Apache Tomcat^®

This page lists all security vulnerabilities fixed in released versions of Apache Tomcat^® 10.x. Each vulnerability is given a security impact rating by the Apache Tomcat security team — please note that this rating may vary from platform to platform. We also list the versions of Apache Tomcat the flaw is known to affect, and where a flaw has not been verified list the version with a question mark.

Note: Vulnerabilities that are not Tomcat vulnerabilities but have either been incorrectly reported against Tomcat or where Tomcat provides a workaround are listed at the end of this page.

Please note that Tomcat 10.0.x has reached end of life and is no longer supported. Vulnerabilities reported after 31 October 2022 were not checked against the 10.0.x branch and will not be fixed. Users should upgrade to 10.1.x or later to obtain security fixes.

Please note that binary patches are never provided. If you need to apply a source code patch, use the building instructions for the Apache Tomcat version that you are using. For Tomcat 10.0.x those are building.html and BUILDING.txt. Both files can be found in the webapps/docs subdirectory of a binary distribution. You may also want to review the Security Considerations page in the documentation.

If you need help on building or configuring Tomcat or other help on following the instructions to mitigate the known vulnerabilities listed here, please send your questions to the public Tomcat Users mailing list

If you have encountered an unlisted security vulnerability or other unexpected behaviour that has security impact, or if the descriptions here are incomplete, please report them privately to the Tomcat Security Team. Thank you.

• Fixed in Apache Tomcat 10.1.33
• Fixed in Apache Tomcat 10.1.31
• Fixed in Apache Tomcat 10.1.25
• Fixed in Apache Tomcat 10.1.19
• Fixed in Apache Tomcat 10.1.16
• Fixed in Apache Tomcat 10.1.14
• Fixed in Apache Tomcat 10.1.13
• Fixed in Apache Tomcat 10.1.9
• Fixed in Apache Tomcat 10.1.8
• Fixed in Apache Tomcat 10.1.6
• Fixed in Apache Tomcat 10.1.5
• Fixed in Apache Tomcat 10.1.2
• Fixed in Apache Tomcat 10.1.1
• Fixed in Apache Tomcat 10.0.27
• Fixed in Apache Tomcat 10.0.23
• Fixed in Apache Tomcat 10.1.0-M17
• Fixed in Apache Tomcat 10.0.21
• Fixed in Apache Tomcat 10.1.0-M15
• Fixed in Apache Tomcat 10.0.20
• Fixed in Apache Tomcat 10.1.0-M14
• Fixed in Apache Tomcat 10.0.16
• Fixed in Apache Tomcat 10.1.0-M10
• Fixed in Apache Tomcat 10.0.12
• Fixed in Apache Tomcat 10.1.0-M6
• Fixed in Apache Tomcat 10.0.7
• Fixed in Apache Tomcat 10.0.6
• Fixed in Apache Tomcat 10.0.5
• Fixed in Apache Tomcat 10.0.4
• Fixed in Apache Tomcat 10.0.2
• Fixed in Apache Tomcat 10.0.0-M10
• Fixed in Apache Tomcat 10.0.0-M8
• Fixed in Apache Tomcat 10.0.0-M7
• Fixed in Apache Tomcat 10.0.0-M6
• Fixed in Apache Tomcat 10.0.0-M5
• Not a vulnerability in Tomcat

Note: The issue below was fixed in Apache Tomcat 10.1.32 but the release vote for the 10.1.32 release candidate did not pass. Therefore, although users must download 10.1.33 to obtain a version that includes a fix for these issues, version 10.1.32 is not included in the list of affected versions.

Important: XSS in generated JSPs CVE-2024-52318

The fix for improvement 69333 caused pooled JSP tags not to be released after use which in turn could cause output of some tags not to escaped as expected. This unescaped output could lead to XSS.

This was fixed with commit be8e3214.

The issue was made public on 18 November 2024.

Affects: 10.1.31

Important: Request and/or response mix-up CVE-2024-52317

Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users.

This was fixed with commit 146f94f8.

This issue was identified by the Tomcat Security Team on 1 October 2024. The issue was made public on 18 November 2024.

Affects: 10.1.27 to 10.1.30

Low: Authentication Bypass CVE-2024-52316

If Tomcat was configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not have failed, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.

This was fixed with commit acc2f013.

This issue was identified by the Tomcat Security Team on 19 September 2024. The issue was made public on 18 November 2024.

