If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum nu
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 8.5.1, 8.5.2, 8.5.3, 8.5.4, 8.5.5, and 55 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a Apache Tomcat
Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37, 8.5.0 to 8.5.57
- tomcatBitnami
From 8.5.0 · fixed in 8.5.1; From 8.5.1 · fixed in 8.5.2; From 8.5.2 · fixed in 8.5.3; From 8.5.3 · fixed in 8.5.4; From 8.5.4 · fixed in 8.5.5; From 8.5.5 · fixed in 8.5.6; From 8.5.6 · fixed in 8.5.7; From 8.5.7 · fixed in 8.5.8; From 8.5.8 · fixed in 8.5.9; From 8.5.9 · fixed in 8.5.10; From 8.5.10 · fixed in 8.5.11; From 8.5.11 · fixed in 8.5.12; From 8.5.12 · fixed in 8.5.13; From 8.5.13 · fixed in 8.5.14; From 8.5.14 · fixed in 8.5.15; From 8.5.15 · fixed in 8.5.16; From 8.5.16 · fixed in 8.5.17; From 8.5.17 · fixed in 8.5.18; From 8.5.18 · fixed in 8.5.19; From 8.5.19 · fixed in 8.5.20; From 8.5.20 · fixed in 8.5.21; From 8.5.21 · fixed in 8.5.22; From 8.5.22 · fixed in 8.5.23; From 8.5.23 · fixed in 8.5.24; From 8.5.24 · fixed in 8.5.25; From 8.5.25 · fixed in 8.5.26; From 8.5.26 · fixed in 8.5.27; From 8.5.27 · fixed in 8.5.28; From 8.5.28 · fixed in 8.5.29; From 8.5.29 · fixed in 8.5.30; From 8.5.30 · fixed in 8.5.31; From 8.5.31 · fixed in 8.5.32; From 8.5.32 · fixed in 8.5.33; From 8.5.33 · fixed in 8.5.34; From 8.5.34 · fixed in 8.5.35; From 8.5.35 · fixed in 8.5.36; From 8.5.36 · fixed in 8.5.37; From 8.5.37 · fixed in 8.5.38; From 8.5.38 · fixed in 8.5.39; From 8.5.39 · fixed in 8.5.40; From 8.5.40 · fixed in 8.5.41; From 8.5.41 · fixed in 8.5.42; From 8.5.42 · fixed in 8.5.43; From 8.5.43 · fixed in 8.5.44; From 8.5.44 · fixed in 8.5.45; From 8.5.45 · fixed in 8.5.46; From 8.5.46 · fixed in 8.5.47; From 8.5.47 · fixed in 8.5.48; From 8.5.48 · fixed in 8.5.49; From 8.5.49 · fixed in 8.5.50; From 8.5.50 · fixed in 8.5.51; From 8.5.51 · fixed in 8.5.52; From 8.5.52 · fixed in 8.5.53; From 8.5.53 · fixed in 8.5.54; From 8.5.54 · fixed in 8.5.55; From 8.5.55 · fixed in 8.5.56; From 8.5.56 · fixed in 8.5.57; From 8.5.57 · fixed in 8.5.58; From 9.0.0 · fixed in 9.0.38
- org.apache.tomcat:tomcat-coyoteMaven
From 10.0.0-M1 · fixed in 10.0.0-M8
- org.apache.tomcat:tomcat-coyoteMaven
From 9.0.0-M1 · fixed in 9.0.38
- org.apache.tomcat:tomcat-coyoteMaven
From 8.5.0 · fixed in 8.5.58