Description
Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | tomcat6 | 6.0.35-1+squeeze2 | DSA-2401-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 1 | tomcat6 +9 | 6.0.32-24_patch_07.ep5.el5 | RHSA-2012:0682 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 6.0.30, < 6.0.35 | 6.0.35 | GHSA-rp8h-vr48-4j8p |
| Maven | org.apache.tomcat:tomcat | >= 7.0, < 7.0.22 | 7.0.22 | GHSA-rp8h-vr48-4j8p |
Advisories 2
- RHSA-2012:0682 Red Hat Security Advisory: tomcat6 security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-2401-1 tomcat6 - several Debian Security (DSA / DLA) · Mar 9, 2026