Race condition in Apache Tomcat
Priority MEDIUM 40CWE-362Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 4 fixed, 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.
Why it matters now
EPSS 0.11156 95th percentileScored 2026-11-07
Fix Partial org.apache.tomcat.embed:tomcat-embed-core (Maven): 9.0.10, 8.5.32Red Hat: 3 advisoriesRed Hat: 4 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | 9.0.0.M9 to 9.0.9; 8.5.5 to 8.5.31 | — | No fix listed | CNA |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 9.0.0.M9 to before 9.0.10 | 9.0.10 | Patch available | GHSA-6v52-mj5r-7j2m |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 8.5.5 to before 8.5.32 | 8.5.32 | Patch available | GHSA-6v52-mj5r-7j2m |
- Apache Tomcat VendorApache Affected 9.0.0.M9 to 9.0.9; 8.5.5 to 8.5.31 Fixed in — No fix listed CNA
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.0.M9 to before 9.0.10 Fixed in 9.0.10 Patch available GHSA-6v52-mj5r-7j2m
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.5.5 to before 8.5.32 Fixed in 8.5.32 Patch available GHSA-6v52-mj5r-7j2m
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 8.5.5 – 8.5.31; 9.0.1 – 9.0.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:*:*:*:*:*:*:* | 9.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* | 9.0.0 milestone10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* | 9.0.0 milestone11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* | 9.0.0 milestone12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* | 9.0.0 milestone13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* | 9.0.0 milestone14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* | 9.0.0 milestone15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* | 9.0.0 milestone16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* | 9.0.0 milestone17 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 8.5.5 – 8.5.31; 9.0.1 – 9.0.9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:* Versions 9.0.0 milestone10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:* Versions 9.0.0 milestone11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:* Versions 9.0.0 milestone12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:* Versions 9.0.0 milestone13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:* Versions 9.0.0 milestone14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:* Versions 9.0.0 milestone15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:* Versions 9.0.0 milestone16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:* Versions 9.0.0 milestone17 Vulnerable ·Apache
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* | 9.0.0 milestone18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* | 9.0.0 milestone19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* | 9.0.0 milestone20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* | 9.0.0 milestone21 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* | 9.0.0 milestone22 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* | 9.0.0 milestone23 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* | 9.0.0 milestone24 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* | 9.0.0 milestone25 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* | 9.0.0 milestone26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* | 9.0.0 milestone27 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* | 9.0.0 milestone9 | Vulnerable | Apache |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:* Versions 9.0.0 milestone18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:* Versions 9.0.0 milestone19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:* Versions 9.0.0 milestone20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:* Versions 9.0.0 milestone21 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:* Versions 9.0.0 milestone22 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:* Versions 9.0.0 milestone23 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:* Versions 9.0.0 milestone24 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:* Versions 9.0.0 milestone25 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:* Versions 9.0.0 milestone26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:* Versions 9.0.0 milestone27 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.0:milestone9:*:*:*:*:*:* Versions 9.0.0 milestone9 Vulnerable ·Apache
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-6v52-mj5r-7j2m org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.10 Advisory →
- Fix · GHSA-6v52-mj5r-7j2m org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.32 Advisory →
Red Hat 3 advisories
- RHSA-2019:1529 Released 2019-06-18 · Red Hat rating Importantpki-deps:10.6 security update
- Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.0.0+3248+9d514f3b.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.0.0+3248+9d514f3b.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.0.0+3248+9d514f3b.noarch::pki-deps:10.6 +47
- RHSA-2018:2868 Released 2018-10-03 · Red Hat rating ImportantRed Hat JBoss Web Server 5.0 Service Pack 1 security and bug fix update
- Red Hat JBoss Web Server 5.0 for RHEL 6 Server jws5-tomcat-9.0.7-12.redhat_12.1.el6jws, jws5-tomcat-admin-webapps-9.0.7-12.redhat_12.1.el6jws, jws5-tomcat-docs-webapp-9.0.7-12.redhat_12.1.el6jws +8
- Red Hat JBoss Web Server 5.0 for RHEL 7 Server jws5-tomcat-9.0.7-12.redhat_12.1.el7jws, jws5-tomcat-admin-webapps-9.0.7-12.redhat_12.1.el7jws, jws5-tomcat-docs-webapp-9.0.7-12.redhat_12.1.el7jws +8
- RHSA-2018:2867 Released 2018-10-03 · Red Hat rating ImportantRed Hat JBoss Web Server 5.0 Service Pack 1 security and bug fix update
- Red Hat JBoss Web Server 5.0
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Application Runtimes | Affected | No fix yet |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2019:1529 |
| Red Hat JBoss Web Server 5.0 | Fixed | RHSA-2018:2867 |
| Red Hat JBoss Web Server 5.0 for RHEL 6 Server | Fixed | RHSA-2018:2868 |
| Red Hat JBoss Web Server 5.0 for RHEL 7 Server | Fixed | RHSA-2018:2868 |
Not affected: 18 products
- Red Hat BPM Suite 6
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Fuse 7
- Red Hat JBoss BRMS 5
- Red Hat JBoss BRMS 6
- Red Hat JBoss Data Grid 6
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 5
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Enterprise Web Server 2
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Service Works 6
- Red Hat JBoss Operations Network 3
- Red Hat JBoss SOA Platform 5
- Red Hat JBoss Web Server 3
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2018-8037
- 2026-10-03 Alias added: GHSA-6v52-mj5r-7j2m
References
Advisory 8
- [www-announce] 20180722 [SECURITY] CVE-2018-8037 Apache Tomcat - Information Disclosure
- DSA-4281
- https://security.netapp.com/advisory/ntap-20180817-0001/
- [www-announce] 20180809 [UPDATE][SECURITY] CVE-2018-8037 Apache Tomcat - Information Disclosure
- RHSA-2018:2867
- RHSA-2018:2868
- RHSA-2019:1529
- https://nvd.nist.gov/vuln/detail/CVE-2018-8037
Other 38
- [tomcat-dev] 20190319 svn commit: r1855831 [24/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [23/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190413 svn commit: r1857496 [3/4] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190415 svn commit: r1857582 [18/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-users] 20191001 Additional Information on Apache Tomcat CVE-2018-8037
- [tomcat-users] 20191001 Re: Additional Information on Apache Tomcat CVE-2018-8037
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- [tomcat-dev] 20200203 svn commit: r1873527 [24/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200203 svn commit: r1873527 [25/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [28/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [29/34] - /tomcat/site/trunk/docs/
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://github.com/apache/tomcat/commit/4c04369c287233ea2e8e5135f6c31d02e2d76293
- https://github.com/apache/tomcat/commit/ccf2e6bf5205561ad18c2300153e9173ec509d73
- https://github.com/apache/tomcat/commit/ed4b9d791f9470e4c3de691dd0153a9ce431701b
- https://github.com/apache/tomcat/commit/f94eedf02b5973598ab3dbbd4504da588e9ba6cb
- https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E
- https://security.netapp.com/advisory/ntap-20180817-0001
- https://web.archive.org/web/20200227102808/http://www.securityfocus.com/bid/104894
- https://web.archive.org/web/20200515223903/http://www.securitytracker.com/id/1041376
- https://github.com/apache/tomcat
- https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/2ee3af8a43cb019e7898c9330cc8e73306553a27f2e4735dfb522d39@%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/5d15316dfb4adf75d96d394745f8037533fa3bcc1ac8f619bf5c044c@%3Cusers.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2018-8037 · CVE Program
- CVE-2018-8037 · NVD
- FIRST EPSS
- GHSA-6v52-mj5r-7j2m · GitHub Advisory Database · CC BY 4.0
- CVE-2018-8037 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences