CVE-2023-34981: Apache Tomcat: AJP response header mix-up
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS message would be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-34981?
The severity of CVE-2023-34981 is high.
Which versions of Apache Tomcat are affected by CVE-2023-34981?
Apache Tomcat versions 8.5.88, 9.0.74, 10.1.8, and 11.0.0-M5 are affected by CVE-2023-34981.
How does CVE-2023-34981 affect Apache Tomcat?
CVE-2023-34981 in Apache Tomcat can cause a regression in the fix for bug 66512, resulting in the failure to send AJP SEND_HEADERS messages for responses without any HTTP headers.
How can I fix CVE-2023-34981 in Apache Tomcat?
To fix CVE-2023-34981, upgrade to Apache Tomcat versions 8.5.89, 9.0.75, 10.1.9, or 11.0.0-M6.
Where can I find more information about CVE-2023-34981?
You can find more information about CVE-2023-34981 at the following references: [Link 1](https://nvd.nist.gov/vuln/detail/CVE-2023-34981), [Link 2](https://lists.apache.org/thread/j1ksjh9m9gx1q60rtk1sbzmxhvj5h5qz), [Link 3](https://bz.apache.org/bugzilla/show_bug.cgi?id=66512).