Every CVE Search/ Get API key

CVE-2023-34981

Apache Tomcat: AJP response header mix-up

7.5 HighFix available

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.12%Up 1.1 points since Jun 22, 2023
90%50%10%1%

What each source reports

NVD Score used 7.5

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Record
CVE-2023-34981
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-732
Updated
2026-11-02
CVE List 7.5

Apache Tomcat: AJP response header mix-up

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Record
CVE-2023-34981
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-732
Updated
2026-11-02
EUVDEUVD-2023-1844 7.5

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Record
EUVD-2023-1844
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-mppv-79ch-vw6q 7.5

Apache Tomcat vulnerable to information leak

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS message would be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Record
GHSA-mppv-79ch-vw6q
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-732
Updated
2026-11-02
OSV 7.5

Apache Tomcat: AJP response header mix-up

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Record
CVE-2023-34981
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2023-34981 7.5

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Record
DEBIAN-CVE-2023-34981
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-mppv-79ch-vw6q 7.5

Apache Tomcat vulnerable to information leak

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS message would be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Record
GHSA-mppv-79ch-vw6q
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-732
Updated
2026-11-02
OSVUBUNTU-CVE-2023-34981 7.5

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Record
UBUNTU-CVE-2023-34981
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVBIT-tomcat-2023-34981 No score

Apache Tomcat: AJP response header mix-up

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Record
BIT-tomcat-2023-34981
Updated
2026-11-02
OSVCLSA-2025-1748282295 No score

Fix of 34 CVEs

  • SECURITY UPDATE: Misc vulnerability fixes
    • CVE-2019-12418, CVE-2019-17563, CVE-2020-1935, CVE-2020-11996, CVE-2020-13934, CVE-2020-13935, CVE-2020-13943, CVE-2020-17527, CVE-2021-24122, CVE-2021-30639, CVE-2021-30640, CVE-2021-33037, CVE-2021-42340, CVE-2021-43980, CVE-2022-25762, CVE-2022-34305, CVE-2022-45143, CVE-2023-24998, CVE-2023-28709, CVE-2023-34981, CVE-2023-42794, CVE-2024-21733
  • Update to 8.5.100
    • debian/rules, debian/libtomcat8-java.poms, debian/maven.rules, debian/tomcat8-common.links, debian/patches/0018-fix-manager-webapp.patch, debian/patches/0019-add-distribution-to-error-page.patch, debian/patches/0021-dont-test-unsupported-ciphers.patch, debian/patches/0101-skipping-tests-incompatible-with-firewall.patch: updated
    • debian/patches/0002-do-not-load-AJP13-connector-by-default.patch, debian/patches/0026-easymock4-compatibility.patch: removed as they were applied in upstream
    • CVE-2019-0221.patch, CVE-2019-10072-1.patch, CVE-2019-10072-2.patch, CVE-2022-42252.patch, CVE-2020-1938.patch, CVE-2021-25122.patch, CVE-2021-41079.patch, CVE-2022-29885.patch, CVE-2020-9484.patch, CVE-2021-25329-pre1.patch, CVE-2021-25329.patch, CVE-2022-23181.patch, CVE-2023-44487.patch, CVE-2023-46589-pre1.patch, CVE-2023-46589-pre2.patch, CVE-2023-46589-pre3.patch, CVE-2023-46589-pre4.patch, CVE-2023-46589.patch: removed because these CVEs were fixed in upstream
  • Internal tests
    • debian/test_certs/*: updated from upstream branch 9.0.x, as the 8.0.x certs were expired
Record
CLSA-2025-1748282295
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2023-34981 No score

CVE-2023-34981 in org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2023-34981 in the org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2023-34981
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.0-M5 to 11.0.0-M5
11.0.0-M6
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.8 to 10.1.8
10.1.9
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.74 to 9.0.74
9.0.75
org.apache.tomcat:tomcat-coyote
Maven
 8.5.88 to 8.5.88
8.5.89
tomcat
Bitnami
 8.5.88 up to 8.5.89, 9.0.74 up to 9.0.75, 10.1.8 up to 10.1.9
8.5.899.0.7510.1.9
libtomcat8-embed-java
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1
8.5.100-1ubuntu1~18.04.1+tuxcare.els1
libtomcat8-java
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1
8.5.100-1ubuntu1~18.04.1+tuxcare.els1
tomcat8
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1
8.5.100-1ubuntu1~18.04.1+tuxcare.els1
tomcat8-admin
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1
8.5.100-1ubuntu1~18.04.1+tuxcare.els1
tomcat8-common
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1
8.5.100-1ubuntu1~18.04.1+tuxcare.els1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
tomcat8-docs
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1
8.5.100-1ubuntu1~18.04.1+tuxcare.els1
tomcat8-examples
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1
8.5.100-1ubuntu1~18.04.1+tuxcare.els1
tomcat8-user
TuxCare:Ubuntu:18.04
 before 8.5.100-1ubuntu1~18.04.1+tuxcare.els1
8.5.100-1ubuntu1~18.04.1+tuxcare.els1
tomcat10
Debian:13
 before 10.1.10-1
10.1.10-1
tomcat10
Debian:14
 before 10.1.10-1
10.1.10-1
org.apache.tomcat.embed:tomcat-embed-core
Maven
 11.0.0-M5 up to 11.0.0-M6
11.0.0-M6
org.apache.tomcat.embed:tomcat-embed-core
Maven
 10.1.8 up to 10.1.9
10.1.9
org.apache.tomcat.embed:tomcat-embed-core
Maven
 9.0.74 up to 9.0.75
9.0.75
org.apache.tomcat:tomcat-coyote
Maven
 8.5.88 up to 8.5.89
8.5.89
org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 9.0.74-aikido.2
9.0.74-aikido.29.0.74-aikido.1
io.root.org.apache.tomcat.embed:tomcat-embed-core
Root:Maven
 before 9.0.74-root.io.2
9.0.74-root.io.29.0.74-root.io.1

History

History
RecordedChangedSources
affected
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-34981 is a high vulnerability (CVSS 7.5) in Apache Tomcat, published June 21, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. Fixed in org.apache.tomcat.embed:tomcat-embed-core 11.0.0-M6.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open