-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat:tomcat | maven | >= 8.5.0, < 8.5.78 | 8.5.78 |
| org.apache.tomcat:tomcat | maven | >= 9.0.0-M1, < 9.0.62 | 9.0.62 |
| org.apache.tomcat:tomcat | maven | >= 10.0.0-M1, < 10.0.20 | 10.0.20 |
| org.apache.tomcat:tomcat | maven | >= 10.1.0-M1, < 10.1.0-M14 | 10.1.0-M14 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from improper synchronization around Http11Processor instance management. The commit diff shows critical changes: 1) Replacing getCurrentProcessor() with takeCurrentProcessor() (atomic get-and-clear), 2) Converting currentProcessor to AtomicReference. The original functions lacked atomic operations, allowing race conditions where multiple client connections could share a processor instance. The vulnerable functions directly handled processor association/dissociation without thread-safe mechanisms, leading to response mix-ups between clients.
Ongoing coverage of React2Shell