Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to 8.0.0Upgrade Apache Tomcat to 6.0.39Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 7.0.50 | Mar 3, 2014 | Feb 26, 2014 |
| Centos_linux | — | Upgrade tomcat6-docs-webappUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat6-javadocUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat6-webappsUpgrade tomcat6-admin-webappsUpgrade tomcat6-el-2.1-apiUpgrade tomcat6Upgrade tomcat6-lib | Dec 1, 2016 | Feb 26, 2014 |
| Debian | — | Upgrade tomcat7Upgrade tomcat6 | Mar 28, 2016 | Feb 26, 2014 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | Oct 30, 2017 | Feb 26, 2014 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat to version 6.0.39-0.175.1.19.0.2.0 on Solaris 11.1Upgrade web/java-servlet/tomcat/tomcat-examples to version 6.0.39-0.175.1.19.0.2.0 on Solaris 11.1 | May 29, 2017 | Feb 26, 2014 |
| Oracle_linux | — | Upgrade tomcat6-webappsUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-webappsUpgrade tomcat6-libUpgrade tomcat6-el-2.1-apiUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat-admin-webappsUpgrade tomcat6-javadocUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-docs-webappUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-el-2.2-apiUpgrade tomcat6Upgrade tomcat6-docs-webappUpgrade tomcat-jsvcUpgrade tomcat6-admin-webappsUpgrade tomcat6-jsp-2.1-api | Aug 8, 2017 | Feb 26, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 25, 2014 |
| Suse | — | Upgrade tomcat6-admin-webappsUpgrade tomcat6-jsp-2_1-apiUpgrade tomcat6-javadocUpgrade tomcat6-libUpgrade libtcnative-1-0Upgrade tomcat6-docs-webappUpgrade tomcat6-servlet-2_5-apiUpgrade tomcat6Upgrade tomcat6-webapps | Sep 30, 2014 | Feb 26, 2014 |
| Ubuntu | — | Upgrade libtomcat7-javaUpgrade libtomcat6-java | Nov 8, 2024 | Feb 26, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub