CVE-2026-34487 in Tomcat Embed Core 10.1.42 doesn't deceted

[antonbombov]

Description

Hello,

I have found some strange behavior when scanning the artifact org.apache.tomcat.embed:tomcat-embed-core:10.1.42 (https://mvnrepository.com/artifact/org.apache.tomcat.embed/tomcat-embed-core/10.1.42).

Trivy no longer detects CVE-2026-34487 in this artifact, but an older scan did show this vulnerability (for example, from June 15, 2026).

However, according to the Aqua Security vulnerability database (https://avd.aquasec.com/nvd/2026/cve-2026-34487/), this CVE affects all versions from 10.1.0 to 10.1.53, which clearly includes 10.1.42.

I tested this with Trivy versions 0.73.0, 0.71.0, and 0.69.0 — the results are the same (the CVE is missing in all of them).

Could you please confirm whether this is expected behavior or a regression?

Thank you.

p.s.
This is similar to #10853, but I didn't use a POM – I downloaded the whole JAR to my desktop

Desired Behavior

CVE-2026-34487 in Tomcat Embed Core 10.1.42 should be included in Trivy reports.

Actual Behavior

CVE-2026-34487 for tomcat-embed-core:10.1.42 is not included in Trivy reports.

Reproduction Steps

1. download artifact from https://mvnrepository.com/artifact/org.apache.tomcat.embed/tomcat-embed-core/10.1.42
2. start scan with rootfs (i've used .\trivy.exe rootfs .\Scan\)
3. get results

Target

Filesystem

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Debug Output

PS C:\work\dist\trivy71.0> .\trivy.exe rootfs .\Scan\
2026-08-11T16:29:09+07:00       INFO    [vulndb] Need to update DB
2026-08-11T16:29:09+07:00       INFO    [vulndb] Downloading vulnerability DB...
2026-08-11T16:29:09+07:00       INFO    [vulndb] Downloading artifact...        repo="mirror.gcr.io/aquasec/trivy-db:2"
104.02 MiB / 104.02 MiB [--------------------------------------------------------------------] 100.00% 6.41 MiB p/s 16s
2026-08-11T16:29:29+07:00       INFO    [vulndb] Artifact successfully downloaded       repo="mirror.gcr.io/aquasec/trivy-db:2"
2026-08-11T16:29:29+07:00       INFO    [vuln] Vulnerability scanning is enabled
2026-08-11T16:29:29+07:00       INFO    [secret] Secret scanning is enabled
2026-08-11T16:29:29+07:00       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-08-11T16:29:29+07:00       INFO    [secret] Please see https://trivy.dev/docs/v0.71/guide/scanner/secret#recommendation for faster secret detection
2026-08-11T16:29:29+07:00       INFO    [javadb] Downloading Java DB...
2026-08-11T16:29:29+07:00       INFO    [javadb] Downloading artifact...        repo="mirror.gcr.io/aquasec/trivy-java-db:1"
904.66 MiB / 904.66 MiB [------------------------------------------------------------------] 100.00% 6.63 MiB p/s 2m17s
2026-08-11T16:31:47+07:00       INFO    [javadb] Artifact successfully downloaded       repo="mirror.gcr.io/aquasec/trivy-java-db:1"
2026-08-11T16:31:47+07:00       INFO    [javadb] Java DB is cached for 3 days. If you want to update the database more frequently, "trivy clean --java-db" command clears the DB cache.
2026-08-11T16:31:47+07:00       INFO    Number of language-specific files       num=1
2026-08-11T16:31:47+07:00       INFO    [jar] Detecting vulnerabilities...
2026-08-11T16:31:47+07:00       INFO    Table result includes only package filenames. Use '--format json' option to get the full path to the package file.

Report Summary

┌───────────────────────────────┬──────┬─────────────────┬─────────┐
│            Target             │ Type │ Vulnerabilities │ Secrets │
├───────────────────────────────┼──────┼─────────────────┼─────────┤
│ tomcat-embed-core-10.1.42.jar │ jar  │       18        │    -    │
└───────────────────────────────┴──────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


Java (jar)
==========
Total: 18 (UNKNOWN: 0, LOW: 3, MEDIUM: 2, HIGH: 10, CRITICAL: 3)

┌───────────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────────────────┬──────────────────────────────────────────────────────────────┐
│                  Library                  │ Vulnerability  │ Severity │ Status │ Installed Version │       Fixed Version       │                            Title                             │
├───────────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────────────────┼──────────────────────────────────────────────────────────────┤
│ org.apache.tomcat.embed:tomcat-embed-core │ CVE-2026-41293 │ CRITICAL │ fixed  │ 10.1.42           │ 9.0.118, 10.1.55, 11.0.22 │ tomcat-coyote: Apache Tomcat: HTTP/2 request headers not     │
│ (tomcat-embed-core-10.1.42.jar)           │                │          │        │                   │                           │ validated                                                    │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-41293                   │
│                                           ├────────────────┤          │        │                   │                           ├──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2026-43512 │          │        │                   │                           │ tomcat-coyote: Apache Tomcat: Authentication bypass via      │
│                                           │                │          │        │                   │                           │ digest authentication                                        │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-43512                   │
│                                           ├────────────────┤          │        │                   │                           ├──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2026-43515 │          │        │                   │                           │ tomcat-coyote: tomcat: Improper Authorization allows         │
│                                           │                │          │        │                   │                           │ security bypass                                              │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-43515                   │
│                                           ├────────────────┼──────────┤        │                   ├───────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2025-48989 │ HIGH     │        │                   │ 11.0.10, 10.1.44, 9.0.108 │ tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2      │
│                                           │                │          │        │                   │                           │ control frames                                               │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2025-48989                   │
│                                           ├────────────────┤          │        │                   ├───────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2025-52520 │          │        │                   │ 11.0.9, 10.1.43, 9.0.107  │ tomcat: Apache Tomcat denial of service                      │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2025-52520                   │
│                                           ├────────────────┤          │        │                   ├───────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2025-53506 │          │        │                   │ 9.0.107, 10.1.43, 11.0.9  │ tomcat: Apache Tomcat denial of service                      │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2025-53506                   │
│                                           ├────────────────┤          │        │                   ├───────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2025-55752 │          │        │                   │ 11.0.11, 10.1.45, 9.0.109 │ tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat:    │
│                                           │                │          │        │                   │                           │ Directory traversal via rewrite with possible RCE            │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2025-55752                   │
│                                           ├────────────────┤          │        │                   ├───────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2026-24734 │          │        │                   │ 11.0.18, 10.1.52, 9.0.115 │ tomcat: Apache Tomcat: Certificate revocation bypass due to  │
│                                           │                │          │        │                   │                           │ improper OCSP response validation...                         │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-24734                   │
│                                           ├────────────────┤          │        │                   ├───────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2026-24880 │          │        │                   │ 9.0.116, 10.1.52, 11.0.20 │ Apache Tomcat: Apache Tomcat: HTTP Request/Response          │
│                                           │                │          │        │                   │                           │ Smuggling via invalid chunk extension                        │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-24880                   │
│                                           ├────────────────┤          │        │                   ├───────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2026-34483 │          │        │                   │ 9.0.116, 10.1.54, 11.0.21 │ Apache Tomcat: Apache Tomcat: Information disclosure due to  │
│                                           │                │          │        │                   │                           │ improper encoding in JsonAccessLogValve...                   │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-34483                   │
│                                           ├────────────────┤          │        │                   ├───────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2026-41284 │          │        │                   │ 9.0.118, 10.1.55, 11.0.22 │ tomcat: Apache Tomcat: Denial of Service due to uncontrolled │
│                                           │                │          │        │                   │                           │ resource allocation                                          │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-41284                   │
│                                           ├────────────────┤          │        │                   │                           ├──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2026-42498 │          │        │                   │                           │ tomcat-coyote: Apache Tomcat: Information disclosure due to  │
│                                           │                │          │        │                   │                           │ HTTP Authentication Header exposure during...                │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-42498                   │
│                                           ├────────────────┤          │        │                   │                           ├──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2026-43513 │          │        │                   │                           │ tomcat-catalina: Apache Tomcat: Improper Handling of Case    │
│                                           │                │          │        │                   │                           │ Sensitivity in LockOutRealm                                  │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-43513                   │
│                                           ├────────────────┼──────────┤        │                   ├───────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2025-66614 │ MEDIUM   │        │                   │ 11.0.15, 10.1.50, 9.0.113 │ tomcat: Client certificate verification bypass due to        │
│                                           │                │          │        │                   │                           │ virtual host mapping                                         │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2025-66614                   │
│                                           ├────────────────┤          │        │                   ├───────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2026-25854 │          │        │                   │ 9.0.116, 10.1.53, 11.0.20 │ Apache Tomcat: Apache Tomcat: Open Redirect vulnerability    │
│                                           │                │          │        │                   │                           │ via LoadBalancerDrainingValve                                │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-25854                   │
│                                           ├────────────────┼──────────┤        │                   ├───────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2025-55754 │ LOW      │        │                   │ 11.0.11, 10.1.45, 9.0.109 │ org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat:        │
│                                           │                │          │        │                   │                           │ console manipulation                                         │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2025-55754                   │
│                                           ├────────────────┤          │        │                   ├───────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2025-61795 │          │        │                   │ 11.0.12, 10.1.47, 9.0.110 │ tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat:    │
│                                           │                │          │        │                   │                           │ Denial of service                                            │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2025-61795                   │
│                                           ├────────────────┤          │        │                   ├───────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                           │ CVE-2026-43514 │          │        │                   │ 9.0.118, 10.1.55, 11.0.22 │ tomcat-coyote: Apache Tomcat: Information disclosure via AJP │
│                                           │                │          │        │                   │                           │ secret timing discrepancy                                    │
│                                           │                │          │        │                   │                           │ https://avd.aquasec.com/nvd/cve-2026-43514                   │
└───────────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────────────────┴──────────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.73.0 of Trivy is now available, current version is 0.71.0

