If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possibl…

Overview

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.

Affected

• tomcat = 8.5.0
• tomcat = 8.5.1
• tomcat = 8.5.2
• tomcat = 8.5.3
• tomcat = 8.5.4
• tomcat = 8.5.5
• tomcat = 8.5.6
• tomcat = 8.5.7
• tomcat = 8.5.8
• tomcat = 8.5.9
• tomcat = 8.5.10
• tomcat = 8.5.11
• tomcat = 8.5.12
• tomcat = 8.5.13
• tomcat = 8.5.14
• tomcat = 8.5.15
• tomcat = 8.5.16
• tomcat = 8.5.17
• tomcat = 8.5.18
• tomcat = 8.5.19
• tomcat = 8.5.20
• tomcat = 8.5.21
• tomcat = 8.5.22
• tomcat = 8.5.23
• tomcat = 8.5.24
• tomcat = 8.5.25
• tomcat = 8.5.26
• tomcat = 8.5.27
• tomcat = 8.5.28
• tomcat = 8.5.29
• tomcat = 8.5.30
• tomcat = 8.5.31
• tomcat = 8.5.32
• tomcat = 8.5.33
• tomcat = 8.5.34
• tomcat = 8.5.35
• tomcat = 8.5.36
• tomcat = 8.5.37
• tomcat = 8.5.38
• tomcat = 8.5.39
• tomcat = 8.5.40
• tomcat = 8.5.41
• tomcat = 8.5.42
• tomcat = 8.5.43
• tomcat = 8.5.44
• tomcat = 8.5.45
• tomcat = 8.5.46
• tomcat = 8.5.47
• tomcat = 8.5.48
• tomcat = 8.5.49
• tomcat = 8.5.50
• tomcat = 8.5.51
• tomcat = 8.5.52
• tomcat = 8.5.53
• tomcat = 8.5.54
• tomcat = 8.5.55
• tomcat = 8.5.56
• tomcat = 8.5.57
• tomcat = 9.0.0
• tomcat = 9.0.1
• tomcat = 9.0.2
• tomcat = 9.0.3
• tomcat = 9.0.4
• tomcat = 9.0.5
• tomcat = 9.0.6
• tomcat = 9.0.7
• tomcat = 9.0.8
• tomcat = 9.0.9
• tomcat = 9.0.10
• tomcat = 9.0.11
• tomcat = 9.0.12
• tomcat = 9.0.13
• tomcat = 9.0.14
• tomcat = 9.0.15
• tomcat = 9.0.16
• tomcat = 9.0.17
• tomcat = 9.0.18
• tomcat = 9.0.19
• tomcat = 9.0.20
• tomcat = 9.0.21
• tomcat = 9.0.22
• tomcat = 9.0.23
• tomcat = 9.0.24
• tomcat = 9.0.25
• tomcat = 9.0.26
• tomcat = 9.0.27
• tomcat = 9.0.28
• tomcat = 9.0.29
• tomcat = 9.0.30
• tomcat = 9.0.31
• tomcat = 9.0.32
• tomcat = 9.0.33
• tomcat = 9.0.34
• tomcat = 9.0.35
• tomcat = 9.0.36
• tomcat = 9.0.37
• tomcat = 10.0.0
• debian_linux = 9.0
• debian_linux = 10.0
• instantis_enterprisetrack = 17.1

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.