If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed

Summary

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.

Timeline

1. Aug 2, 2018, 2:00 PM UTCCVE published
2. Sep 16, 2024, 5:07 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Tomcat

  9.0.0.M9 to 9.0.9, 8.5.5 to 8.5.31

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 9.0.0.M9 · fixed in 9.0.10

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 8.5.5 · fixed in 8.5.32

References 25