Apache Tomcat h2c request mix-up

Summary

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

Timeline

1. Mar 1, 2021, 12:00 PM UTCCVE published
2. Oct 8, 2026, 9:04 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 8, 2026, 9:13 PM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Apache Software Foundation Apache Tomcat

  From Apache Tomcat 10 · fixed in 10.0.2; From Apache Tomcat 9 · fixed in 9.0.42; From Apache Tomcat 8.5 · fixed in 8.5.62

• tomcatBitnami

  From 8.5.0 · fixed in 8.5.62; From 9.0.0 · fixed in 9.0.42; From 10.0.0 · fixed in 10.0.1

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 10.0.0-M1 · fixed in 10.0.2

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 9.0.0-M1 · fixed in 9.0.43

• org.apache.tomcat.embed:tomcat-embed-coreMaven

  From 8.5.0 · fixed in 8.5.63

• org.apache.tomcat:tomcat-coyoteMaven

  From 10.0.0-M1 · fixed in 10.0.2

References 15