Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to 6.0.39Upgrade Apache Tomcat to 8.0.0Upgrade Apache Tomcat to 7.0.50Upgrade Apache Tomcat to the latest available version | Mar 3, 2014 | Feb 26, 2014 |
| Centos_linux | — | Upgrade tomcat6-jsp-2.1-apiUpgrade tomcat6-admin-webappsUpgrade tomcat6-libUpgrade tomcat6-webappsUpgrade tomcat6-el-2.1-apiUpgrade tomcat6Upgrade tomcat6-servlet-2.5-apiUpgrade tomcat6-javadocUpgrade tomcat6-docs-webapp | Dec 1, 2016 | Feb 26, 2014 |
| Debian | — | Upgrade tomcat7Upgrade tomcat6 | Mar 28, 2016 | Feb 26, 2014 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | Oct 30, 2017 | Feb 26, 2014 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat/tomcat-examples to version 6.0.39-0.175.1.19.0.2.0 on Solaris 11.1Upgrade web/java-servlet/tomcat to version 6.0.39-0.175.1.19.0.2.0 on Solaris 11.1 | May 29, 2017 | Feb 26, 2014 |
| Oracle_linux | — | Upgrade tomcat-jsvcUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat6Upgrade tomcat6-docs-webappUpgrade tomcat6-admin-webappsUpgrade tomcat6-el-2.1-apiUpgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcat6-libUpgrade tomcat6-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcatUpgrade tomcat6-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat-javadocUpgrade tomcat-docs-webappUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webapps | Aug 8, 2017 | Feb 26, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 25, 2014 |
| Suse | — | Upgrade tomcat6-jsp-2_1-apiUpgrade tomcat6-libUpgrade tomcat6-javadocUpgrade tomcat6-docs-webappUpgrade tomcat6-admin-webappsUpgrade libtcnative-1-0Upgrade tomcat6-webappsUpgrade tomcat6Upgrade tomcat6-servlet-2_5-api | Sep 30, 2014 | Feb 26, 2014 |
| Ubuntu | — | Upgrade libtomcat7-javaUpgrade libtomcat6-java | Nov 8, 2024 | Feb 26, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub