| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | ≥ 10.0.0-M1, < 10.0.0-M5≥ 8.5.0, < 8.5.55≥ 9.0.0.M1, < 9.0.35 | 10.0.0-M58.5.559.0.35 |
| org.apache.tomcat:tomcat | ≥ 10.0.0-M1, < 10.0.0-M5≥ 8.5.0, < 8.5.55≥ 9.0.0.M1, < 9.0.35 | 10.0.0-M58.5.559.0.35 |
| tomcat | = 10.0.0= 9.0.0≥ 8.5.0, ≤ 8.5.55≥ 9.0.0, ≤ 9.0.35 | |
| oncommand system manager | = 3.0= 3.1.3 | |
| mysql enterprise monitor | ≤ 8.0.21 | |
| siebel ui framework | ≤ 20.12 | |
| workload manager | = 12.2.0.1= 18c= 19c |
A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free