-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 8.5.0, <= 8.5.98 | 8.5.99 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 9.0.0-M1, <= 9.0.85 | 9.0.86 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 10.1.0-M1, <= 10.1.18 | 10.1.19 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 11.0.0-M1, <= 11.0.0-M16 | 11.0.0-M17 |
| org.apache.tomcat:tomcat-coyote | maven | >= 11.0.0-M1, <= 11.0.0-M16 | 11.0.0-M17 |
| org.apache.tomcat:tomcat-coyote | maven | >= 10.1.0-M1, <= 10.1.18 | 10.1.19 |
| org.apache.tomcat:tomcat-coyote | maven | >= 9.0.0-M1, <= 9.0.85 | 9.0.86 |
| org.apache.tomcat:tomcat-coyote | maven | >= 8.5.0, <= 8.5.98 | 8.5.99 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from delayed header validation in HTTP/2 processing. The commit 0cac540 shows:- validateHeaders() calls were added to readHeadersFrame and readContinuationFrame- validateHeaders() was removed from onHeadersCompleteIn vulnerable versions:- Header validation only occurred at the end of header processing (onHeadersComplete)- This allowed attackers to send oversized headers that wouldn't trigger stream resets until after full processingThe affected functions are where header processing occurred without intermediate validation. The patch moved validation earlier into frame processing methods to detect errors immediately.
Ongoing coverage of React2Shell