CVE-2021-25122
High · 7.5CVSS
7.5
EPSS
18.1%
Published
Mar 1, 2021
CISA due date
—
The record
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.0.0 | 10.0.2 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 8.5.0 | 8.5.63 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.0 | 9.0.43 |
| Bitnami | tomcat | 8.5.0 | 8.5.61 |
| Bitnami | tomcat | 8.5.0 | 8.5.62 |
| Chainguard | spark-3.5.0-compat | 0 | 3.5.0-r2 |
| Debian:10 | tomcat9 | 0 | 9.0.31-1~deb10u4 |
| Debian:11 | tomcat9 | 0 | 9.0.43-1 |
| Debian:12 | tomcat9 | 0 | 9.0.43-1 |
| Debian:13 | tomcat9 | 0 | 9.0.43-1 |
| Debian:9 | tomcat8 | 0 | 8.5.54-0+deb9u6 |
| Mageia:8 | tomcat | 0 | 9.0.41-1.2.mga8 |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-ecj | 0 | 0:4.12.0-3.redhat_2.2.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-mod_cluster | 0 | 0:1.4.3-2.Final_redhat_00002.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-mod_cluster-tomcat | 0 | 0:1.4.3-2.Final_redhat_00002.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat | 0 | 0:9.0.43-11.redhat_00011.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-admin-webapps | 0 | 0:9.0.43-11.redhat_00011.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-docs-webapp | 0 | 0:9.0.43-11.redhat_00011.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-el-3.0-api | 0 | 0:9.0.43-11.redhat_00011.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-java-jdk11 | 0 | 0:9.0.43-11.redhat_00011.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-java-jdk8 | 0 | 0:9.0.43-11.redhat_00011.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-javadoc | 0 | 0:9.0.43-11.redhat_00011.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-jsp-2.3-api | 0 | 0:9.0.43-11.redhat_00011.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-lib | 0 | 0:9.0.43-11.redhat_00011.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-native | 0 | 0:1.2.26-3.redhat_3.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-native-debuginfo | 0 | 0:1.2.26-3.redhat_3.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-selinux | 0 | 0:9.0.43-11.redhat_00011.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-servlet-4.0-api | 0 | 0:9.0.43-11.redhat_00011.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-vault | 0 | 0:1.1.8-2.Final_redhat_00003.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-vault-javadoc | 0 | 0:1.1.8-2.Final_redhat_00003.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el7 | jws5-tomcat-webapps | 0 | 0:9.0.43-11.redhat_00011.1.el7jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-ecj | 0 | 0:4.12.0-3.redhat_2.2.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-mod_cluster | 0 | 0:1.4.3-2.Final_redhat_00002.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-mod_cluster-tomcat | 0 | 0:1.4.3-2.Final_redhat_00002.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat | 0 | 0:9.0.43-11.redhat_00011.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat-admin-webapps | 0 | 0:9.0.43-11.redhat_00011.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat-docs-webapp | 0 | 0:9.0.43-11.redhat_00011.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat-el-3.0-api | 0 | 0:9.0.43-11.redhat_00011.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat-javadoc | 0 | 0:9.0.43-11.redhat_00011.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat-jsp-2.3-api | 0 | 0:9.0.43-11.redhat_00011.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat-lib | 0 | 0:9.0.43-11.redhat_00011.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat-native | 0 | 0:1.2.26-3.redhat_3.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat-native-debuginfo | 0 | 0:1.2.26-3.redhat_3.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat-selinux | 0 | 0:9.0.43-11.redhat_00011.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat-servlet-4.0-api | 0 | 0:9.0.43-11.redhat_00011.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat-vault | 0 | 0:1.1.8-2.Final_redhat_00003.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat-vault-javadoc | 0 | 0:1.1.8-2.Final_redhat_00003.1.el8jws |
