● CVE — High
CVE-2021-25122
Vendordebian, oracle, apacheProductdebian linux, agile product lifecycle management, tomcat, communications instant messaging server, managed file transfer, agile plm, mysql enterprise monitor, database, instantis enterprisetrack, siebel ui framework, communications cloud native core policy, communications cloud native core security edge protection proxy, graph server and clientDiscoveredMar 1, 2021UpdatedAug 25, 2026
When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.