-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat:tomcat | maven | >= 7.0.0, < 7.0.40 | 7.0.40 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of RuntimeExceptions in AsyncListener callbacks. The patch modifies four key methods in AsyncContextImpl that process listener events, changing their exception handling from catching specific IOExceptions to general Throwables. These functions would appear in stack traces when processing malicious AsyncListeners that throw RuntimeExceptions, as they were the entry points for listener execution with insufficient error handling prior to the patch. The ExceptionUtils.handleThrowable addition in the patch confirms these were the vulnerable execution paths.
Ongoing coverage of React2Shell