-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | maven | = 11.0.0-M5 | 11.0.0-M6 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | = 10.1.8 | 10.1.9 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | = 9.0.74 | 9.0.75 |
| org.apache.tomcat:tomcat-coyote | maven | = 8.5.88 | 8.5.89 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from how headers were processed in AjpProcessor.prepareResponse(). The pre-patch code used a single-pass for-loop that: 1) Only generated SEND_HEADERS during the first iteration 2) Could exit without sending headers if all were removed via error handling 3) Didn't account for zero-header responses. The commit introduced retry logic (while-loop with header regeneration) to ensure at least one SEND_HEADERS is always sent, confirming the original function's flawed control flow was the root cause.
Ongoing coverage of React2Shell