| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | ≥ 10.1.0-M1, < 10.1.14≥ 11.0.0-M1, < 11.0.0-M12≥ 8.5.0, < 8.5.94≥ 9.0.0-M1, < 9.0.81 | 10.1.1411.0.0-M128.5.949.0.81 |
| org.apache.tomcat:tomcat | ≥ 10.1.0-M1, < 10.1.14≥ 11.0.0-M1, < 11.0.0-M12≥ 8.5.0, < 8.5.94≥ 9.0.0-M1, < 9.0.81 | 10.1.1411.0.0-M128.5.949.0.81 |
| org.apache.tomcat:tomcat-catalina | ≥ 10.1.0-M1, < 10.1.14≥ 11.0.0-M1, < 11.0.0-M12≥ 8.5.0, < 8.5.94≥ 9.0.0-M1, < 9.0.81 | 10.1.1411.0.0-M128.5.949.0.81 |
| org.apache.tomcat:tomcat-util | ≥ 10.1.0-M1, < 10.1.14≥ 11.0.0-M1, < 11.0.0-M12≥ 8.5.0, < 8.5.94≥ 9.0.0-M1, < 9.0.81 | 10.1.1411.0.0-M128.5.949.0.81 |
| tomcat | = 10.1.0= 11.0.0= 9.0.0≥ 10.1.1, < 10.1.14≥ 8.5.0, < 8.5.94≥ 9.0.1, < 9.0.81 | 10.1.148.5.949.0.81 |
Incomplete Cleanup vulnerability in Apache Tomcat.
When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next. Older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fixes the issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free