The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-jsvcUpgrade tomcat-javadocUpgrade tomcat-jsp-2.3-api | Sep 28, 2023 | Oct 12, 2020 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 10.0.0Upgrade Apache Tomcat to 9.0.38Upgrade Apache Tomcat to 8.5.58Upgrade Apache Tomcat to the latest available version | Oct 13, 2020 | Oct 12, 2020 |
| Debian | — | Upgrade tomcat9 | Oct 15, 2020 | Oct 12, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webapps | Nov 3, 2020 | Oct 12, 2020 |
| Oracle Missing Cpu Apr 2021 | — | Apply the April 2021 Critical Patch Update (CPU) for Oracle Database | Sep 1, 2026 | Oct 12, 2020 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat-8 to version 8.5.60-11.4.29.0.1.82.2 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-examples to version 8.5.60-11.4.29.0.1.82.2 on Solaris 11.4Upgrade web/java-servlet/tomcat-8/tomcat-admin to version 8.5.60-11.4.29.0.1.82.2 on Solaris 11.4 | Jan 19, 2021 | Oct 12, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 12, 2020 |
| Suse | — | Upgrade tomcat-docs-webappUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-javadocUpgrade tomcatUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-embedUpgrade tomcat-jsvcUpgrade tomcat-libUpgrade tomcat-el-3_0-api | Jan 8, 2021 | Oct 12, 2020 |
| Ubuntu | — | Upgrade tomcat9Upgrade tomcat9-commonUpgrade libtomcat9-embed-javaUpgrade libtomcat9-java | Apr 1, 2022 | Oct 12, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 12, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub