Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 4.1.36Upgrade Apache Tomcat to 6.0.11Upgrade Apache Tomcat to 5.5.23Upgrade Apache Tomcat to 5.0.0 | May 17, 2012 | Jun 30, 2005 |
| Apple Osx Tomcat | — | Apply OS X security update 2007-007 | Dec 16, 2011 | Jul 5, 2005 |
| Freebsd | — | Upgrade apache-tomcatUpgrade tomcatUpgrade jakarta-tomcat | Dec 10, 2025 | Jul 24, 2007 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat to version 6.0.39-0.175.1.19.0.2.0 on Solaris 11.1Upgrade web/java-servlet/tomcat/tomcat-examples to version 6.0.39-0.175.1.19.0.2.0 on Solaris 11.1 | May 29, 2017 | Jul 5, 2005 |
| Oracle_linux | — | Upgrade tomcat5-jasperUpgrade tomcat5Upgrade tomcat5-server-libUpgrade tomcat5-webappsUpgrade tomcat5-jsp-2.0-api-javadocUpgrade tomcat5-jasper-javadocUpgrade tomcat5-common-libUpgrade jakarta-commons-modelerUpgrade tomcat5-admin-webappsUpgrade tomcat5-servlet-2.4-api-javadocUpgrade jakarta-commons-modeler-javadocUpgrade tomcat5-servlet-2.4-apiUpgrade tomcat5-jsp-2.0-api | Oct 16, 2024 | Jun 30, 2005 |
| Suse | — | Upgrade jakarta-tomcatUpgrade apache2-jakarta-tomcat-connectorsUpgrade tomcat5-admin-webappsUpgrade suse-releaseUpgrade tomcat5Upgrade jakarta-tomcat-docUpgrade tomcat5-webappsUpgrade apache-jakarta-tomcat-connectorsUpgrade jakarta-tomcat-examplesUpgrade apache2-mod_jk | Feb 17, 2015 | Jul 5, 2005 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub