When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-tomcatamazon-linux-ami-2-upgrade-tomcat-admin-webappsamazon-linux-ami-2-upgrade-tomcat-docs-webappamazon-linux-ami-2-upgrade-tomcat-el-3-0-apiamazon-linux-ami-2-upgrade-tomcat-javadocamazon-linux-ami-2-upgrade-tomcat-jsp-2-3-apiamazon-linux-ami-2-upgrade-tomcat-jsvcamazon-linux-ami-2-upgrade-tomcat-libamazon-linux-ami-2-upgrade-tomcat-servlet-3-1-apiamazon-linux-ami-2-upgrade-tomcat-webapps | Sep 28, 2023 | Mar 1, 2021 | |
| Amazon_linux | — | amazon-linux-upgrade-tomcat8 | Mar 26, 2021 | Mar 1, 2021 |
| Apache Tomcat | apache-tomcat-upgrade-8_5_63apache-tomcat-upgrade-9_0_43apache-tomcat-upgrade-10_0_2apache-tomcat-10_0apache-tomcat-8_5apache-tomcat-9_0apache-tomcat-upgrade-latest | Mar 2, 2021 | Mar 1, 2021 | |
| Debian | debian-upgrade-tomcat9 | Mar 17, 2021 | Mar 1, 2021 | |
| Gentoo Linux | gentoo-linux-upgrade-www-servers-tomcat | Aug 22, 2022 | Mar 1, 2021 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-tomcathuawei-euleros-2_0_sp8-upgrade-tomcat-admin-webappshuawei-euleros-2_0_sp8-upgrade-tomcat-el-3.0-apihuawei-euleros-2_0_sp8-upgrade-tomcat-jsp-2.3-apihuawei-euleros-2_0_sp8-upgrade-tomcat-libhuawei-euleros-2_0_sp8-upgrade-tomcat-servlet-4.0-api | May 18, 2021 | Mar 1, 2021 | |
| Oracle Missing Cpu Oct 2021 | oracle-apply-oct-2021-cpu | Jan 19, 2022 | Mar 1, 2021 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-8-5-64-11-4-32-0-1-88-2oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-admin-8-5-64-11-4-32-0-1-88-2oracle-solaris-11-4-upgrade-web-java-servlet-tomcat-8-tomcat-examples-8-5-64-11-4-32-0-1-88-2 | Apr 21, 2021 | Mar 1, 2021 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Mar 1, 2021 |
| Suse | — | suse-upgrade-tomcatsuse-upgrade-tomcat-admin-webappssuse-upgrade-tomcat-docs-webappsuse-upgrade-tomcat-el-3_0-apisuse-upgrade-tomcat-embedsuse-upgrade-tomcat-javadocsuse-upgrade-tomcat-jsp-2_3-apisuse-upgrade-tomcat-jsvcsuse-upgrade-tomcat-libsuse-upgrade-tomcat-servlet-4_0-apisuse-upgrade-tomcat-webapps | Mar 31, 2021 | Mar 1, 2021 |
| Ubuntu | ubuntu-pro-upgrade-libtomcat8-javaubuntu-pro-upgrade-libtomcat9-javaubuntu-pro-upgrade-tomcat8ubuntu-pro-upgrade-tomcat8-docsubuntu-pro-upgrade-tomcat9ubuntu-pro-upgrade-tomcat9-docsubuntu-upgrade-libtomcat9-embed-javaubuntu-upgrade-libtomcat9-javaubuntu-upgrade-tomcat9ubuntu-upgrade-tomcat9-common | Apr 1, 2022 | Mar 1, 2021 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Mar 1, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub