The vulnerability stems from incomplete escaping of JSON data in the JsonAccessLogValve component of Apache Tomcat. When client requests contain untrusted input that is recorded to JSON access logs, that input is written without proper encoding. An attacker could embed crafted JSON structures or script fragments that, when later viewed by an administrator or through a log‑viewer interface, may trigger cross‑site scripting, injection or even execution of code in the context of the logging application. The impact is primarily information disclosure and potential compromise of the logging platform, and potentially the web tier that displays those logs.

This flaw affects Apache Tomcat releases 9.0.40 through 9.0.116, 10.1.0‑M1 through 10.1.53, and 11.0.0‑M1 through 11.0.20. The affected component is the JsonAccessLogValve used for writing JSON‑formatted access logs.

The CVSS score of 7.5 indicates high severity. The EPSS score is below 1%, so widespread exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to send crafted requests that are logged and to subsequently gain read access to the log files or to a log‑viewing interface. For environments that expose log files to the web or rely on shared log viewer applications, the risk can be higher. Tier‑1 organizations should monitor for unusual log activity and apply the recommended patch promptly.