Apache Tomcat: AJP response header mix-up
Priority MEDIUM 41CWE-732Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01116 66th percentileScored 2026-11-07
Fix Partial org.apache.tomcat.embed:tomcat-embed-core (Maven): 11.0.0-M6, 10.1.9, 9.0.75org.apache.tomcat:tomcat-coyote (Maven): 8.5.89Red Hat: 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Tomcat | 11.0.0-M5; 10.1.8; 9.0.74; 8.5.88 | — | No fix listed | CNA |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 11.0.0-M5 to before 11.0.0-M6 | 11.0.0-M6 | Patch available | GHSA-mppv-79ch-vw6q |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 10.1.8 to before 10.1.9 | 10.1.9 | Patch available | GHSA-mppv-79ch-vw6q |
| — | org.apache.tomcat.embed:tomcat-embed-core (Maven) | 9.0.74 to before 9.0.75 | 9.0.75 | Patch available | GHSA-mppv-79ch-vw6q |
| — | org.apache.tomcat:tomcat-coyote (Maven) | 8.5.88 to before 8.5.89 | 8.5.89 | Patch available | GHSA-mppv-79ch-vw6q |
- Apache Tomcat VendorApache Affected 11.0.0-M5; 10.1.8; 9.0.74; 8.5.88 Fixed in — No fix listed CNA
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 11.0.0-M5 to before 11.0.0-M6 Fixed in 11.0.0-M6 Patch available GHSA-mppv-79ch-vw6q
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 10.1.8 to before 10.1.9 Fixed in 10.1.9 Patch available GHSA-mppv-79ch-vw6q
- org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.74 to before 9.0.75 Fixed in 9.0.75 Patch available GHSA-mppv-79ch-vw6q
- org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 8.5.88 to before 8.5.89 Fixed in 8.5.89 Patch available GHSA-mppv-79ch-vw6q
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:8.5.88:*:*:*:*:*:*:* | 8.5.88 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:9.0.74:*:*:*:*:*:*:* | 9.0.74 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:10.1.8:*:*:*:*:*:*:* | 10.1.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:* | 11.0.0 milestone5 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:8.5.88:*:*:*:*:*:*:* Versions 8.5.88 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:9.0.74:*:*:*:*:*:*:* Versions 9.0.74 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:10.1.8:*:*:*:*:*:*:* Versions 10.1.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:* Versions 11.0.0 milestone5 Vulnerable ·Apache
Remediation
- Fix · GHSA-mppv-79ch-vw6q org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 11.0.0-M6 Advisory →
- Fix · GHSA-mppv-79ch-vw6q org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 10.1.9 Advisory →
- Fix · GHSA-mppv-79ch-vw6q org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.75 Advisory →
- Fix · GHSA-mppv-79ch-vw6q org.apache.tomcat:tomcat-coyote (Maven) Fixed in 8.5.89 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
Not affected: 4 products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Web Server 5
- Red Hat JBoss Web Server 6
Timeline
- 2026-10-02 Threatist record created from CVE-2023-34981
- 2026-10-03 Alias added: GHSA-mppv-79ch-vw6q
References
Advisory 3
Other 12
- https://github.com/apache/tomcat/commit/2214c8030522aa9b2a367dfa5d9acff1a03666ae
- https://github.com/apache/tomcat/commit/2f0ca2378415f4cf0748f4bc8fa955f41f803fa5
- https://github.com/apache/tomcat/commit/739c7381aed22b7636351caf885ddc519ab6b442
- https://github.com/apache/tomcat/commit/f0742f47b98aca943097f7f88e0d1163f57527e3
- https://bz.apache.org/bugzilla/show_bug.cgi?id=66512
- https://bz.apache.org/bugzilla/show_bug.cgi?id=66591
- https://github.com/apache/tomcat
- https://security.netapp.com/advisory/ntap-20230714-0003
- https://tomcat.apache.org/security-10.html
- https://tomcat.apache.org/security-11.html
- https://tomcat.apache.org/security-8.html
- https://tomcat.apache.org/security-9.html
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2023-34981 · CVE Program
- CVE-2023-34981 · NVD
- FIRST EPSS
- GHSA-mppv-79ch-vw6q · GitHub Advisory Database · CC BY 4.0
- CVE-2023-34981 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences