Improper encoding or escaping of JSON access logs in the JsonAccessLogValve component of Apache Tomcat allows attackers to inject malicious payloads into log entries. Because the log output is not sanitized, crafted HTTP requests can produce log entries containing hidden or false data, potentially leading to information disclosure and making it difficult to detect real log entries. The flaw aligns with CWE‑116, where unchecked output is written without proper encoding.

Affected products are Apache Tomcat versions 9.0.40 through 9.0.116, 10.1.0‑M1 through 10.1.53, and 11.0.0‑M1 through 11.0.20. All these releases are part of the Apache Software Foundation’s Tomcat distribution. Users of these versions are advised to upgrade to 9.0.117, 10.1.54, or 11.0.21, which contain the fix.

The CVSS score is not provided, and the EPSS score is unknown, and the vulnerability is not listed in the KEV catalog. Based on the description, the likely attack vector is through HTTP traffic that the server logs; an adversary can send requests that are logged with malicious content to corrupt the log file or reveal sensitive information. The overall risk is moderate but could aid in covert operations by tampering logs; therefore, patching is recommended.