High · published March 1, 2021
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
| Product | Versions | Fixed in |
|---|---|---|
| apache/tomcat | ≥ 8.5.0, ≤ 8.5.61 | — |
| apache/tomcat | ≥ 9.0.0, ≤ 9.0.41 | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| apache/tomcat | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| oracle/communications_instant_messaging_server | all versions | — |
| oracle/database | all versions | — |
| oracle/database | all versions | — |
| oracle/database | all versions | — |
| oracle/graph_server_and_client | < 21.3.0 | 21.3.0 |
| oracle/graph_server_and_client | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/managed_file_transfer | all versions | — |
| oracle/managed_file_transfer | all versions | — |
| oracle/mysql_enterprise_monitor | ≤ 8.0.23 | — |
| oracle/siebel_ui_framework | ≤ 21.9 | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/agile_product_lifecycle_management | all versions | — |
| oracle/communications_cloud_native_core_policy | all versions | — |
| oracle/communications_cloud_native_core_security_edge_protection_proxy | all versions | — |