CVE-2023-34981 Apache Tomcat: AJP response header mix-up

What is CVE-2023-34981?

CVE-2023-34981 is a high-severity vulnerability in Apache Tomcat, published on 21 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP SEND_HEADERS messare woudl be sent for the response which in turn meant that at least one AJP proxy (mod_proxy_ajp) would use the response headers from the previous request leading to an information leak.

Weakness: CWE-732

Which versions are affected by CVE-2023-34981?

9 open source packages ship an affected version, including org.apache.tomcat.embed:tomcat-embed-core, tomcat and org.apache.tomcat:tomcat-coyote. It affects 1 product.

Products include Apache Tomcat.

How do I fix CVE-2023-34981?

Upgrade org.apache.tomcat.embed:tomcat-embed-core to a fixed version for your release line: 10.1.9, 11.0.0-M6 or 9.0.75.

Is CVE-2023-34981 being exploited?

There is no known exploitation of CVE-2023-34981 in the wild and no public exploit code.

Other vulnerabilities in Apache Tomcat

• CVE-2025-24813 Apache Tomcat Path Equivalence Exploited Critical 10.0
• CVE-2016-8735 Apache Tomcat Remote Code Execution Exploited Critical 9.8
• CVE-2017-12617 Apache Tomcat Remote Code Execution Exploited High 8.1
• CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution Exploited High 8.1
• CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Exploited High 7.5

All Apache Tomcat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-tomcat-2023-34981, DEBIAN-CVE-2023-34981, GHSA-mppv-79ch-vw6q, ROOT-APP-MAVEN-CVE-2023-34981.