The hook
Tomcat often reaches production through embedded servlet containers, Spring Boot-managed dependencies, platform BOMs, or container base images. CVE-2021-25122 is an h2c request mix-up advisory, so FixVibe treats a repo match as dependency evidence, not proof that the deployed service accepts HTTP/2 cleartext upgrade traffic or leaked request data.
How it works
The repo check looks for Tomcat embedded-core and Coyote Maven coordinates in Java build files. Exact declared versions produce the strongest signal; compatible manifest ranges are reported when they clearly allow affected 8.5.x, 9.0.x, or 10.0.x release lines. The finding stays scoped to dependency evidence and does not claim FixVibe sent h2c traffic.
The blast radius
If an affected Tomcat runtime is deployed with the vulnerable h2c path reachable, request headers and limited request body data can be mixed between users under the advisory conditions. A repo match should trigger dependency-tree review, artifact rebuild, connector review, and runtime verification before anyone treats it as confirmed production exposure.
// what fixvibe checks
What FixVibe checks
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Upgrade the active Tomcat release line to 8.5.63, 9.0.43, 10.0.2, or newer. Update direct Tomcat artifacts, BOMs, Spring Boot-managed versions, Gradle constraints, or container base images as needed, then rebuild and redeploy the actual WAR, JAR, or image.