Apache Tomcat h2c Request Mix-Up Advisory

Tomcat often reaches production through embedded servlet containers, Spring Boot-managed dependencies, platform BOMs, or container base images. CVE-2021-25122 is an h2c request mix-up advisory, so FixVibe treats a repo match as dependency evidence, not proof that the deployed service accepts HTTP/2 cleartext upgrade traffic or leaked request data.

The repo check looks for Tomcat embedded-core and Coyote Maven coordinates in Java build files. Exact declared versions produce the strongest signal; compatible manifest ranges are reported when they clearly allow affected 8.5.x, 9.0.x, or 10.0.x release lines. The finding stays scoped to dependency evidence and does not claim FixVibe sent h2c traffic.

If an affected Tomcat runtime is deployed with the vulnerable h2c path reachable, request headers and limited request body data can be mixed between users under the advisory conditions. A repo match should trigger dependency-tree review, artifact rebuild, connector review, and runtime verification before anyone treats it as confirmed production exposure.

Upgrade the active Tomcat release line to 8.5.63, 9.0.43, 10.0.2, or newer. Update direct Tomcat artifacts, BOMs, Spring Boot-managed versions, Gradle constraints, or container base images as needed, then rebuild and redeploy the actual WAR, JAR, or image.