| Red Hat:jboss_enterprise_web_server:5.5::el8 | jws5-tomcat-webapps | 0 | 0:9.0.43-11.redhat_00011.1.el8jws |
| SUSE:Enterprise Storage 6 | tomcat | 0 | 9.0.36-4.58.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | tomcat | 0 | 9.0.36-4.58.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | tomcat | 0 | 9.0.36-4.58.1 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | tomcat | 0 | 9.0.36-3.79.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | tomcat | 0 | 9.0.36-3.79.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP2 | tomcat | 0 | 9.0.36-3.24.1 |
| SUSE:Linux Enterprise Server 12 SP4-LTSS | tomcat | 0 | 9.0.36-3.64.1 |
| SUSE:Linux Enterprise Server 12 SP5 | tomcat | 0 | 9.0.36-3.64.1 |
| SUSE:Linux Enterprise Server 15 SP1-BCL | tomcat | 0 | 9.0.36-4.58.1 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | tomcat | 0 | 9.0.36-4.58.1 |
| SUSE:Linux Enterprise Server 15-LTSS | tomcat | 0 | 9.0.36-3.79.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | tomcat | 0 | 9.0.36-3.64.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | tomcat | 0 | 9.0.36-3.64.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | tomcat | 0 | 9.0.36-3.79.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | tomcat | 0 | 9.0.36-4.58.1 |
| SUSE:Manager Proxy 4.0 | tomcat | 0 | 9.0.36-4.58.1 |
| SUSE:Manager Retail Branch Server 4.0 | tomcat | 0 | 9.0.36-4.58.1 |
| SUSE:Manager Server 4.0 | tomcat | 0 | 9.0.36-4.58.1 |
| SUSE:OpenStack Cloud 9 | tomcat | 0 | 9.0.36-3.64.1 |
| SUSE:OpenStack Cloud Crowbar 9 | tomcat | 0 | 9.0.36-3.64.1 |
| Ubuntu:18.04:LTS | tomcat9 | 0 | 9.0.16-3ubuntu0.18.04.2 |
| Ubuntu:20.04:LTS | tomcat9 | 0 | 9.0.31-1ubuntu0.2 |
| Ubuntu:20.04:LTS | tomcat9 | 0 | 9.0.31-1ubuntu0.6 |
| Ubuntu:22.04:LTS | tomcat9 | 0 | No fix |
| Ubuntu:22.04:LTS | tomcat9 | 0 | 9.0.43-3 |
| Ubuntu:24.04:LTS | tomcat9 | 0 | No fix |
| Ubuntu:24.04:LTS | tomcat9 | 0 | 9.0.70-1ubuntu1 |
| Ubuntu:Pro:14.04:LTS | tomcat6 | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | tomcat7 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | tomcat6 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | tomcat7 | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | tomcat8 | 0 | 8.0.32-1ubuntu1.13+esm1 |
| Ubuntu:Pro:18.04:LTS | tomcat7 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | tomcat8 | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | tomcat8 | 0 | 8.5.39-1ubuntu1~18.04.3+esm2 |
| Ubuntu:Pro:18.04:LTS | tomcat9 | 0 | 9.0.16-3ubuntu0.18.04.2+esm2 |
| Ubuntu:Pro:22.04:LTS | tomcat9 | 0 | 9.0.58-1ubuntu0.1+esm2 |
| maven | org.apache.tomcat.embed/tomcat-embed-core | 10.0.0 | 10.0.2 |
| maven | org.apache.tomcat.embed/tomcat-embed-core | 8.5.0 | 8.5.62 |
| maven | org.apache.tomcat.embed/tomcat-embed-core | 9.0.0 | 9.0.42 |
| openSUSE:Leap 15.2 | tomcat | 0 | 9.0.36-lp152.2.22.1 |
| openSUSE:Tumbleweed | tomcat | 0 | 9.0.36-8.4 |
| openSUSE:Tumbleweed | tomcat10 | 0 | 10.1.14-1.1 |
Related vulnerabilities
- CVE-2026-24733 Improper Input Validation vulnerability in Apache Tomcat. Also affects org.apache.tomcat.embed:tomcat-embed-core
- CVE-2025-66614 Improper Input Validation vulnerability. Also affects org.apache.tomcat.embed:tomcat-embed-core
- CVE-2025-61795 Improper Resource Shutdown or Release vulnerability in Apache Tomcat. Also affects org.apache.tomcat.embed:tomcat-embed-core
- CVE-2025-55752 Relative Path Traversal vulnerability in Apache Tomcat. Also affects org.apache.tomcat.embed:tomcat-embed-core
- CVE-2025-55754 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache… Also affects org.apache.tomcat.embed:tomcat-embed-core
- CVE-2025-48989 Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat… Also affects org.apache.tomcat.embed:tomcat-embed-core
- CVE-2025-49124 Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. Also affects org.apache.tomcat.embed:tomcat-embed-core
- CVE-2025-48988 Apache Tomcat - DoS in multipart upload Also affects org.apache.tomcat.embed:tomcat-embed-core