CVE-2021-25122

Published: Mar 1, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.

Affected (55)

Products: Apache: Tomcat · Debian: Debian Linux · Oracle: Agile Plm, Communications Cloud Native Core Policy, Communications Cloud Native Core Security Edge Protection Proxy, Communications Instant Messaging Server, Database, Graph Server And Client, Instantis Enterprisetrack, Managed File Transfer, Mysql Enterprise Monitor, Siebel Ui Framework

1 product

1 product

10 products

Communications Cloud Native Core Policy

Communications Cloud Native Core Security Edge Protection Proxy

Communications Instant Messaging Server

Database

Graph Server And Client

Instantis Enterprisetrack

Managed File Transfer

Mysql Enterprise Monitor

Siebel Ui Framework

Configuration A

36 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	From 8.5.0 to 8.5.61
Apache Tomcat	From 9.0.0 to 9.0.41
Apache Tomcat	Version 10.0.0
Apache Tomcat	Version 10.0.0 milestone10
Apache Tomcat	Version 10.0.0 milestone1
Apache Tomcat	Version 10.0.0 milestone2
Apache Tomcat	Version 10.0.0 milestone3
Apache Tomcat	Version 10.0.0 milestone4
Apache Tomcat	Version 10.0.0 milestone5
Apache Tomcat	Version 10.0.0 milestone6
Apache Tomcat	Version 10.0.0 milestone7
Apache Tomcat	Version 10.0.0 milestone8
Apache Tomcat	Version 10.0.0 milestone9
Apache Tomcat	Version 9.0.0 milestone10
Apache Tomcat	Version 9.0.0 milestone11
Apache Tomcat	Version 9.0.0 milestone12
Apache Tomcat	Version 9.0.0 milestone13
Apache Tomcat	Version 9.0.0 milestone14
Apache Tomcat	Version 9.0.0 milestone15
Apache Tomcat	Version 9.0.0 milestone16
Apache Tomcat	Version 9.0.0 milestone17
Apache Tomcat	Version 9.0.0 milestone18
Apache Tomcat	Version 9.0.0 milestone19
Apache Tomcat	Version 9.0.0 milestone1
Apache Tomcat	Version 9.0.0 milestone20
Apache Tomcat	Version 9.0.0 milestone21
Apache Tomcat	Version 9.0.0 milestone22
Apache Tomcat	Version 9.0.0 milestone23
Apache Tomcat	Version 9.0.0 milestone24
Apache Tomcat	Version 9.0.0 milestone25
Apache Tomcat	Version 9.0.0 milestone26
Apache Tomcat	Version 9.0.0 milestone27
Apache Tomcat	Version 9.0.0 milestone2
Apache Tomcat	Version 9.0.0 milestone3
Apache Tomcat	Version 9.0.0 milestone4
Apache Tomcat	Version 9.0.0 milestone5

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration C

17 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Plm	Version 9.3.3
Oracle Agile Plm	Version 9.3.6
Oracle Communications Cloud Native Core Policy	Version 1.14.0
Oracle Communications Cloud Native Core Security Edge Protection Proxy	Version 1.6.0
Oracle Communications Instant Messaging Server	Version 10.0.1.5.0
Oracle Database	Version 12.2.0.1
Oracle Database	Version 19c
Oracle Database	Version 21c
Oracle Graph Server And Client	Before 21.3.0
Oracle Graph Server And Client	Version 21.3.0
Oracle Instantis Enterprisetrack	Version 17.1
Oracle Instantis Enterprisetrack	Version 17.2
Oracle Instantis Enterprisetrack	Version 17.3
Oracle Managed File Transfer	Version 12.2.1.3.0
Oracle Managed File Transfer	Version 12.2.1.4.0
Oracle Mysql Enterprise Monitor	Up to 8.0.23
Oracle Siebel Ui Framework	Up to 21.9