CVE-2023-34981

Name: CVE-2023-34981
Creator: NVD / NIST
Published: 2023-06-21T11:15:09.41+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 1.12%

Last modified Jun 17, 2026

CVE-2023-34981 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.. EPSS estimates a 1.12% chance of exploitation in the next 30 days.

Description

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability

1.12%

61.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-732

Affected Software

Vendor	Product	Versions	Update
Apache	Tomcat	8.5.88	—
Apache	Tomcat	9.0.74	—
Apache	Tomcat	10.1.8	—
Apache	Tomcat	11.0.0	Milestone5

References

https://lists.apache.org/thread/j1ksjh9m9gx1q60rtk1sbzmxhvj5h5qzMailing List, Vendor Advisory
https://security.netapp.com/advisory/ntap-20230714-0003/Third Party Advisory
https://lists.apache.org/thread/j1ksjh9m9gx1q60rtk1sbzmxhvj5h5qzMailing List, Vendor Advisory
https://security.netapp.com/advisory/ntap-20230714-0003/Third Party Advisory

Timeline

Published: Jun 21, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-34981?

How severe is CVE-2023-34981?

CVE-2023-34981 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.12% probability of exploitation in the next 30 days.

How do I fix CVE-2023-34981?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-34981?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST