diff --git a/advisories/unreviewed/2026/07/GHSA-rpf9-hrjr-88fv/GHSA-rpf9-hrjr-88fv.json b/advisories/unreviewed/2026/07/GHSA-rpf9-hrjr-88fv/GHSA-rpf9-hrjr-88fv.json
index 9115779acd7a..eedac603d623 100644
--- a/advisories/unreviewed/2026/07/GHSA-rpf9-hrjr-88fv/GHSA-rpf9-hrjr-88fv.json
+++ b/advisories/unreviewed/2026/07/GHSA-rpf9-hrjr-88fv/GHSA-rpf9-hrjr-88fv.json
@@ -1,28 +1,54 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-rpf9-hrjr-88fv",
-  "modified": "2026-07-28T18:33:02Z",
+  "modified": "2026-07-28T18:34:07Z",
   "published": "2026-07-28T15:32:18Z",
   "aliases": [
     "CVE-2026-66299"
   ],
-  "details": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.\n\nThis issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue.\n\nUsers are recommended to remove the examples web application or to upgrade to version 11.0.25, 10.1.58 or 9.0.121 (when released), which fix the issue.",
+  "summary": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example",
+  "details": "Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example.\n\nThis issue affects Apache Tomcat from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, and from 9.0.89 through 9.0.120.\n\nThe vulnerable functionality is limited to the optional WebSocket chat example application. The presence of an affected Tomcat version alone does not establish that the vulnerable example is installed, deployed, or reachable. Users who do not deploy the `examples` web application are not affected. This includes typical embedded Tomcat applications that do not package the example application.\n\nThe Apache Tomcat Security Team rates this vulnerability **Low**.\n\nUsers should remove the examples web application or upgrade to version 11.0.25, 10.1.58, or 9.0.121 when the applicable fixed release is available.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": ""
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66299"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/tomcat/commit/4e8e3f8964e9653bab427bf794e026c69ee80f2b"
+    },
     {
       "type": "WEB",
       "url": "https://lists.apache.org/thread/8owczcc1o8qw1rxmg9gvfk4w2jnh4l5k"
     },
+    {
+      "type": "WEB",
+      "url": "https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.25"
+    },
     {
       "type": "WEB",
       "url": "http://www.openwall.com/lists/oss-security/2026/07/28/25"