CVE-2023-42795: Apache Tomcat Information Disclosure Flaw

CVE-2023-42795 Overview

CVE-2023-42795 is an Incomplete Cleanup vulnerability affecting Apache Tomcat, one of the most widely deployed open-source Java servlet containers. The vulnerability exists in how Tomcat recycles various internal objects during request processing. When an error occurs during the recycling process, Tomcat may skip certain cleanup steps, causing information from the current request/response to leak into subsequent requests.

This vulnerability allows attackers to potentially access sensitive information from other users' sessions or requests without authentication, as the information disclosure can occur passively through normal server operations.

Critical Impact

Information leakage between requests can expose sensitive user data, session tokens, authentication credentials, or application-specific data from one request to another user's subsequent request.

Affected Products

• Apache Tomcat 11.0.0-M1 through 11.0.0-M11
• Apache Tomcat 10.1.0-M1 through 10.1.13
• Apache Tomcat 9.0.0-M1 through 9.0.80
• Apache Tomcat 8.5.0 through 8.5.93
• Debian Linux 10.0, 11.0, and 12.0

Discovery Timeline

• 2023-10-10 - CVE-2023-42795 published to NVD
• 2025-08-07 - Last updated in NVD database

Technical Details for CVE-2023-42795

Vulnerability Analysis

This vulnerability is classified under CWE-459 (Incomplete Cleanup), which occurs when a product does not properly clear previously used resources that may still contain sensitive data before they are reused. In Apache Tomcat's architecture, internal objects such as request and response buffers are recycled for performance optimization. When these objects are reused without complete cleanup, residual data from previous requests can persist and become accessible in subsequent request/response cycles.

The flaw is particularly concerning in multi-tenant environments or applications handling sensitive user data, where information boundaries between users must be strictly maintained. An error condition during the recycling process triggers the incomplete cleanup, meaning the vulnerability may manifest intermittently depending on server load and error conditions.

Root Cause

The root cause stems from improper error handling in Tomcat's internal object recycling mechanism. When recycling request/response objects for reuse, if an exception or error occurs during the cleanup phase, the process may terminate early without fully clearing all data fields. This leaves portions of the previous request/response data intact in the recycled object, which is then assigned to handle a new incoming request.

The recycling optimization is designed to reduce memory allocation overhead, but the incomplete cleanup allows data bleed-through when errors interrupt the normal cleanup sequence. Older, end-of-life versions of Tomcat may also be affected by this issue.

Attack Vector

The attack vector for CVE-2023-42795 is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Sending requests to a vulnerable Tomcat server that may trigger error conditions during object recycling
2. Monitoring subsequent responses for leaked information from other users' requests
3. Potentially harvesting session identifiers, authentication tokens, or sensitive application data that persists across request boundaries

The exploitation does not require specific privileges and can be performed remotely against any network-accessible Tomcat instance. The information disclosed could include HTTP headers, POST data, cookies, or other request/response content from previous users.

Detection Methods for CVE-2023-42795

Indicators of Compromise

• Unexpected data appearing in HTTP responses that does not correlate with the current request
• Log entries indicating recycling errors or exceptions in Tomcat's internal processing
• Users reporting seeing other users' data or session information
• Anomalous HTTP response sizes or content that suggests data concatenation from multiple requests

Detection Strategies

• Monitor Tomcat application logs for recycling-related exceptions or warnings using the catalina.out log file
• Implement application-level logging to track request/response content for anomalies
• Deploy web application firewalls (WAF) with rules to detect information leakage patterns
• Use SentinelOne Singularity Platform to monitor for unusual Tomcat process behavior and memory access patterns

Monitoring Recommendations

• Enable verbose logging in Tomcat to capture recycling process events and potential errors
• Implement real-time log analysis to detect patterns indicative of incomplete cleanup events
• Monitor network traffic for responses containing mixed or unexpected data fragments
• Configure alerting for Tomcat error rates that may indicate conditions triggering the vulnerability

How to Mitigate CVE-2023-42795

Immediate Actions Required

• Upgrade Apache Tomcat to version 11.0.0-M12 or later for the 11.x branch
• Upgrade Apache Tomcat to version 10.1.14 or later for the 10.1.x branch
• Upgrade Apache Tomcat to version 9.0.81 or later for the 9.x branch
• Upgrade Apache Tomcat to version 8.5.94 or later for the 8.5.x branch
• Apply Debian security patches as documented in DSA-5521 and DSA-5522 for Debian-based systems

Patch Information

Apache has released security patches addressing this vulnerability across all affected version branches. The fix ensures that the object recycling process completes all necessary cleanup steps even when errors occur during the process.

For detailed patch information, refer to the Apache Mailing List Discussion. Additional security advisories are available from Debian Security Advisory DSA-5521, Debian Security Advisory DSA-5522, and NetApp Security Advisory NTAP-20231103-0007.

Workarounds

• If immediate patching is not possible, consider implementing request isolation at the reverse proxy or load balancer level
• Enable additional error handling and cleanup routines at the application level to minimize sensitive data in request/response objects
• Consider deploying Tomcat instances with reduced thread pool sizes to limit the potential scope of information leakage
• Implement session invalidation and cleanup policies to reduce sensitive data retention in recycled objects

# Verify current Tomcat version
cd $CATALINA_HOME
./bin/version.sh

# Example: Upgrade Tomcat on Linux systems
# Stop Tomcat service
systemctl stop tomcat

# Backup current installation
cp -r $CATALINA_HOME $CATALINA_HOME.backup

# Download and extract patched version (example for 9.0.81)
wget https://archive.apache.org/dist/tomcat/tomcat-9/v9.0.81/bin/apache-tomcat-9.0.81.tar.gz
tar -xzf apache-tomcat-9.0.81.tar.gz

# Restart Tomcat service
systemctl start tomcat