-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat:tomcat | maven | >= 9.0.0.M1, <= 9.0.0.M11 | 9.0.0.M12 |
| org.apache.tomcat:tomcat | maven | >= 8.5.0, < 8.5.8 | 8.5.8 |
JavaJavaMiggo AIRoot Cause AnalysisThe commit diff shows critical changes in Http2Parser.java's readHeaderPayload() method. The original implementation used a fixed 1024-byte buffer and a loop that subtracted 'payloadSize' without proper buffer expansion. This created an unreachable exit condition when headers exceeded buffer capacity. The patch introduces buffer expansion checks and dynamic resizing (via ByteBufferUtils.expand), confirming the vulnerability stemmed from improper buffer management in this function.
Ongoing coverage of React2Shell