Affects: 10.1.0-M1 to 10.1.30

Important: Denial of Service CVE-2024-34750

When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed.

This was fixed with commit 2afae300.

This issue was reported to the Tomcat Security Team on 4 May 2024. The issue was made public on 3 July 2024.

Affects: 10.1.0-M1 to 10.1.24

Important: Denial of Service CVE-2024-38286

Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.

This was fixed with commit 3344c17c.

This issue was reported to the Tomcat Security Team on 4 June 2024. The issue was made public on 23 September 2024.

Affects: 10.1.0-M1 to 10.1.24

Important: Denial of Service CVE-2024-23672

It was possible for a WebSocket client to keep a WebSocket connection open leading to increased resource consumption.

This was fixed with commit 0052b374.

This issue was identified by the Tomcat Security Team on 17 January 2024. The issue was made public on 13 March 2024.

Affects: 10.1.0-M1 to 10.1.18

Important: Denial of Service CVE-2024-24549

When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been processed.

This was fixed with commit d07c8219.

This issue was reported to the Tomcat Security Team on 24 January 2024. The issue was made public on 13 March 2024.

Affects: 10.1.0-M1 to 10.1.18

Important: Request smuggling CVE-2023-46589

Tomcat did not correctly parse HTTP trailer headers. A specially crafted trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

This was fixed with commit b5776d76.

This issue was reported to the Tomcat Security Team on 20 October 2023. The issue was made public on 28 November 2023.

Affects: 10.1.0-M1 to 10.1.15

Important: Request smuggling CVE-2023-45648

Tomcat did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

This was fixed with commit 8ecff306.

This issue was reported to the Tomcat Security Team on 12 September 2023. The issue was made public on 10 October 2023.

Affects: 10.1.0-M1 to 10.1.13

Important: Denial of Service CVE-2023-44487

Tomcat's HTTP/2 implementation was vulnerable to the rapid reset attack. The denial of service typically manifested as an OutOfMemoryError.

This was fixed with commit 76bb4bfb.

This issue was reported to the Tomcat Security Team on 14 September 2023. The issue was made public on 10 October 2023.

Affects: 10.1.0-M1 to 10.1.13

Important: Information Disclosure CVE-2023-42795

When recycling various internal objects, including the request and the response, prior to re-use by the next request/response, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next.

This was fixed with commit 9375d671.

This issue was identified by the Tomcat Security Team on 13 September 2023. The issue was made public on 10 October 2023.

Affects: 10.1.0-M1 to 10.1.13

Moderate: Open redirect CVE-2023-41080

If the ROOT (default) web application is configured to use FORM authentication then it is possible that a specially crafted URL could be used to trigger a redirect to an URL of the attackers choice.

This was fixed with commit bb4624a9.

This issue was reported to the Tomcat Security Team on 17 August 2023. The issue was made public on 22 August 2023.

Affects: 10.1.0-M1 to 10.1.12

Important: Information disclosure CVE-2023-34981

The fix for bug 66512 introduced a regression that was fixed as bug 66591. The regression meant that, if a response did not have any HTTP headers set, no AJP SEND_HEADERS message would be sent which in turn meant that at least one AJP based proxy (mod_proxy_ajp) would use the response headers from the previous request for the current request leading to an information leak.

This was fixed with commit f0742f47.

This issue was reported to the Tomcat Security Team on 24 May 2023. The issue was made public on 21 June 2023.

Affects: 10.1.8

Moderate: Apache Tomcat denial of service CVE-2023-28709

The fix for CVE-2023-24998 was incomplete. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed with the potential for a denial of service to occur.

This was fixed with commit ba848da7.

This issue was reported to the Tomcat Security Team on 13 March 2023. The issue was made public on 22 May 2023.

Affects: 10.1.5 to 10.1.7

Important: Apache Tomcat information disclosure CVE-2023-28708

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Tomcat did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.

This was fixed with commit f509bbf3.

66471 was reported publicly on 8 February 2023. The security implications were identified by the Tomcat Security team on 9 February 2023. The issue was made public on 22 March 2023.

Affects: 10.1.0-M1 to 10.1.5

Important: Apache Tomcat denial of service CVE-2023-24998

Apache Tomcat uses a packaged renamed copy of Apache Commons FileUpload to provide the file upload functionality defined in the Jakarta Servlet specification. Apache Tomcat was, therefore, also vulnerable to the Apache Commons FileUpload vulnerability CVE-2023-24998 as there was no limit to the number of request parts processed. This resulted in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.

This was fixed with commit 8a2285f1.

This issue was reported to the Apache Tomcat Security team on 11 December 2022. The issue was made public on 20 February 2023.

Affects: 10.1.0-M1 to 10.1.4

Low: Apache Tomcat JsonErrorReportValve injection CVE-2022-45143

The JsonErrorReportValve did not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.

This was fixed with commit 6a0ac6a4.

This issue was identified by the Apache Tomcat Security team on 2 September 2022. The issue was made public on 3 January 2023.

Affects: 10.1.0-M1 to 10.1.1

Low: Apache Tomcat request smuggling CVE-2022-42252

If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (not the default), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

This was fixed with commit c9fe754e.

This issue was reported to the Apache Tomcat Security team on 29 September 2022. The issue was made public on 31 October 2022.

Affects: 10.1.0-M1 to 10.1.0

Low: Apache Tomcat request smuggling CVE-2022-42252

If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (not the default), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

This was fixed with commit 0d089a15.

This issue was reported to the Apache Tomcat Security team on 29 September 2022. The issue was made public on 31 October 2022.

Affects: 10.0.0-M1 to 10.0.26

Low: Apache Tomcat XSS in examples web application CVE-2022-34305

The Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

This was fixed with commit 1a7e95d9.

This issue was reported to the Apache Tomcat Security team on 22 June 2022. The issue was made public on 23 June 2022.

Affects: 10.0.0-M1 to 10.0.22

Low: Apache Tomcat XSS in examples web application CVE-2022-34305

The Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.

This was fixed with commit d6251d1c.

This issue was reported to the Apache Tomcat Security team on 22 June 2022. The issue was made public on 23 June 2022.

Affects: 10.1.0-M1 to 10.1.0-M16

Low: Apache Tomcat EncryptInterceptor DoS CVE-2022-29885

The documentation for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

This was fixed with commit 36826ea6.

This issue was reported to the Apache Tomcat Security team by 4ra1n on 17 April 2022. The issue was made public on 10 May 2022.

Affects: 10.0.0-M1 to 10.0.20

Low: Apache Tomcat EncryptInterceptor DoS CVE-2022-29885

The documentation for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

This was fixed with commit 0fa7721f.

This issue was reported to the Apache Tomcat Security team by 4ra1n on 17 April 2022. The issue was made public on 10 May 2022.

Affects: 10.1.0-M1 to 10.1.0-M14

Note: The issue below was fixed in Apache Tomcat 10.0.19 but the release vote for the 10.0.19 release candidate did not pass. Therefore, although users must download 10.0.20 to obtain a version that includes a fix for these issues, version 10.0.19 is not included in the list of affected versions.

High: Information Disclosure CVE-2021-43980

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

This was fixed with commit 17f177ee.

This issue was reported to the Apache Tomcat Security team by Adam Thomas, Richard Hernandez and Ryan Schmitt on 11 November 2021. The issue was made public on 28 September 2022.

Affects: 10.0.0-M1 to 10.0.18

Note: The issue below was fixed in Apache Tomcat 10.1.0-M13 but the release vote for the 10.1.0-M13 release candidate did not pass. Therefore, although users must download 10.1.0-M14 to obtain a version that includes a fix for these issues, version 10.1.0-M13 is not included in the list of affected versions.

High: Information Disclosure CVE-2021-43980

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

This was fixed with commit 9651b83a.

This issue was reported to the Apache Tomcat Security team by Adam Thomas, Richard Hernandez and Ryan Schmitt on 11 November 2021. The issue was made public on 28 September 2022.

Affects: 10.1.0-M1 to 10.1.0-M12

Note: The issue below was fixed in Apache Tomcat 10.0.15 but the release vote for the 10.0.15 release candidate did not pass. Therefore, although users must download 10.0.16 to obtain a version that includes a fix for these issues, version 10.0.15 is not included in the list of affected versions.

Low: Local Privilege Escalation CVE-2022-23181

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

This was fixed with commit 094800b1.

This issue was reported to the Apache Tomcat Security team by Trung Pham of Viettel Cyber Security on 10 December 2021. The issue was made public on 26 January 2022.

Affects: 10.0.0-M5 to 10.0.14

Note: The issue below was fixed in Apache Tomcat 10.1.0-M9 but the release vote for the 10.1.0-M9 release candidate did not pass. Therefore, although users must download 10.1.0-M10 to obtain a version that includes a fix for these issues, version 10.1.0-M9 is not included in the list of affected versions.

Low: Local Privilege Escalation CVE-2022-23181

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

This was fixed with commit 70da1aaa.

This issue was reported to the Apache Tomcat Security team by Trung Pham of Viettel Cyber Security on 10 December 2021. The issue was made public on 26 January 2022.

Affects: 10.1.0-M1 to 10.1.0-M8

Important: Denial of Service CVE-2021-42340

The fix for bug 63362 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the WebSocket connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

This was fixed with commit 31d62426.

The memory leak was reported publicly via the users mailing list on 23 September 2021. The security implications were identified by the Tomcat Security team the same day. The issue was made public on 14 October 2021.

Affects: 10.0.0-M10 to 10.0.11

Important: Denial of Service CVE-2021-42340

The fix for bug 63362 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the WebSocket connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

This was fixed with commit d5a6660c.

The memory leak was reported publicly via the users mailing list on 23 September 2021. The security implications were identified by the Tomcat Security team the same day. The issue was made public on 14 October 2021.

Affects: 10.1.0-M1 to 10.1.0-M5

Important: Request Smuggling CVE-2021-33037

Apache Tomcat did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility of request smuggling when used with a reverse proxy. Specifically: Tomcat incorrectly ignored the transfer-encoding header if the client declared it would only accept an HTTP/1.0 response; Tomcat honoured the identify encoding; and Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

This was fixed with commits eee0d024, 506134f9 and 19d11556.

This issue was reported to the Apache Tomcat Security team by Bahruz Jabiyev, Steven Sprecher and Kaan Onarlioglu of NEU seclab on 7 May 2021. The issue was made public on 12 July 2021.

Affects: 10.0.0-M1 to 10.0.6

Low: Authentication weakness CVE-2021-30640

Queries made by the JNDI Realm did not always correctly escape parameters. Parameter values could be sourced from user provided data (eg user names) as well as configuration data provided by an administrator. In limited circumstances it was possible for users to authenticate using variations of their user name and/or to bypass some of the protection provided by the LockOut Realm.

This was fixed with commits f4d9bdef, 4e61e1d6, d5303a50, b930d0b3, 17208c64, bd4d1fbe, 81f16b0a and eeb73512.

This issue was reported publicly as 65224.

Affects: 10.0.0-M1 to 10.0.5

Important: Denial of Service CVE-2021-30639

An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS.

Applications that do not use non-blocking I/O are not exposed to this vulnerability.

This was fixed with commit b59099e4.

This issue was reported publicly as 65203.

Affects: 10.0.3 to 10.0.4

Note: The issue below was fixed in Apache Tomcat 10.0.3 but the release vote for the 10.0.3 release candidate did not pass. Therefore, although users must download 10.0.4 to obtain a version that includes a fix for these issues, version 10.0.3 is not included in the list of affected versions.

Important: Denial of Service CVE-2021-41079

When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.

This was fixed with commit 34115fb3.

This issue was first reported to the Apache Tomcat Security Team by Thomas Wozenilek on 26 February 2021 but could not be confirmed. A speculative fix was applied on 3 March 2021. On 14 September 2021 David Frankson of Infinite Campus independently reported the issue and included a test case. This allowed both the issue and the speculative fix to be verified. The issue was made public on 15 September 2021.

Affects: 10.0.0-M1 to 10.0.2

Note: The issues below were fixed in Apache Tomcat 10.0.1 but the release vote for the 10.0.1 release candidate did not pass. Therefore, although users must download 10.0.2 to obtain a version that includes a fix for these issues, version 10.0.1 is not included in the list of affected versions.

Low: Fix for CVE-2020-9484 was incomplete CVE-2021-25329

The fix for CVE-2020-9484 was incomplete. When using a highly unlikely configuration edge case, the Tomcat instance was still vulnerable to CVE-2020-9484. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published non-upgrade mitigations for CVE-2020-9484 also apply to this issue.

This was fixed with commit 6d66e99e.

This issue was reported to the Apache Tomcat Security team by Trung Pham of Viettel Cyber Security on 12 January 2021. The issue was made public on 1 March 2021.

