CVE-2021-24122: tomcat-embed-websocket fixed in 10.0.0-M9, 9.0.39, 8.5.59 and 1 more

CVE-2021-24122 PUBLISHED CVSS 5.900000095367432 MEDIUM

Information Disclosure in Apache Tomcat

Record from NVD · Published January 14, 2021

tomcat-embed-websocket is fixed in 10.0.0-M9, 9.0.39, 8.5.59 and 1 more (Maven Central)

When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root cause was the unexpected behaviour of the JRE API File.getCanonicalPath() which in turn was caused by the inconsistent behaviour of the Windows API (FindFirstFileW) in some circumstances.

EPSS 22.85% · 97.7th percentile

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
org.apache.tomcat.embed:tomcat-embed-websocket	Maven Central	10.0.0-M9, 9.0.39, 8.5.59, 7.0.106
org.apache.tomcat:tomcat-coyote	Maven Central	10.0.0-M9, 9.0.39, 8.5.59, 7.0.106
tomcat:jasper-runtime	Maven Central	10.0.0-M9, 9.0.39, 8.5.59, 7.0.106
tomcat:catalina	Maven Central	10.0.0-M9, 9.0.39, 8.5.59, 7.0.106
org.apache.tomcat:coyote	Maven Central	10.0.0-M9, 9.0.39, 8.5.59, 7.0.106
org.apache.tomcat.embed:tomcat-embed-core	Maven Central	10.0.0-M9, 10.0.0-M10, 9.0.40, 9.0.39, 8.5.60, 8.5.59, 7.0.107, 7.0.106
org.apache.tomcat:tomcat-util	Maven Central	9.0.39, 8.5.59, 7.0.106
org.apache.tomcat:tomcat-catalina	Maven Central	10.0.0-M9, 9.0.39, 8.5.59, 7.0.106
org.apache.tomcat:tomcat	Maven Central	10.0.0-M9, 9.0.39, 8.5.59, 7.0.106
tomcat-jsp-2.2-api	Amazon Linux	7.0.76-10.amzn2.0.10
tomcat-javadoc	Amazon Linux	7.0.76-10.amzn2.0.10
tomcat	Bitnami	9.0.40, 8.5.60, 7.0.107

13 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

5.900000095367432

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

22.85%

97.7th percentile

Affected products

Vendor	Product	Versions
apache	tomcat	7.0.0, 8.5.0, 9.0.1
debian	debian_linux	9.0
oracle	agile_product_lifecycle_management	9.3.3, 9.3.6
oracle	agile_plm	9.3.3, 9.3.6

Timeline

Jan 14, 2021 CVE Published
Apr 14, 2021 EPSS Score (30 in total, the first dated here)
Mar 17, 2026 Security Advisory (33 in total, the first dated here)
Aug 16, 2026 Coalition ESS Score
Nov 3, 2026 Distribution Patch (29 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2021-24122
vulnetix vdb fixes CVE-2021-24122

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-24122/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →