CVE-2021-25122
Apache Tomcat h2c request mix-up
- State
- Published
- Severity
- Not scored
- Published
- Mar 1, 2021
- Updated
- Oct 8, 2026
- Reserved
- Jan 14, 2021
Description
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Scores
The record has no CVSS score.
Weaknesses
- CWE-200 Information Exposure
Affected Products
| Product | Versions |
|---|---|
Apache TomcatApache Software Foundation |
|
References
- https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E
- [tomcat-users] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-upmailing-list
- [tomcat-dev] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-upmailing-list
- [tomcat-dev] 20210301 svn commit: r1887027 - in /tomcat/site/trunk: docs/security-10.html docs/security-7.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-7.xml xdocs/security-8.xml xdocs/security-9.xmlmailing-list
- [announce] 20210301 [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-upmailing-list
- [oss-security] 20210301 CVE-2021-25122: Apache Tomcat h2c request mix-upmailing-list
- [tomcat-users] 20210305 RE: [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-upmailing-list
- [tomcat-users] 20210305 Re: [SECURITY] CVE-2021-25122 Apache Tomcat h2c request mix-upmailing-list
- [debian-lts-announce] 20210316 [SECURITY] [DLA 2596-1] tomcat8 security updatemailing-list
- DSA-4891vendor-advisory
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://security.netapp.com/advisory/ntap-20210409-0002/
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- GLSA-202208-34vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.