Affects: 10.0.0-M1 to 10.0.0

Important: Request mix-up with h2c CVE-2021-25122

When responding to new h2c connection requests, Apache Tomcat could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

This was fixed with commit dd757c0a.

This issue was identified by the Apache Tomcat Security team on 11 January 2021. The issue was made public on 1 March 2021.

Affects: 10.0.0-M1 to 10.0.0

Important: Information disclosure CVE-2021-24122

When serving resources from a network location using the NTFS file system it was possible to bypass security constraints and/or view the source code for JSPs in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.

This was fixed with commit 7f004ac4.

This issue was reported the Apache Tomcat Security team by Ilja Brander on 26 October 2020. The issue was made public on 14 January 2021.

Affects: 10.0.0-M1 to 10.0.0-M9

Moderate: HTTP/2 request header mix-up CVE-2020-17527

While investigating issue 64830 it was discovered that Apache Tomcat could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.

This was fixed with commit 8d2fe689.

This issue was identified by the Apache Tomcat Security team on 10 November 2020. The issue was made public on 3 December 2020.

Affects: 10.0.0-M1 to 10.0.0-M9

Moderate: HTTP/2 request mix-up CVE-2020-13943

If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

This was fixed with commit 1bbc650c.

This issue was identified by the Apache Tomcat Security team on 23 July 2020. The issue was made public on 12 October 2020.

Affects: 10.0.0-M1 to 10.0.0-M7

Important: WebSocket DoS CVE-2020-13935

The payload length in a WebSocket frame was not correctly validated. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.

This was fixed with commit 1c1c77b0.

This issue was reported publicly via the Apache Bugzilla instance on 28 June 2020 and included references to high CPU but no specific reference to denial of service. The associated DoS risks were identified by the Apache Tomcat Security Team the same day. The issue was made public on 14 July 2020.

Affects: 10.0.0-M1 to 10.0.0-M6

Moderate: HTTP/2 DoS CVE-2020-13934

An h2c direct connection did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

This was fixed with commit c9167ae3.

This issue was reported publicly via the Apache Tomcat Users mailing list on 22 June 2020 without reference to the potential for DoS. After further discussion to identify the steps necessary to reproduce the issue, the root cause of the issue and the associated DoS risks were identified by the Apache Tomcat Security Team on 26 June 2020. The issue was made public on 14 July 2020.

Affects: 10.0.0-M1 to 10.0.0-M6

Important: HTTP/2 DoS CVE-2020-11996

A specially crafted sequence of HTTP/2 requests could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

This was fixed with commit 9434a44d.

This issue was reported publicly via the Apache Tomcat Users mailing list on 21 May 2020 without reference to the potential for DoS. The DoS risks were identified by the Apache Tomcat Security Team the same day. The issue was made public on 25 June 2020.

Affects: 10.0.0-M1 to 10.0.0-M5

Important: Remote Code Execution via session persistence CVE-2020-9484

If:

• an attacker is able to control the contents and name of a file on the server; and
• the server is configured to use the PersistenceManager with a FileStore; and
• the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and
• the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over;

then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control.

Note: All of conditions above must be true for the attack to succeed.

As an alternative to upgrading to 10.0.0-M5 or later, users may configure the PersistenceManager with an appropriate value for sessionAttributeValueClassNameFilter to ensure that only application provided attributes are serialized and deserialized.

This was fixed with commit bb33048e.

This issue was reported to the Apache Tomcat Security Team by jarvis threedr3am of pdd security research on 12 April 2020. The issue was made public on 20 May 2020.

Affects: 10.0.0-M1 to 10.0.0-M4

Critical: Remote Code Execution via log4j CVE-2021-44228

Apache Tomcat 10.x has no dependency on any version of log4j.

Web applications deployed on Apache Tomcat may have a dependency on log4j. You should seek support from the application vendor in this instance.

It is possible to configure Apache Tomcat 10.x to use log4j 2.x for Tomcat's internal logging. This requires explicit configuration and the addition of the log4j 2.x library. Anyone who has switched Tomcat's internal logging to log4j 2.x is likely to need to address this vulnerability.

In most cases, disabling the problematic feature will be the simplest solution. Exactly how to do that depends on the exact version of log4j 2.x being used. Details are provided on the log4j 2.x security page.