CVE-2021-25122

7.5 highEPSS 18%

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

CVSS 3.1: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 18% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-25)
CWE: CWE-200
Published: 2021-03-01
Modified: 2026-10-08
Record from: the NVD, synced 2026-10-19

Affected

apache:tomcat
debian:debian_linux
oracle:agile_product_lifecycle_management
oracle:communications_cloud_native_core_policy
oracle:communications_cloud_native_core_security_edge_protection_proxy
oracle:communications_instant_messaging_server
oracle:database
oracle:graph_server_and_client
oracle:instantis_enterprisetrack
oracle:managed_file_transfer
oracle:mysql_enterprise_monitor
oracle:siebel_ui_framework

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-j39c-c8hj-x4j3	Maven	org.apache.tomcat.embed:tomcat-embed-core	>=10.0.0-M1 <10.0.2	10.0.2
GHSA-j39c-c8hj-x4j3	Maven	org.apache.tomcat.embed:tomcat-embed-core	>=9.0.0-M1 <9.0.43	9.0.43
GHSA-j39c-c8hj-x4j3	Maven	org.apache.tomcat.embed:tomcat-embed-core	>=8.5.0 <8.5.63	8.5.63
GHSA-j39c-c8hj-x4j3	Maven	org.apache.tomcat:tomcat-coyote	>=10.0.0-M1 <10.0.2	10.0.2

References

Check your stack JSON