CVE-2021-25122: Apache Tomcat h2c request mix-up
A flaw was found in Apache Tomcat. When responding to new h2c connection requests, Apache Tomcat could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request. The highest threat from this vulnerability is to data confidentiality.
Other sources
Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by a flaw when responding to new h2c connection requests. By sending a specially-crafted request, an attacker could exploit this vulnerability to see the request body information from one request to another, and use this information to launch further attacks against the affected system.
— IBM
When responding to new h2c connection requests, Apache Tomcat could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Upstream commits: Tomcat 10.0: https://github.com/apache/tomcat/commit/dd757c0a893e2e35f8bc1385d6967221ae8b9b9b Tomcat 9.0: https://github.com/apache/tomcat/commit/d47c20a776e8919eaca8da9390a32bc8bf8210b1 Tomcat 8.5: https://github.com/apache/tomcat/commit/bb0e7c1e0d737a0de7d794572517bce0e91d30fa
Reference: http://mail-archives.apache.org/modmbox/tomcat-announce/202103.mbox/%3Cb7626398-5e6d-1639-4e9e-e41b34af84de%40apache.org%3E
— Red Hat
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-25122?
The severity of CVE-2021-25122 is high.
Which versions of Apache Tomcat are affected by CVE-2021-25122?
Apache Tomcat versions 10.0.0-M1 to 10.0.0 and 9.0.0.M1 to 9.0.43 are affected by CVE-2021-25122.
How does CVE-2021-25122 affect Apache Tomcat?
CVE-2021-25122 allows user A and user B to see the results of user A's request due to duplicate request headers and a limited amount of request body.
What is the remedy for CVE-2021-25122 in Apache Tomcat 10.0.2?
The remedy for CVE-2021-25122 in Apache Tomcat 10.0.2 is to update to version 10.0.3.
Where can I find more information about CVE-2021-25122?
You can find more information about CVE-2021-25122 at the following references: [link1], [link2], [link3].