Homepage

Race Condition The advisory has been revoked - it doesn't affect any version of package xalan-j2  (opens in a new tab)

Threat Intelligence

EPSS
11.16% (96th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-XALANJ2-1374265
  • published26 Jul 2021
  • disclosed22 Jul 2018
Report a new vulnerability Found a mistake?

Introduced: 22 Jul 2018

CVE-2018-8037  (opens in a new tab)
CWE-362  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream xalan-j2 package and not the xalan-j2 package as distributed by RHEL.

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.

References