Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-libUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-admin-webapps | Jan 18, 2024 | Oct 10, 2023 |
| Amazon Linux Ami 2 | — | Upgrade tomcatUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-javadocUpgrade tomcat-jsvcUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-el-2.2-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-libUpgrade tomcat-admin-webapps | Oct 18, 2023 | Oct 10, 2023 |
| Amazon_linux | — | Upgrade tomcat8 | Oct 19, 2023 | Oct 10, 2023 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 9.0.81Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 8.5.94Upgrade Apache Tomcat to 10.1.14Upgrade Apache Tomcat to 11.0.0 | Oct 11, 2023 | Oct 10, 2023 |
| Centos_linux | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-el-3.0-api | Jan 11, 2024 | Oct 10, 2023 |
| Debian | — | Upgrade tomcat10Upgrade tomcat9 | Oct 12, 2023 | Oct 10, 2023 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jan 17, 2024 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tomcat-el-2.2-apiUpgrade tomcat-libUpgrade tomcat-jsp-2.2-apiUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.0-api | Feb 12, 2024 | Oct 10, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-jsp-2.3-apiUpgrade tomcatUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-el-3.0-api | Mar 13, 2024 | Oct 10, 2023 |
| Oracle_linux | — | Upgrade tomcat-libUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcat-webapps | Jan 11, 2024 | Oct 10, 2023 |
| Redhat_linux | — | Upgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat-admin-webappsNo solution existsUpgrade tomcat-jsp-2.3-apiUpgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-docs-webapp | Jan 11, 2024 | Oct 10, 2023 |
| Suse | — | Upgrade tomcat-embedUpgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade tomcat-el-3_0-apiUpgrade tomcat-jsp-2_3-apiUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-javadocUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-lib | Nov 3, 2023 | Oct 10, 2023 |
| Ubuntu | — | Upgrade tomcat10 (Ubuntu Pro)Upgrade libtomcat8-java (Ubuntu Pro)Upgrade tomcat9 (Ubuntu Pro)Upgrade libtomcat10-java (Ubuntu Pro)Upgrade libtomcat9-java (Ubuntu Pro)Upgrade tomcat9Upgrade tomcat8 (Ubuntu Pro)Upgrade libtomcat9-java | Nov 19, 2024 | Oct 10, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub