CVE-2021-24122
Apache Tomcat information disclosure
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
- Record
CVE-2021-24122- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200, CWE-706
- Updated
- 2026-11-02
CVE List No score
Apache Tomcat information disclosure
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
- Record
CVE-2021-24122- Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2021-0906 No score
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
- Record
EUVD-2021-0906- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2rvv-w9r2-rg7m
Information Disclosure in Apache Tomcat
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
- Record
GHSA-2rvv-w9r2-rg7m- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-706
- Updated
- 2026-11-02
OSV
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
- Record
CVE-2021-24122- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-24122
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
- Record
DEBIAN-CVE-2021-24122- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 20 moreShow less
OSVGHSA-2rvv-w9r2-rg7m
Information Disclosure in Apache Tomcat
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
- Record
GHSA-2rvv-w9r2-rg7m- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200, CWE-706
- Updated
- 2026-11-02
OSVOESA-2021-1075
tomcat security update
The Apache Tomcat software is developed in an open and participatory environment and released under the Apache License version 2. The Apache Tomcat project is intended to be a collaboration of the best-of-breed developers from around the world. We invite you to participate in this open development project
Security Fix(es):
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.(CVE-2021-24122)
- Record
OESA-2021-1075- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2021:0494
Red Hat Security Advisory: Red Hat JBoss Web Server 5.4.1 Security Update
- Record
RHSA-2021:0494- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-24122
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
- Record
UBUNTU-CVE-2021-24122- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-tomcat-2021-24122 No score
Apache Tomcat information disclosure
When serving resources from a network location using the NTFS file system, Apache Tomcat versions 9.0.0 through 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.
- Record
BIT-tomcat-2021-24122- Updated
- 2026-11-02
OSVCLSA-2025-1748282295 No score
Fix of 34 CVEs
- SECURITY UPDATE: Misc vulnerability fixes
- CVE-2019-12418, CVE-2019-17563, CVE-2020-1935, CVE-2020-11996, CVE-2020-13934, CVE-2020-13935, CVE-2020-13943, CVE-2020-17527, CVE-2021-24122, CVE-2021-30639, CVE-2021-30640, CVE-2021-33037, CVE-2021-42340, CVE-2021-43980, CVE-2022-25762, CVE-2022-34305, CVE-2022-45143, CVE-2023-24998, CVE-2023-28709, CVE-2023-34981, CVE-2023-42794, CVE-2024-21733
- Update to 8.5.100
- debian/rules, debian/libtomcat8-java.poms, debian/maven.rules, debian/tomcat8-common.links, debian/patches/0018-fix-manager-webapp.patch, debian/patches/0019-add-distribution-to-error-page.patch, debian/patches/0021-dont-test-unsupported-ciphers.patch, debian/patches/0101-skipping-tests-incompatible-with-firewall.patch: updated
- debian/patches/0002-do-not-load-AJP13-connector-by-default.patch, debian/patches/0026-easymock4-compatibility.patch: removed as they were applied in upstream
- CVE-2019-0221.patch, CVE-2019-10072-1.patch, CVE-2019-10072-2.patch, CVE-2022-42252.patch, CVE-2020-1938.patch, CVE-2021-25122.patch, CVE-2021-41079.patch, CVE-2022-29885.patch, CVE-2020-9484.patch, CVE-2021-25329-pre1.patch, CVE-2021-25329.patch, CVE-2022-23181.patch, CVE-2023-44487.patch, CVE-2023-46589-pre1.patch, CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch, CVE-2023-46589-pre4.patch, CVE-2023-46589.patch: removed because these CVEs were fixed in upstream
- Internal tests
- debian/test_certs/*: updated from upstream branch 9.0.x, as the 8.0.x certs were expired
- Record
CLSA-2025-1748282295- Updated
- 2026-11-02
OSVCLSA-2026-1790247468 No score
TuxCare security update for 2 packages (6 CVEs)
TuxCare rebuilt 2 packages to address 6 CVEs. Fixed in 7.0.70-tuxcare.5.
- Record
CLSA-2026-1790247468- Updated
- 2026-11-02
OSVCLSA-2026-1792575257 No score
TuxCare security update for 8 packages (32 CVEs)
TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.
- Record
CLSA-2026-1792575257- Updated
- 2026-11-02
OSVCLSA-2026-1792667085 No score
TuxCare security update for 7 packages (24 CVEs)
TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.
- Record
CLSA-2026-1792667085- Updated
- 2026-11-02
OSVCLSA-2026-1792686134 No score
TuxCare security update for 5 packages (9 CVEs)
TuxCare rebuilt 5 packages to address 9 CVEs. Fixed in 9.0.13-tuxcare.1.
- Record
CLSA-2026-1792686134- Updated
- 2026-11-02
OSVMGASA-2021-0072 No score
Updated tomcat packages fix a security vulnerability
When serving resources from a network location using the NTFS file system it was possible to bypass security constraints and/or view the source code for JSPs in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances (CVE-2021-24122).
- Record
MGASA-2021-0072- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0330-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
- CVE-2021-24122: Fixed an information disclosure if resources are served from the NTFS file system (bsc#1180947).
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2021:0330-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11468-1 No score
tomcat-9.0.36-8.4 on GA media
These are all security issues fixed in the tomcat-9.0.36-8.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11468-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13441-1 No score
tomcat10-10.1.14-1.1 on GA media
These are all security issues fixed in the tomcat10-10.1.14-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13441-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:0530-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
- CVE-2021-24122: Fixed an information disclosure if resources are served from the NTFS file system (bsc#1180947).
- Record
SUSE-SU-2021:0530-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:0531-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
- CVE-2021-24122: Fixed an information disclosure if resources are served from the NTFS file system (bsc#1180947).
- Record
SUSE-SU-2021:0531-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:0989-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
- Fixed CVEs:
- CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
- CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Log if file access is blocked due to symlinks: CVE-2021-24122 (bsc#1180947)
- Record
SUSE-SU-2021:0989-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1009-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
- CVE-2021-24122: Fixed an information disclosure if resources are served from the NTFS file system (bsc#1180947).
- CVE-2021-25122: Apache Tomcat h2c request mix-up (bsc#1182912)
- CVE-2021-25329: Complete fix for CVE-2020-9484 (bsc#1182909)
- Record
SUSE-SU-2021:1009-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:14705-1 No score
Security update for tomcat6
This update for tomcat6 fixes the following issues:
- CVE-2021-25329: Fixed completely CVE-2020-9484 (bsc#1182909).
- CVE-2021-24122: Fixed an information disclosure (bsc#1180947).
- CVE-2017-12617: Fixed a file inclusion vulnerability through a crafted request (bsc#1059554).
- Record
SUSE-SU-2021:14705-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1058-1 No score
Security update for tomcat
This update for tomcat fixes the following issues:
Update to Tomcat 9.0.115:
- CVE-2025-48989: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to 'MadeYouReset' DoS attack (bsc#1243895).
- CVE-2025-52434: race condition on connection close when using the APR/Native connector could lead to a JVM crash (bsc#1246389).
- CVE-2025-53506: uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318).
- CVE-2025-66614: client certificate verification bypass due to virtual host mapping (bsc#1258371).
- CVE-2026-24733: improper input validation on HTTP/0.9 requests (bsc#1258385).
- CVE-2023-44487: Rapid reset attack (bsc#1216182).
- Record
SUSE-SU-2026:1058-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat.embed:tomcat-embed-coreMaven |
10.0.0-M1 to 10.0.0-M9 | 10.0.0-M10 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
9.0.0 up to 9.0.40 | 9.0.40 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
8.5.0 up to 8.5.60 | 8.5.60 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
7.0.0 up to 7.0.107 | 7.0.107 |
tomcatBitnami |
7.0.0 up to 7.0.107, 8.5.0 up to 8.5.60, 9.0.1 up to 9.0.40 | 7.0.1078.5.609.0.40 |
libtomcat8-embed-javaTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
libtomcat8-javaTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8TuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-adminTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-commonTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
Show 88 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat8-docsTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-examplesTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
tomcat8-userTuxCare:Ubuntu:18.04 |
before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 | 8.5.100-1ubuntu1~18.04.1+tuxcare.els1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven |
7.0.70 up to 7.0.70-tuxcare.5, plus listed versions 7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.37.0.70-tuxcare.4 |
7.0.70-tuxcare.5 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven |
7.0.70 up to 7.0.70-tuxcare.5, plus listed versions 7.0.70-tuxcare.17.0.70-tuxcare.27.0.70-tuxcare.37.0.70-tuxcare.4 |
7.0.70-tuxcare.5 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-websocketTuxCare:Maven |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat:tomcatTuxCare:Maven |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat:tomcat-tribesTuxCare:Maven |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat:tomcat-utilTuxCare:Maven |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat:tomcat-websocketTuxCare:Maven |
9.0.24 up to 9.0.24-tuxcare.1 | 9.0.24-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven |
8.5.46 up to 8.5.46-tuxcare.1 | 8.5.46-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-websocketTuxCare:Maven |
8.5.46 up to 8.5.46-tuxcare.1 | 8.5.46-tuxcare.1 |
org.apache.tomcat:tomcatTuxCare:Maven |
8.5.46 up to 8.5.46-tuxcare.1 | 8.5.46-tuxcare.1 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven |
8.5.46 up to 8.5.46-tuxcare.1 | 8.5.46-tuxcare.1 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven |
8.5.46 up to 8.5.46-tuxcare.1 | 8.5.46-tuxcare.1 |
org.apache.tomcat:tomcat-tribesTuxCare:Maven |
8.5.46 up to 8.5.46-tuxcare.1 | 8.5.46-tuxcare.1 |
org.apache.tomcat:tomcat-websocketTuxCare:Maven |
8.5.46 up to 8.5.46-tuxcare.1 | 8.5.46-tuxcare.1 |
org.apache.tomcat.embed:tomcat-embed-coreTuxCare:Maven |
9.0.13 up to 9.0.13-tuxcare.1 | 9.0.13-tuxcare.1 |
org.apache.tomcat:tomcatTuxCare:Maven |
9.0.13 up to 9.0.13-tuxcare.1 | 9.0.13-tuxcare.1 |
org.apache.tomcat:tomcat-catalinaTuxCare:Maven |
9.0.13 up to 9.0.13-tuxcare.1 | 9.0.13-tuxcare.1 |
org.apache.tomcat:tomcat-coyoteTuxCare:Maven |
9.0.13 up to 9.0.13-tuxcare.1 | 9.0.13-tuxcare.1 |
org.apache.tomcat:tomcat-tribesTuxCare:Maven |
9.0.13 up to 9.0.13-tuxcare.1 | 9.0.13-tuxcare.1 |
tomcat9Debian:12 |
before 9.0.40-1 | 9.0.40-1 |
tomcat9Debian:13 |
before 9.0.40-1 | 9.0.40-1 |
tomcat9Debian:14 |
before 9.0.40-1 | 9.0.40-1 |
tomcat8Debian:9 |
before 8.5.54-0+deb9u6, plus listed versions 8.5.14-18.5.14-1+deb9u18.5.14-1+deb9u28.5.14-1+deb9u38.5.14-2 Show 37 moreShow less8.5.15-18.5.16-18.5.21-18.5.23-18.5.24-18.5.24-28.5.24-2~bpo9+18.5.28-18.5.28-1~bpo9+18.5.29-18.5.29-1~bpo9+18.5.30-18.5.31-18.5.32-18.5.32-28.5.33-18.5.33-1~bpo9+18.5.34-18.5.34-1~bpo9+18.5.35-18.5.35-28.5.35-2~bpo9+18.5.35-38.5.37-18.5.37-1~bpo9+18.5.37-28.5.38-18.5.38-1~bpo9+18.5.38-28.5.38-2~bpo9+18.5.39-18.5.50-0+deb9u18.5.54-0+deb9u18.5.54-0+deb9u28.5.54-0+deb9u38.5.54-0+deb9u48.5.54-0+deb9u5 |
8.5.54-0+deb9u6 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
10.0.0-M1 up to 10.0.0-M10, plus listed versions 10.0.0-M310.0.0-M410.0.0-M510.0.0-M610.0.0-M710.0.0-M810.0.0-M9 |
10.0.0-M10 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
9.0.0 up to 9.0.40, plus listed versions 9.0.19.0.109.0.119.0.129.0.13 Show 26 moreShow less9.0.149.0.169.0.179.0.199.0.29.0.209.0.219.0.229.0.249.0.269.0.279.0.299.0.309.0.319.0.339.0.349.0.359.0.369.0.379.0.389.0.399.0.49.0.59.0.69.0.79.0.8 |
9.0.40 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
8.5.0 up to 8.5.60, plus listed versions 8.5.118.5.128.5.138.5.148.5.15 Show 42 moreShow less8.5.168.5.198.5.28.5.208.5.218.5.238.5.248.5.278.5.288.5.298.5.38.5.308.5.318.5.328.5.338.5.348.5.358.5.378.5.388.5.398.5.48.5.408.5.418.5.428.5.438.5.458.5.468.5.478.5.498.5.58.5.508.5.518.5.538.5.548.5.558.5.568.5.578.5.588.5.598.5.68.5.88.5.9 |
8.5.60 |
org.apache.tomcat.embed:tomcat-embed-coreMaven |
7.0.0 up to 7.0.107, plus listed versions 7.0.1007.0.1037.0.1047.0.1057.0.106 Show 45 moreShow less7.0.117.0.127.0.147.0.167.0.197.0.27.0.207.0.217.0.227.0.237.0.257.0.267.0.277.0.287.0.297.0.307.0.327.0.337.0.347.0.357.0.377.0.397.0.47.0.407.0.417.0.427.0.477.0.57.0.507.0.527.0.537.0.547.0.557.0.567.0.577.0.597.0.67.0.617.0.627.0.637.0.647.0.657.0.677.0.687.0.69 |
7.0.107 |
tomcatMageia:7 |
before 9.0.39-1.1.mga7 | 9.0.39-1.1.mga7 |
tomcatopenEuler:20.03-LTS-SP1 |
before 9.0.10-17.oe1 | 9.0.10-17.oe1 |
jws5-tomcatRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-admin-webappsRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-docs-webappRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-el-3.0-apiRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-javadocRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-libRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-nativeRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:1.2.25-3.redhat_3.el7jws | 0:1.2.25-3.redhat_3.el7jws |
jws5-tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:1.2.25-3.redhat_3.el7jws | 0:1.2.25-3.redhat_3.el7jws |
jws5-tomcat-selinuxRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-servlet-4.0-apiRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcat-webappsRed Hat:jboss_enterprise_web_server:5.4::el7 |
before 0:9.0.36-9.redhat_8.1.el7jws | 0:9.0.36-9.redhat_8.1.el7jws |
jws5-tomcatRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-admin-webappsRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-docs-webappRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-el-3.0-apiRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-javadocRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-jsp-2.3-apiRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-libRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-nativeRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:1.2.25-3.redhat_3.el8jws | 0:1.2.25-3.redhat_3.el8jws |
jws5-tomcat-native-debuginfoRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:1.2.25-3.redhat_3.el8jws | 0:1.2.25-3.redhat_3.el8jws |
jws5-tomcat-selinuxRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-servlet-4.0-apiRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
jws5-tomcat-webappsRed Hat:jboss_enterprise_web_server:5.4::el8 |
before 0:9.0.36-9.redhat_8.1.el8jws | 0:9.0.36-9.redhat_8.1.el8jws |
tomcatSUSE:Linux Enterprise Server 12 SP5 |
before 9.0.36-3.61.1 | 9.0.36-3.61.1 |
tomcatSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 9.0.36-3.61.1 | 9.0.36-3.61.1 |
tomcatSUSE:Linux Enterprise Module for Web and Scripting 15 SP2 |
before 9.0.36-3.21.1 | 9.0.36-3.21.1 |
tomcatSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 9.0.36-3.79.1 | 9.0.36-3.79.1 |
tomcatSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 9.0.36-3.79.1 | 9.0.36-3.79.1 |
tomcatSUSE:Linux Enterprise Server 15-LTSS |
before 9.0.36-3.79.1 | 9.0.36-3.79.1 |
tomcatSUSE:Linux Enterprise Server for SAP Applications 15 |
before 9.0.36-3.79.1 | 9.0.36-3.79.1 |
tomcatSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS |
before 9.0.36-4.58.1 | 9.0.36-4.58.1 |
tomcatSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 9.0.36-4.58.1 | 9.0.36-4.58.1 |
tomcatSUSE:Linux Enterprise Server 15 SP1-BCL |
before 9.0.36-4.58.1 | 9.0.36-4.58.1 |
tomcatSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 9.0.36-4.58.1 | 9.0.36-4.58.1 |
tomcatSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 9.0.36-4.58.1 | 9.0.36-4.58.1 |
tomcatSUSE:Manager Proxy 4.0 |
before 9.0.36-4.58.1 | 9.0.36-4.58.1 |
tomcatSUSE:Manager Retail Branch Server 4.0 |
before 9.0.36-4.58.1 | 9.0.36-4.58.1 |
tomcatSUSE:Manager Server 4.0 |
before 9.0.36-4.58.1 | 9.0.36-4.58.1 |
tomcatSUSE:Enterprise Storage 6 |
before 9.0.36-4.58.1 | 9.0.36-4.58.1 |
tomcat6SUSE:Linux Enterprise Point of Sale 11 SP3 |
before 6.0.53-0.57.19.1 | 6.0.53-0.57.19.1 |
tomcat6SUSE:Linux Enterprise Server 11 SP4-LTSS |
before 6.0.53-0.57.19.1 | 6.0.53-0.57.19.1 |
tomcatSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 9.0.115-3.160.1 | 9.0.115-3.160.1 |
tomcatSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 9.0.115-3.160.1 | 9.0.115-3.160.1 |
tomcat7Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 7.0.42-17.0.47-17.0.50-17.0.52-17.0.52-1ubuntu0.1 Show 13 moreShow less7.0.52-1ubuntu0.37.0.52-1ubuntu0.67.0.52-1ubuntu0.77.0.52-1ubuntu0.87.0.52-1ubuntu0.97.0.52-1ubuntu0.107.0.52-1ubuntu0.117.0.52-1ubuntu0.137.0.52-1ubuntu0.147.0.52-1ubuntu0.157.0.52-1ubuntu0.167.0.52-1ubuntu0.16+esm17.0.52-1ubuntu0.16+esm2 |
None known |
tomcat8Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 8.0.26-18.0.28-18.0.30-18.0.32-18.0.32-1ubuntu1 Show 14 moreShow less8.0.32-1ubuntu1.18.0.32-1ubuntu1.28.0.32-1ubuntu1.38.0.32-1ubuntu1.48.0.32-1ubuntu1.58.0.32-1ubuntu1.68.0.32-1ubuntu1.78.0.32-1ubuntu1.88.0.32-1ubuntu1.98.0.32-1ubuntu1.108.0.32-1ubuntu1.118.0.32-1ubuntu1.138.0.32-1ubuntu1.13+esm18.0.32-1ubuntu1.13+esm2 |
None known |
tomcat7Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 7.0.64-17.0.68-17.0.68-1ubuntu0.17.0.68-1ubuntu0.37.0.68-1ubuntu0.4 Show 4 moreShow less7.0.68-1ubuntu0.4+esm17.0.68-1ubuntu0.4+esm27.0.68-1ubuntu0.4+esm37.0.68-1ubuntu0.4+esm4 |
None known |
tomcat8Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 8.5.21-1ubuntu18.5.29-18.5.30-18.5.30-1ubuntu18.5.30-1ubuntu1.2 Show 11 moreShow less8.5.30-1ubuntu1.38.5.30-1ubuntu1.48.5.39-1ubuntu1~18.04.18.5.39-1ubuntu1~18.04.28.5.39-1ubuntu1~18.04.38.5.39-1ubuntu1~18.04.3+esm18.5.39-1ubuntu1~18.04.3+esm28.5.39-1ubuntu1~18.04.3+esm38.5.39-1ubuntu1~18.04.3+esm48.5.39-1ubuntu1~18.04.3+esm58.5.39-1ubuntu1~18.04.3+esm6 |
None known |
tomcat9Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 9.0.16-3~18.04.19.0.16-3ubuntu0.18.04.19.0.16-3ubuntu0.18.04.29.0.16-3ubuntu0.18.04.2+esm19.0.16-3ubuntu0.18.04.2+esm2 Show 6 moreShow less9.0.16-3ubuntu0.18.04.2+esm39.0.16-3ubuntu0.18.04.2+esm49.0.16-3ubuntu0.18.04.2+esm59.0.16-3ubuntu0.18.04.2+esm69.0.16-3ubuntu0.18.04.2+esm79.0.16-3ubuntu0.18.04.2+esm8 |
None known |
tomcat9Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 9.0.24-19.0.27-19.0.31-19.0.31-1ubuntu0.19.0.31-1ubuntu0.2 Show 10 moreShow less9.0.31-1ubuntu0.39.0.31-1ubuntu0.49.0.31-1ubuntu0.59.0.31-1ubuntu0.69.0.31-1ubuntu0.79.0.31-1ubuntu0.89.0.31-1ubuntu0.99.0.31-1ubuntu0.9+esm19.0.31-1ubuntu0.9+esm29.0.31-1ubuntu0.9+esm3 |
None known |
tomcatopenSUSE:Leap 15.2 |
before 9.0.36-lp152.2.19.1 | 9.0.36-lp152.2.19.1 |
tomcatopenSUSE:Tumbleweed |
before 9.0.36-8.4 | 9.0.36-8.4 |
tomcat10openSUSE:Tumbleweed |
before 10.1.14-1.1 | 10.1.14-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-24122 is a medium vulnerability (CVSS 5.9) in Apache Tomcat, published January 14, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 22.9%, the 97th percentile. Fixed in org.apache.tomcat.embed:tomcat-embed-core 10.0.0-M10.
References
lists.apache.org/thread.html/r1595889b083e05986f42b944dc43060d6b083022260b6ea64d2cec52%40%3Cannounce.tomcat.apache.org%3E
openwall.com/lists/oss-security/2021/01/14/1
Show 142 moreShow less
lists.debian.org/debian-lts-announce/2021/03/msg00018.html
oracle.com//security-alerts/cpujul2021.html
security.netapp.com/advisory/ntap-20210212-0008
nvd.nist.gov/vuln/detail/CVE-2021-24122
github.com/apache/tomcat/commit/7f004ac4531c45f9a2a2d1470561fe135cf27bc2
tomcat.apache.org/security-9.html
errata.cloudlinux.com/ubuntu18-els/CLSA-2025-1748282295.html
security-tracker.debian.org/tracker/CVE-2021-24122
advisories.mageia.org/MGASA-2021-0072.html
bugs.mageia.org/show_bug.cgi?id=28093
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1075
access.redhat.com/errata/RHSA-2021:0494
bugzilla.redhat.com/show_bug.cgi?id=1887648
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0494.json
cve.org/CVERecord?id=CVE-2020-1971
openssl.org/news/secadv/20201208.txt
mail-archives.apache.org/mod_mbox/tomcat-announce/202010.mbox/%3C2b767c6e-dcb9-5816-bd69-a3bc0771fef3%40apache.org%3E
suse.com/support/update/announcement/2021/suse-su-20210530-1
bugzilla.suse.com/1180947
ubuntu.com/security/CVE-2021-24122
lists.opensuse.org/archives/list/[email protected]/thread/C43WR2IQX2RWDG6VXRG72VPTVZRF6TIY
Left out here: 22 versions. The JSON record has them.