-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from how HTTP/2 requests handled the ':path' pseudo-header. The original code in Stream.java split the URI and query but used setString() for the URI, which skipped proper path parameter decoding. The patch changed this to setBytes() with ISO_8859_1 encoding, ensuring path parameters (like session IDs) are processed. The test case in TestStream.java confirms the fix by validating session ID handling. The emitHeader function's flawed URI processing directly caused the security bypass.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat:tomcat | maven | >= 9.0.0.M1, <= 9.0.0.M21 | 9.0.0.M22 |
| org.apache.tomcat:tomcat | maven | >= 8.5.0, <= 8.5.15 | 8.5.16 |