{"id":"CVE-2021-43980","published":"2022-09-28T00:00:00Z","modified":"2025-05-21T15:00:10Z","title":"Apache Tomcat: Information disclosure","vendor":"Apache","product":"Apache Tomcat","tier":"tail","description":{"text":"The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.7,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.02362,"percentile":0.83784,"provenance":"source"},"cwes":[{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization"}],"references":[{"url":"https://lists.apache.org/thread/3jjqbsp6j88b198x5rmg99b1qr8ht3g3","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2022/09/28/1","tags":["mailing-list"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00029.html","tags":["mailing-list"]},{"url":"https://www.debian.org/security/2022/dsa-5265","tags":["vendor-advisory"]}],"priority":{"score":19.3,"factors":[{"name":"EPSS percentile","points":16.76},{"name":"CVSS severity","points":2.59}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":["10.1.0-M1 to 10.1.0-M12","10.0.0-M1 to 10.0.18","9.0.0-M1 to 9.0.60","8.5.0 to 8.5.77"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=8.5.0, <8.5.78",">=9.0.0-M1, <9.0.62",">=10.0.0-M1, <10.0.20",">=10.1.0-M1, <10.1.0-M14"],"patched":["8.5.78","9.0.62","10.0.20","10.1.0-M14"],"from":["GHSA-jx7c-7mj5-9438"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6865","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tomcat-cve-2017-5647","parents":[{"from":"CVE-2017-5647","to":"CVE-2021-43980","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/AbstractProtocol.java"],"commits":["https://github.com/apache/tomcat/commit/864aa1199ad2cccc9a7e7c6b977f7d7f812c9910","https://github.com/apache/tomcat/commit/a4efd3ca1ccbdfc398136d76c0d8b7ad5a1e4905","https://github.com/apache/tomcat/commit/170e0f792bd18ff031677890ba2fe50eb7a376c1","https://github.com/apache/tomcat/commit/17f177eeb7df5938f67ef9ea580411b120195f13"],"basis":"shared function","functions":["process"]}]}],"children":[{"from":"CVE-2021-43980","to":"CVE-2025-66614","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/AbstractProtocol.java","java/org/apache/tomcat/util/net/SocketWrapperBase.java"],"commits":["https://github.com/apache/tomcat/commit/170e0f792bd18ff031677890ba2fe50eb7a376c1","https://github.com/apache/tomcat/commit/17f177eeb7df5938f67ef9ea580411b120195f13","https://github.com/apache/tomcat/commit/258a591b61f8cf5c22109e21e5a2a38b63454fd2","https://github.com/apache/tomcat/commit/152c14885d45f5e0a8b59bd9f93c289cfe20ce30"],"basis":"shared function","functions":["SocketWrapperBase"]}]}],"packageHistory":[{"cve":"CVE-2022-25762","published":"2022-05-13","fixed":"9.0.20","kev":false,"link":{"from":"CVE-2022-25762","to":"CVE-2021-43980","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"8.5.75","toFixed":"8.5.78","daysApart":138}]}},{"cve":"CVE-2021-30640","published":"2021-07-12","fixed":"10.0.5","kev":false},{"cve":"CVE-2021-33037","published":"2021-07-12","fixed":"10.0.7","kev":false},{"cve":"CVE-2022-23181","published":"2022-01-27","fixed":"10.0.16","kev":false,"link":{"from":"CVE-2022-23181","to":"CVE-2021-43980","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"9.0.58","toFixed":"9.0.62","daysApart":244},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat","fromFixed":"10.0.16","toFixed":"10.0.20","daysApart":244}]}},{"cve":"CVE-2021-43980","published":"2022-09-28","fixed":"10.1.0-M14","kev":false},{"cve":"CVE-2022-29885","published":"2022-05-12","fixed":"10.1.0-M15","kev":false},{"cve":"CVE-2022-34305","published":"2022-06-23","fixed":"10.1.0-M17","kev":false},{"cve":"CVE-2021-42340","published":"2021-10-14","fixed":"10.1.0-M6","kev":false}],"package":"Maven:org.apache.tomcat:tomcat"}}