Description
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | 11.0.0-M5, 10.1.8, 9.0.74, 8.5.88 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tomcat10 | 10.1.10-1 | — |
| Debian 13 | tomcat10 | 10.1.10-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat-coyote | >= 8.5.88, < 8.5.89 | 8.5.89 | GHSA-mppv-79ch-vw6q |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 11.0.0-M5, < 11.0.0-M6 | 11.0.0-M6 | GHSA-mppv-79ch-vw6q |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 10.1.8, < 10.1.9 | 10.1.9 | GHSA-mppv-79ch-vw6q |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | >= 9.0.74, < 9.0.75 | 9.0.75 | GHSA-mppv-79ch-vw6q |
Advisories 10
- WID-SEC-2023-2031 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2023-2625 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 6, 2025
- WID-SEC-2024-1238 HPE HP-UX: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 27, 2024
- WID-SEC-2024-0892 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 16, 2024
- WID-SEC-2024-0107 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2023-1530 Apache Tomcat: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Dec 21, 2023
- WID-SEC-2023-2686 Oracle Supply Chain: Schwachstelle gefährdet Vertraulichkeit BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-2680 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-2679 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-2675 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023