Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L H L N U H H H 7.0 .0949 95.4 —
AFFECTED Product Versions Fixed Apache Tomcat Apache Tomcat 10 – —
TIMELINE Jan 19 Reserved by apache Mar 1 Published (CNA: apache) Oct 8 ENRICHED — CVE-2021-25329 (Apache Software Foundation Apache Tomcat). Received CVSS 7.0 and CPE data from NVD.
The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
| Date | Event | Detail |
|---|---|---|
| January 19, 2021 | Reserved | Reserved by apache |
| March 1, 2021 | Published | Published (CNA: apache) |
| October 8, 2026 | ENRICHED | ENRICHED — CVE-2021-25329 (Apache Software Foundation Apache Tomcat). Received CVSS 7.0 and CPE data from NVD. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Apache Software Foundation | Apache Tomcat | — | Apache Tomcat 10 | — |
Authoritative record: CVE-2021-25329 at cve.org
Vendors: apache
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-25329 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