To suppress version checks, run Trivy scans with the --skip-version-check flag

Operating System

windows 10

Version

PS C:\work\dist\trivy71.0> .\trivy.exe --version
Version: 0.71.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2026-08-11 07:08:26.605319766 +0000 UTC
  NextUpdate: 2026-08-12 07:08:26.605319446 +0000 UTC
  DownloadedAt: 2026-08-11 09:29:29.2431559 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2026-08-11 01:11:13.275587519 +0000 UTC
  NextUpdate: 2026-08-14 01:11:13.275587339 +0000 UTC
  DownloadedAt: 2026-08-11 09:31:47.3958217 +0000 UTC
Check Bundle:
  Digest: sha256:ff1f8aeb19a802446ed4125bd084f2d6f50ad6800328fee24a4bc2f5a03c23c1
  DownloadedAt: 2026-03-12 03:27:03.1424975 +0000 UTC
PS C:\work\dist\trivy71.0>

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @antonbombov
Thanks for your report.

This jar is correctly detected as org.apache.tomcat.embed/tomcat-embed-core@10.1.42, but the tomcat-embed-core package isn't listed in the advisory. The GitHub advisory (which is exactly what we use for Java — https://trivy.dev/docs/latest/guide/scanner/vulnerability/#langpkg-data-sources) doesn't contain this package (only org.apache.tomcat:tomcat and org.apache.tomcat:tomcat-tribes).

If you're sure the package is vulnerable, please suggest changes at this link — https://github.com/advisories/GHSA-x4m4-345f-5h5g/improve

Regards, Dmitriy

[antonbombov]

@DmitriyLewen

Thanks a lot for the link and the explanation!