UpHeron
All vulnerabilities

Servers and applications

CVE-2023-34981

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Severity
High 7.5
Published
21 Jun 2023
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • Version 8.5.88
  • Version 9.0.74
  • Version 10.1.8
  • Version 11.0.0-milestone5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-34981
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-34981