and the two ends interpreting things differently. There's no attack story to tell on a bare-running Tomcat.
• Apache's original advisory rates this as low (the GitHub advisory marks it high / CVSS 7.5). Both numbers are listed here; we don't pick the one that suits us.

Primary sources

• Apache original advisory (oss-security, Mark Thomas, 2026-04-09): http://www.openwall.com/lists/oss-security/2026/04/09/20
• GitHub advisory:https://github.com/advisories/GHSA-563x-q5rq-57qp
• Fix commits:1b586d6(9.0)· f07df938(10.1)· fde1a82(11.0)
• Version lines and EOL:https://endoflife.date/tomcat

Regenerating the verdict table

Assertions cover: positives (9.0.116 / 10.1.53 / 11.0.20 must have the fix class), negatives (9.0.115 / 10.1.52 must not), the core claim (the official recommend indeed names 10.1.52), EOL lines, no-exit (the version after the final one must 404), sentinels (a nonexistent version must 404, proving the 404 criterion itself isn't broken), and 10.0's absence.

Build

License

Apache-2.0