Darryl, On 8/26/26 4:14 PM, Darryl Baker wrote:
I am trying to figure out when a vulnerability justifies and out of cycle update to our Tomcat installations. After determining if we are vulnerable then determining the risk but our security group focuses on the CVSS score. With the Tomcat reports not including one I have little to go by. Is there a rough mapping of your “Severity” and a range of CVSS scores? Today I need to know is “Severity: important” a high enough risk to justify an out of cycle update of our Tomcat installations?
To answer your question directly: no such mapping exists.
This is precisely because the level of severity will vary wildly between users. For example, if you don't use HTTP/2 at all than it doesn't matter if the CVSS score is a perfect-10.
The Tomcat Security Team has tried to capture the overall severity for "most users". Some security announcements represented as "Low" by the Tomcat Security Team might end up being super important for you. To take a recent example: CVE-2026-65183. If you are using UNIX domain sockets in an adversarial environment, then the fix for CVE-2026-65183 is far more important to you than the "Low" severity we have assigned. But since most users are (a) not using UNIX domain sockets and (b) aren't in adversarial environments, the Tomcat Security Team has given this CVE a "low" rating.
(After writing this and then reading Reg's reply, I find that I'm just saying the exact same thing. Hopefully, this repetition is actually helpful.)
Another way to look at this would be "how painful is it to actually do a Tomcat upgrade"? I don't know what your patch/upgrade cycles look like, but if you invest some time and energy into making Tomcat upgrades cheaper or less onerous, then maybe it doesn't matter what the CVSS scores, etc. are. Just upgrade because it's easier than fighting with your Security Overlords. :)
-chris --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
