The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to 6.0.39Upgrade Apache Tomcat to 8.0.0Upgrade Apache Tomcat to 7.0.47Upgrade Apache Tomcat to the latest available version | Mar 3, 2014 | Feb 26, 2014 |
| Centos_linux | — | Upgrade tomcat6-admin-webappsUpgrade tomcat6-docs-webappUpgrade tomcat6Upgrade tomcat6-webappsUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat6-libUpgrade tomcat6-el-2.1-apiUpgrade tomcat6-javadoc | Dec 1, 2016 | Feb 26, 2014 |
| Debian | — | Upgrade tomcat7Upgrade tomcat6 | Mar 28, 2016 | Feb 26, 2014 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | Oct 30, 2017 | Feb 26, 2014 |
| Hpux | — | Update hpuxws22APACHE.MOD_JK2 to the latest versionUpdate hpuxws22APACHE.MOD_PERL2 to the latest versionUpdate hpuxws22APCH32.WEBPROXY2 to the latest versionUpdate hpuxws22APACHE.MOD_JK to the latest versionUpdate hpuxws22APCH32.APACHE2 to the latest versionUpdate hpuxws22APACHE.WEBPROXY2 to the latest versionUpdate hpuxws22APACHE.MOD_PERL to the latest versionUpdate hpuxws22APCH32.AUTH_LDAP2 to the latest versionUpdate hpuxws22APCH32.MOD_JK to the latest versionUpdate hpuxws22APACHE.WEBPROXY to the latest versionUpdate hpuxws22APACHE.APACHE to the latest versionUpdate hpuxws22TOMCAT.TOMCAT to the latest versionUpdate hpuxws22APACHE.PHP to the latest versionUpdate hpuxws22APCH32.MOD_PERL2 to the latest versionUpdate hpuxws22APACHE.APACHE2 to the latest versionUpdate hpuxws22APCH32.WEBPROXY to the latest versionUpdate hpuxws22APCH32.PHP2 to the latest versionUpdate hpuxws22APCH32.MOD_JK2 to the latest versionUpdate hpuxws22APCH32.APACHE to the latest versionUpdate hpuxws22APACHE.AUTH_LDAP to the latest versionUpdate hpuxws22APACHE.PHP2 to the latest versionUpdate hpuxws22APCH32.AUTH_LDAP to the latest versionUpdate hpuxws22APCH32.MOD_PERL to the latest versionUpdate hpuxws22APCH32.PHP to the latest versionUpdate hpuxws22APACHE.AUTH_LDAP2 to the latest version | Aug 11, 2017 | Feb 26, 2014 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat/tomcat-examples to version 6.0.39-0.175.1.19.0.2.0 on Solaris 11.1Upgrade web/java-servlet/tomcat to version 6.0.39-0.175.1.19.0.2.0 on Solaris 11.1 | May 29, 2017 | Feb 26, 2014 |
| Oracle_linux | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcat-libUpgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat6-servlet-2.5-apiUpgrade tomcatUpgrade tomcat6-webappsUpgrade tomcat-webappsUpgrade tomcat6-docs-webappUpgrade tomcat6-el-2.1-apiUpgrade tomcat6-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat6-admin-webappsUpgrade tomcat6-libUpgrade tomcat-javadocUpgrade tomcat6Upgrade tomcat-jsp-2.2-api | Aug 8, 2017 | Feb 26, 2014 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Feb 25, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 25, 2014 |
| Ubuntu | — | Upgrade libtomcat7-javaUpgrade libtomcat6-java | Nov 8, 2024 | Feb 26, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub