CVE-2021-25122: Apache Tomcat - Exposure of Sensitive Information
Summary
CVE-2021-25122: Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat. Affects org.apache.tomcat.embed:tomcat-embed-core across 3 version ranges.
>= 8.5.0, < 8.5.63
>= 9.0.0, < 9.0.43
>= 10.0.0, < 10.0.2
Fixed in 8.5.63, 9.0.43 or 10.0.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-25122 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. The 'org.apache.tomcat.embed:tomcat-embed-core' package is a Maven package that includes the core components of Apache Tomcat for embedding it into other applications. This package is commonly used to integrate Apache Tomcat into Java applications.
Vulnerability Detail
The vulnerability identified as CVE-2021-25122 affects Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, and 8.5.0 to 8.5.61. It allows an unauthorized actor to access sensitive information. When responding to new h2c connection requests, Apache Tomcat duplicates request headers and a limited amount of request body from one request to another. This means that multiple users could potentially see the results of another user's request. This vulnerability poses a significant risk as it can lead to the exposure of sensitive data to unauthorized individuals.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 8.5.0, < 8.5.638.5.63 -
>= 9.0.0, < 9.0.439.0.43 -
>= 10.0.0, < 10.0.210.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions of Apache Tomcat.
Conclusion
The vulnerability (CVE-2021-25122) in Apache Tomcat exposes sensitive information to unauthorized actors. It is crucial to upgrade to the fixed versions of Apache Tomcat (10.0.2, 9.0.43, or 8.5.63) to mitigate the risk of data exposure. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
Apache Tomcat is an open-source web server and servlet container used for hosting Java-based web applications.
The vulnerability affects Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, and 8.5.0 to 8.5.61.
The vulnerability allows an unauthorized actor to access sensitive information, potentially leading to the exposure of sensitive data to unauthorized individuals.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Apache Tomcat.
No, there is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the fixed versions of Apache Tomcat.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
