| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-websocket | ≥ 10.0.0-M1, < 10.0.0-M7≥ 7.0.27, < 7.0.105≥ 8.5.0, < 8.5.57≥ 9.0.0.M1, < 9.0.37 | 10.0.0-M77.0.1058.5.579.0.37 |
| org.apache.tomcat:tomcat | ≥ 10.0.0-M1, < 10.0.0-M7≥ 7.0.27, < 7.0.105≥ 8.5.0, < 8.5.57≥ 9.0.0.M1, < 9.0.37 | 10.0.0-M77.0.1058.5.579.0.37 |
| org.apache.tomcat:tomcat-websocket | ≥ 10.0.0-M1, < 10.0.0-M7≥ 7.0.27, < 7.0.105≥ 8.5.0, < 8.5.57≥ 9.0.0.M1, < 9.0.37 | 10.0.0-M77.0.1058.5.579.0.37 |
| tomcat | = 10.0.0= 9.0.0≥ 7.0.27, ≤ 7.0.104≥ 8.5.0, ≤ 8.5.56≥ 9.0.1, ≤ 9.0.36 | |
| epolicy orchestrator | = 5.10.0= 5.9.0= 5.9.1 | |
| oncommand system manager | ≥ 3.0.0, ≤ 3.1.3 | |
| agile engineering data management | = 6.2.1.0 | |
| agile product lifecycle management | = 9.3.3= 9.3.5= 9.3.6 | |
| blockchain platform | < 21.1.2 | 21.1.2 |
| commerce guided search | = 11.3.2 | |
| communications cloud native core policy | = 1.14.0 | |
| communications instant messaging server | = 10.0.1.5.0 | |
| fmw platform | = 12.2.1.3.0= 12.2.1.4.0 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| managed file transfer | = 12.2.1.3.0= 12.2.1.4.0 | |
| mysql enterprise monitor | ≤ 8.0.21 | |
| siebel ui framework | ≤ 20.12 | |
| workload manager | = 12.2.0.1= 18c= 19c |
The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free