Apache Tomcat Race Condition vulnerability
Moderate severity
GitHub Reviewed
Published
Oct 17, 2018
to the GitHub Advisory Database
•
Updated Feb 22, 2024
Package
Affected versions
>= 8.5.5, < 8.5.32
>= 9.0.0.M9, < 9.0.10
Patched versions
8.5.32
9.0.10
Description
Published by the National Vulnerability Database
Aug 2, 2018
Published to the GitHub Advisory Database
Oct 17, 2018
Reviewed
Jun 16, 2020
Last updated
Feb 22, 2024
Credits
-
sunSUNQ Analyst
If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.
References