[GHSA-qq5r-98hh-rxc9] Apache Tomcat - Security constraint bypass with HTTP/0.9

[yusuke-koyoshi]

Updates

• Affected products
• CVSS v4
• Severity

Comments
Updated the GHSA advisory's "Affected packages" field to correctly identify the packages that are actually impacted by this vulnerability. The previous entry did not accurately reflect the real scope of the issue.

Threat Metrics should not be included in the CVSS vector string for vulnerabilities.

[Copilot]

Pull request overview

Updates the GitHub-reviewed advisory for GHSA-qq5r-98hh-rxc9 (Apache Tomcat - Security constraint bypass with HTTP/0.9) to better reflect the impacted Maven artifacts and to correct advisory metadata around severity and CVSS v4 representation.

Changes:

• Removed the Threat Metric (E:U) from the CVSS v4 vector string.
• Updated affected Maven coordinates from org.apache.tomcat:tomcat-catalina to org.apache.tomcat:tomcat-coyote for the listed version ranges.
• Adjusted the advisory’s database_specific.severity from LOW to MODERATE and bumped the modified timestamp.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

👋 This pull request has been marked as stale because it has been open with no activity. You can: comment on the issue or remove the stale label to hold stale off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing this pull request will be closed eventually by the stale bot. Please see CONTRIBUTING.md for more policy details.

[yusuke-koyoshi]

Please review this PR.

[advisory-database]

Hi @yusuke-koyoshi! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!