CVE-2021-25122
Apache Tomcat h2c request mix-up
HIGH
7.5
CVSS Score
Published: March 1, 2021 at 12:00 PM UTC
Updated: October 8, 2026 at 10:17 PM UTC
12 products affected across 3 vendorsDebian LinuxDatabase ServerTomcat
Using Apache Tomcat by Apache Software Foundation?
Get instant alerts when new vulnerabilities affect Apache Tomcat - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 18%
SSVC
No known exploit
Description
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
8.5.0 ≤ v ≤ 8.5.619.0.0 ≤ v ≤ 9.0.41Apache Tomcat 10 ≤ v < 10.0.2Apache Tomcat 8.5 ≤ v < 8.5.62Apache Tomcat 9 ≤ v < 9.0.42*10.0.010.0.0 milestone110.0.0 milestone1010.0.0 milestone210.0.0 milestone310.0.0 milestone410.0.0 milestone510.0.0 milestone610.0.0 milestone710.0.0 milestone810.0.0 milestone98.59.0.09.0.0 milestone19.0.0 milestone109.0.0 milestone119.0.0 milestone129.0.0 milestone139.0.0 milestone149.0.0 milestone159.0.0 milestone169.0.0 milestone179.0.0 milestone189.0.0 milestone199.0.0 milestone29.0.0 milestone209.0.0 milestone219.0.0 milestone229.0.0 milestone239.0.0 milestone249.0.0 milestone259.0.0 milestone269.0.0 milestone279.0.0 milestone39.0.0 milestone49.0.0 milestone5Apache Tomcat 10Apache Tomcat 8.5Apache Tomcat 9
Affected range stops below 10.0.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 8.5.62, so it looks safe — our inference, not a vendor statement
Affected range stops below 9.0.42, so it looks safe — our inference, not a vendor statement
Debian Linux· Debiandrupal
95%Affected range stops below 21.3.0, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
- https://security.gentoo.org/glsa/202208-34
- https://www.debian.org/security/2021/dsa-4891
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
References (15)
Mailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
http://www.openwall.com/lists/oss-security/2021/03/01/1Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.apache.org%3Ex_refsource_MISCMailing Listx_refsource_MLISTVendor Advisory
Source: [email protected]
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cdev.tomcat.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cusers.tomcat.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b%40%3Cusers.tomcat.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947%40%3Cusers.tomcat.apache.org%3EMailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3ESSVC — Action Prioritization
SSVCNo known exploitAutomatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- NONE
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-200
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card