Der Köder
Tomcat often reaches production through embedded servlet containers, Spring Boot-managed dependencies, platform BOMs, or container base images. CVE-2021-25122 is an h2c request mix-up advisory, so FixVibe treats a repo match as dependency evidence, not proof that the deployed service accepts HTTP/2 cleartext upgrade traffic or leaked request data.
So funktioniert's
The repo check looks for Tomcat embedded-core and Coyote Maven coordinates in Java build files. Exact declared versions produce the strongest signal; compatible manifest ranges are reported when they clearly allow affected 8.5.x, 9.0.x, or 10.0.x release lines. The finding stays scoped to dependency evidence and does not claim FixVibe sent h2c traffic.
Die Auswirkungen
If an affected Tomcat runtime is deployed with the vulnerable h2c path reachable, request headers and limited request body data can be mixed between users under the advisory conditions. A repo match should trigger dependency-tree review, artifact rebuild, connector review, and runtime verification before anyone treats it as confirmed production exposure.
// was fixvibe prüft
Was FixVibe prüft
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Wasserdichte Verteidigung
Upgrade the active Tomcat release line to 8.5.63, 9.0.43, 10.0.2, or newer. Update direct Tomcat artifacts, BOMs, Spring Boot-managed versions, Gradle constraints, or container base images as needed, then rebuild and redeploy the actual WAR, JAR, or image.