--- id: CVE-2021-25329 title: The fix for CVE-2020-9484 was incomplete summary: >- The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was … severity: high cvss: 7 cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-502 vendor: apache product: tomcat affected: - 'tomcat >= 7.0.0, <= 7.0.107' - 'tomcat >= 8.5.0, <= 8.5.61' - 'tomcat >= 9.0.0, <= 9.0.41' - tomcat = 9.0.0 - tomcat = 10.0.0 - debian_linux = 9.0 - debian_linux = 10.0 - agile_product_lifecycle_management = 9.3.3 - agile_product_lifecycle_management = 9.3.6 - communications_cloud_native_core_policy = 1.14.0 - communications_cloud_native_core_security_edge_protection_proxy = 1.6.0 - communications_instant_messaging_server = 10.0.1.5.0 - database = 12.2.0.1 - database = 19c - database = 21c - graph_server_and_client < 21.3.0 - instantis_enterprisetrack = 17.1 - instantis_enterprisetrack = 17.2 - instantis_enterprisetrack = 17.3 - managed_file_transfer = 12.2.1.3.0 - managed_file_transfer = 12.2.1.4.0 - mysql_enterprise_monitor <= 8.0.23 - siebel_ui_framework < 21.9 - siebel_ui_framework = 21.9 patched: - graph_server_and_client 21.3.0 - siebel_ui_framework 21.9 published: '2021-03-01' updated: '2026-10-08' sourceUpdated: '2026-10-08T21:17:34.640' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-25329' references: - url: 'http://www.openwall.com/lists/oss-security/2021/03/01/2' label: security@apache.org - url: >- https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77%40%3Cusers.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r732b2ca289dc02df2de820e8775559abd6c207f159e39f559547a085%40%3Cusers.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc%40%3Cusers.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f%40%3Cusers.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cdev.tomcat.apache.org%3E label: security@apache.org - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cusers.tomcat.apache.org%3E label: security@apache.org - url: 'https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html' label: security@apache.org - url: 'https://security.gentoo.org/glsa/202208-34' label: security@apache.org - url: 'https://security.netapp.com/advisory/ntap-20210409-0002/' label: security@apache.org - url: 'https://www.debian.org/security/2021/dsa-4891' label: security@apache.org - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: security@apache.org - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: security@apache.org - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: security@apache.org - url: 'http://www.openwall.com/lists/oss-security/2021/03/01/2' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r11ce01e8a4c7269b88f88212f21830edf73558997ac7744f37769b77%40%3Cusers.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r732b2ca289dc02df2de820e8775559abd6c207f159e39f559547a085%40%3Cusers.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/r8a2ac0e476dbfc1e6440b09dcc782d444ad635d6da26f0284725a5dc%40%3Cusers.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rb51ccd58b2152fc75125b2406fc93e04ca9d34e737263faa6ff0f41f%40%3Cusers.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rf6d5d57b114678d8898005faef31e9fd6d7c981fcc4ccfc3bc272fc9%40%3Cdev.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cannounce.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cdev.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.apache.org/thread.html/rfe62fbf9d4c314f166fe8c668e50e5d9dd882a99447f26f0367474bf%40%3Cusers.tomcat.apache.org%3E label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2021/03/msg00018.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202208-34' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20210409-0002/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2021/dsa-4891' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-25329.json - url: 'https://access.redhat.com/security/cve/CVE-2021-25329' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1934061' - url: 'https://www.cve.org/CVERecord?id=CVE-2021-25329' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-25329' - url: >- http://mail-archives.apache.org/mod_mbox/tomcat-announce/202103.mbox/%3C811bba77-e74e-9f9b-62ca-5253a09ba84f%40apache.org%3E - url: 'https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.0.2' - url: 'https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.108' - url: 'https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.63' - url: 'https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.43' - url: 'https://access.redhat.com/errata/RHSA-2021:2561' - url: 'https://access.redhat.com/errata/RHSA-2022:5532' - url: 'https://access.redhat.com/errata/RHSA-2021:2562' - url: 'https://access.redhat.com/errata/RHSA-2021:3425' tags: - nvd - csaf - vex - red-hat - cve.org epss: 0.09491 epssPercentile: 0.95415 ingestedAt: '2026-08-25T17:29:31.171Z' ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-10-08T20:55:35.550192Z' --- ## Overview The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue. ## Affected - `tomcat >= 7.0.0, <= 7.0.107` - `tomcat >= 8.5.0, <= 8.5.61` - `tomcat >= 9.0.0, <= 9.0.41` - `tomcat = 9.0.0` - `tomcat = 10.0.0` - `debian_linux = 9.0` - `debian_linux = 10.0` - `agile_product_lifecycle_management = 9.3.3` - `agile_product_lifecycle_management = 9.3.6` - `communications_cloud_native_core_policy = 1.14.0` - `communications_cloud_native_core_security_edge_protection_proxy = 1.6.0` - `communications_instant_messaging_server = 10.0.1.5.0` - `database = 12.2.0.1` - `database = 19c` - `database = 21c` - `graph_server_and_client < 21.3.0` - `instantis_enterprisetrack = 17.1` - `instantis_enterprisetrack = 17.2` - `instantis_enterprisetrack = 17.3` - `managed_file_transfer = 12.2.1.3.0` - `managed_file_transfer = 12.2.1.4.0` - `mysql_enterprise_monitor <= 8.0.23` - `siebel_ui_framework < 21.9` - `siebel_ui_framework = 21.9` ## Remediation Upgrade past the affected range: - `graph_server_and_client 21.3.0` - `siebel_ui_framework 21.9` ## Vendor advisories - **RHSA-2021:2561** · Red Hat · fixed in: Red Hat JBoss Web Server 5.5 for RHEL 7 Server, Red Hat JBoss Web Server 5.5 for RHEL 8 · released 2021-06-29 · [advisory](https://access.redhat.com/errata/RHSA-2021:2561) - **RHSA-2022:5532** · Red Hat · fixed in: Red Hat Fuse 7.11 · released 2022-07-07 · [advisory](https://access.redhat.com/errata/RHSA-2022:5532) - **RHSA-2021:2562** · Red Hat · fixed in: Red Hat JBoss Web Server 5 · released 2021-06-29 · [advisory](https://access.redhat.com/errata/RHSA-2021:2562) - **RHSA-2021:3425** · Red Hat · fixed in: Red Hat support for Spring Boot 2.3.10 · released 2021-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2021:3425) - **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat JBoss Data Grid 6, Red Hat JBoss Data Virtualization 6, Red Hat JBoss Enterprise Application Platform 6, … · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat JBoss Data Grid 6, Red Hat JBoss Data Virtualization 6, … · updated 2026-10-01 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-25329.json)