CVE-2026-34483

What it actually does

CVE-2026-34483 is an improper output encoding/escaping flaw in Apache Tomcat's JsonAccessLogValve. When Tomcat is configured to emit access logs in JSON format using this valve, attacker-controlled request data such as the URI, query string, headers, or other logged fields may be written without sufficient JSON-safe escaping. This can corrupt JSON log structure, inject attacker-controlled fields or records, and potentially expose sensitive log content or mislead downstream log processing systems. The vulnerability is network-exploitable without authentication or user interaction when an affected Tomcat version is reachable and JsonAccessLogValve is enabled.

Why it matters to the business

Organizations using affected Apache Tomcat versions with JSON access logging may have unreliable or attacker-manipulated access logs, which can undermine monitoring, incident response, audit trails, fraud investigation, and compliance reporting. Because the CVSS score is high for confidentiality impact, the main risk is exposure or manipulation of log-derived information rather than direct code execution. The issue is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has low EPSS at 0.00461 with no public exploit maturity reported, but it has been public for 122 days, so remediation should be scheduled promptly for internet-facing or compliance-sensitive services.

How an attack unfolds

An attacker first identifies a Tomcat service and determines, directly or indirectly, that it is running an affected version and using JsonAccessLogValve. The attacker then sends crafted HTTP requests containing JSON-breaking characters or escape sequences in fields commonly written to access logs, such as the request path, query string, User-Agent, Referer, Host header, or other headers included in the configured log pattern. When the vulnerable valve writes the access log entry, the crafted content is not encoded or escaped correctly, allowing the attacker to alter the structure or meaning of the JSON log output. Downstream log collectors, SIEM pipelines, parsers, dashboards, or alerting rules that trust the JSON structure may ingest attacker-controlled records, omit fields, misattribute activity, or expose adjacent log data during parsing and processing.

How to fix it

Upgrade Apache Tomcat to a fixed release: 11.0.21 or later for the 11.x line, 10.1.54 or later for the 10.1.x line, or 9.0.117 or later for the 9.0.x line. Prioritize systems that are internet-facing, process sensitive data, forward JSON access logs to centralized platforms, or use access logs for audit/compliance purposes. If immediate upgrade is not possible, temporarily disable JsonAccessLogValve or switch to a non-vulnerable logging configuration, restrict exposure to trusted networks, reduce logging of attacker-controlled header fields where operationally acceptable, and ensure downstream log pipelines treat access log records as untrusted input. Avoid relying on downstream SIEM parsing alone as a compensating control; the vulnerable producer should be fixed.

How to confirm the fix worked

Confirm the installed Tomcat version is no longer in the affected ranges and is at least 11.0.21, 10.1.54, or 9.0.117 depending on the deployed branch. Review Tomcat configuration files such as server.xml and context-specific configuration to determine whether org.apache.catalina.valves.JsonAccessLogValve is enabled. After upgrade, send benign test requests containing JSON metacharacters and encoded control characters in the path, query string, User-Agent, and Referer, then verify that generated JSON access log entries remain valid JSON and that attacker-controlled values are properly escaped. Validate that centralized log collectors and SIEM parsers ingest the post-upgrade records without field injection, record splitting, or parsing failures. Also verify container images, bundled Tomcat distributions, and vendor-packaged applications include the fixed Tomcat version rather than only checking standalone installations.

Typical attack path

1. Discover an Apache Tomcat endpoint exposed over the network.
2. Confirm or infer that the service is within an affected Tomcat version range: 11.0.0-M1 through 11.0.20, 10.1.0-M1 through 10.1.53, or 9.0.40 through 9.0.116.
3. Determine whether JSON access logging is likely enabled, for example by observing operational behavior, error responses, exposed configuration, or prior knowledge of the deployment.
4. Send crafted HTTP requests with JSON metacharacters, quotes, backslashes, braces, carriage returns, line feeds, or encoded control characters in logged request components.
5. Cause JsonAccessLogValve to write malformed or attacker-influenced JSON access log records.
6. Rely on downstream log ingestion or analysis systems to parse the manipulated records incorrectly, potentially hiding activity, injecting misleading events, or exposing sensitive log content.

How to detect it

To determine whether exploitation may have occurred, review Tomcat access logs, reverse proxy logs, web application firewall logs, and centralized SIEM ingestion logs for requests containing JSON metacharacters, encoded quotes, backslashes, braces, carriage returns, line feeds, or Unicode control characters in the URI, query string, User-Agent, Referer, Host, or other logged headers. Correlate those requests with JSON parser errors, log-forwarder failures, dropped events, unusual field names, duplicate or impossible fields, records split across multiple lines, or sudden gaps in access-log ingestion. Inspect Tomcat configuration for JsonAccessLogValve to determine exposure during the vulnerable window. Pay special attention to activity since the issue became public and to systems running affected versions that forward JSON access logs to SIEM, data lakes, or observability platforms. Because there are no widely reported public exploit artifacts or named threat actors for this CVE, detection should focus on malformed-log attempts and downstream parsing anomalies rather than a single malware signature.

• org.apache.catalina.valves.JsonAccessLogValve
• className="org.apache.catalina.valves.JsonAccessLogValve"
• JsonAccessLogValve
• %0a
• %0A
• %0d
• %0D
• %22
• %5c
• %5C
• \u000a
• \u000d
• \u2028
• \u2029
• User-Agent: {
• User-Agent: \"
• Referer: {
• Referer: \"
• "message":"Unexpected character
• "message":"Unexpected end-of-input
• JsonParseException
• MalformedJsonException
• JSON parse error
• invalid JSON
• failed to parse json
• _jsonparsefailure

What your security team should do

• Inventory all Apache Tomcat deployments, including embedded Tomcat in vendor products and container images, and identify versions in the affected ranges.
• Prioritize upgrading internet-facing and security-monitoring-critical Tomcat services to 11.0.21, 10.1.54, or 9.0.117 or later.
• Search configurations for JsonAccessLogValve usage and apply temporary mitigation where upgrades cannot be completed immediately.
• Review access-log ingestion pipelines for parsing errors, malformed JSON records, unexpected field names, and suspicious control characters since publication.
• Treat access logs from affected systems during the exposure window as potentially attacker-manipulated when performing investigations or compliance reviews.
• Add detection content for requests containing JSON-breaking characters or encoded CR/LF sequences in logged fields, especially when followed by access-log parser failures.
• Verify third-party appliances and applications that bundle Tomcat have published fixed builds rather than assuming the platform package manager covers them.