{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-11T06:43:07.939","vulnerabilities":[{"cve":{"id":"CVE-2021-25122","sourceIdentifier":"security@apache.org","published":"2021-03-01T12:15:13.793","lastModified":"2024-11-21T05:54:23.690","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request."},{"lang":"es","value":"Cuando se responde a nuevas peticiones de conexión h2c, Apache Tomcat versiones 10.0.0-M1 hasta 10.0.0, versiones 9.0.0.M1 hasta 9.0.41 y versiones 8.5.0 hasta 8.5.61, podrían duplicar los encabezados de petición y una cantidad limitada del cuerpo de petición de una petición a otra, lo que significa que el usuario A y el usuario B podrían visualizar los resultados de la petición del usuario A"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","versionStartIncluding":"8.5.0","versionEndIncluding":"8.5.61","matchCriteriaId":"B4ABB491-6750-457E-B5A4-67C1146CB15F"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndIncluding":"9.0.41","matchCriteriaId":"A9DFCBAF-1583-4C2F-8776-76F4DCB582B5"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone1:*:*:*:*:*:*","matchCriteriaId":"9D0689FE-4BC0-4F53-8C79-34B21F9B86C2"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone10:*:*:*:*:*:*","matchCriteriaId":"89B129B2-FB6F-4EF9-BF12-E589A87996CF"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone11:*:*:*:*:*:*","matchCriteriaId":"8B6787B6-54A8-475E-BA1C-AB99334B2535"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone12:*:*:*:*:*:*","matchCriteriaId":"EABB6FBC-7486-44D5-A6AD-FFF1D3F677E1"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone13:*:*:*:*:*:*","matchCriteriaId":"E10C03BC-EE6B-45B2-83AE-9E8DFB58D7DB"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone14:*:*:*:*:*:*","matchCriteriaId":"8A6DA0BE-908C-4DA8-A191-A0113235E99A"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone15:*:*:*:*:*:*","matchCriteriaId":"39029C72-28B4-46A4-BFF5-EC822CFB2A4C"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone16:*:*:*:*:*:*","matchCriteriaId":"1A2E05A3-014F-4C4D-81E5-88E725FBD6AD"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone17:*:*:*:*:*:*","matchCriteriaId":"166C533C-0833-41D5-99B6-17A4FAB3CAF0"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone18:*:*:*:*:*:*","matchCriteriaId":"D3768C60-21FA-4B92-B98C-C3A2602D1BC4"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone19:*:*:*:*:*:*","matchCriteriaId":"DDD510FA-A2E4-4BAF-A0DE-F4E5777E9325"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone2:*:*:*:*:*:*","matchCriteriaId":"9F542E12-6BA8-4504-A494-DA83E7E19BD5"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone20:*:*:*:*:*:*","matchCriteriaId":"C2409CC7-6A85-4A66-A457-0D62B9895DC1"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone21:*:*:*:*:*:*","matchCriteriaId":"B392A7E5-4455-4B1C-8FAC-AE6DDC70689E"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone22:*:*:*:*:*:*","matchCriteriaId":"EF411DDA-2601-449A-9046-D250419A0E1A"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone23:*:*:*:*:*:*","matchCriteriaId":"D7D8F2F4-AFE2-47EA-A3FD-79B54324DE02"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone24:*:*:*:*:*:*","matchCriteriaId":"1B4FBF97-DE16-4E5E-BE19-471E01818D40"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone25:*:*:*:*:*:*","matchCriteriaId":"3B266B1E-24B5-47EE-A421-E0E3CC0C7471"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone26:*:*:*:*:*:*","matchCriteriaId":"29614C3A-6FB3-41C7-B56E-9CC3F45B04F0"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone27:*:*:*:*:*:*","matchCriteriaId":"C6AB156C-8FF6-4727-AF75-590D0DCB3F9D"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone3:*:*:*:*:*:*","matchCriteriaId":"C0C5F004-F7D8-45DB-B173-351C50B0EC16"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone4:*:*:*:*:*:*","matchCriteriaId":"D1902D2E-1896-4D3D-9E1C-3A675255072C"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:9.0.0:milestone5:*:*:*:*:*:*","matchCriteriaId":"49AAF4DF-F61D-47A8-8788-A21E317A145D"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.0.0:-:*:*:*:*:*:*","matchCriteriaId":"DA7CC5E9-3631-4073-84C8-2C12D90686CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.0.0:milestone1:*:*:*:*:*:*","matchCriteriaId":"90CD7E85-4FF9-4158-AC78-4BFCBC882A65"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.0.0:milestone10:*:*:*:*:*:*","matchCriteriaId":"83B9FF07-1B93-4F8C-AC56-7CA74E61B724"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.0.0:milestone2:*:*:*:*:*:*","matchCriteriaId":"7EA56B52-1015-40CD-B10C-393768094269"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.0.0:milestone3:*:*:*:*:*:*","matchCriteriaId":"501B0D4A-D636-4736-979B-D5023599CEFB"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.0.0:milestone4:*:*:*:*:*:*","matchCriteriaId":"94E7764F-BF9E-463E-B446-A9A8DB92BB97"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.0.0:milestone5:*:*:*:*:*:*","matchCriteriaId":"53A9F7EE-AF2A-43E5-B708-0198784AB45A"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.0.0:milestone6:*:*:*:*:*:*","matchCriteriaId":"AC872C5F-63AF-4BB8-8629-334FC9704AE8"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.0.0:milestone7:*:*:*:*:*:*","matchCriteriaId":"94B95C95-DF3E-49C1-9CA0-4474DD7EF7B8"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.0.0:milestone8:*:*:*:*:*:*","matchCriteriaId":"310B0163-01DE-40DA-A2EA-FFA4A6100037"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.0.0:milestone9:*:*:*:*:*:*","matchCriteriaId":"75420449-A951-4133-A5F1-4C01F2DF843B"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","matchCriteriaId":"DEECE5FC-CACF-4496-A3E7-164736409252"},{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","matchCriteriaId":"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:agile_plm:9.3.3:*:*:*:*:*:*:*","matchCriteriaId":"D14ABF04-E460-4911-9C6C-B7BCEFE68E9D"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*","matchCriteriaId":"C650FEDB-E903-4C2D-AD40-282AB5F2E3C2"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*","matchCriteriaId":"4479F76A-4B67-41CC-98C7-C76B81050F8E"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.6.0:*:*:*:*:*:*:*","matchCriteriaId":"45E5C9B0-AB25-4744-88E4-FD0C4A853001"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:*","matchCriteriaId":"C4A94B36-479F-48F2-9B9E-ACEA2589EF48"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database:12.2.0.1:*:*:*:enterprise:*:*:*","matchCriteriaId":"46E7237C-00BD-4490-96C3-A8EAE4CE2C0B"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database:19c:*:*:*:enterprise:*:*:*","matchCriteriaId":"C1E05472-8F3A-4E46-90E5-50EA6D555FDC"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:database:21c:*:*:*:enterprise:*:*:*","matchCriteriaId":"02E34416-E767-4F61-8D2C-0D0202351F91"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:graph_server_and_client:*:*:*:*:*:*:*:*","versionEndExcluding":"21.3.0","matchCriteriaId":"38532AE4-9C9F-4182-A791-FCD2BE27DEA6"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:graph_server_and_client:21.3.0:*:*:*:*:*:*:*","matchCriteriaId":"715F9279-F31E-4CC0-A105-95A008EACBA6"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*","matchCriteriaId":"82EA4BA7-C38B-4AF3-8914-9E3D089EBDD4"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*","matchCriteriaId":"B9C9BC66-FA5F-4774-9BDA-7AB88E2839C4"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*","matchCriteriaId":"7F69B9A5-F21B-4904-9F27-95C0F7A628E3"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:managed_file_transfer:12.2.1.3.0:*:*:*:*:*:*:*","matchCriteriaId":"A2E3E923-E2AD-400D-A618-26ADF7F841A2"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*","matchCriteriaId":"9AB58D27-37F2-4A32-B786-3490024290A1"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*","versionEndIncluding":"8.0.23","matchCriteriaId":"F48F2267-61EA-4F12-ADE9-85CB6F6B290E"},{"vulnerable":true,"criteria":"cpe:2.3:a:oracle:siebel_ui_framework:*:*:*:*:*:*:*:*","versionEndIncluding":"21.9","matchCriteriaId":"90605BF7-9C9B-4AC2-83B6-3666C5A15D43"}]}]}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2021/03/01/1","source":"security@apache.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cdev.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cusers.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b%40%3Cusers.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947%40%3Cusers.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E","source":"security@apache.org"},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html","source":"security@apache.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202208-34","source":"security@apache.org","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210409-0002/","source":"security@apache.org","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4891","source":"security@apache.org","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","source":"security@apache.org","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","source":"security@apache.org","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","source":"security@apache.org","tags":["Patch","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/03/01/1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cannounce.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Vendor Advisory"]},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cdev.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/r7b95bc248603360501f18c8eb03bb6001ec0ee3296205b34b07105b7%40%3Cusers.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/rcd90bf36b1877e1310b87ecd14ed7bbb15da52b297efd9f0e7253a3b%40%3Cusers.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/rd0463f9a5cbc02a485404c4b990f0da452e5ac5c237808edba11c947%40%3Cusers.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/202208-34","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210409-0002/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4891","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]}]}}]}