-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat:tomcat | maven | >= 6.0.30, <= 6.0.33 | 6.0.35 |
| org.apache.tomcat:tomcat | maven | >= 7.0, < 7.0.22 | 7.0.22 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from improper recycling of request objects after access logging. The commit fixes show: 1) CoyoteAdapter.log() moved recycling to a finally block to ensure it always occurs, 2) Removed premature logging in error paths of AJP/HTTP processors, and 3) Added conditional logging only after recycling. These changes indicate the original functions mishandled object lifecycle during errors, allowing cached request data (IP/headers) to leak to subsequent requests.
A Semantic Attack on Google Gemini - Read the Latest Research