Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 7.0.50Upgrade Apache Tomcat to 8.0.0Upgrade Apache Tomcat to 6.0.39 | Mar 3, 2014 | Feb 26, 2014 |
| Centos_linux | — | Upgrade tomcat6Upgrade tomcat6-webappsUpgrade tomcat6-libUpgrade tomcat6-admin-webappsUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat6-el-2.1-apiUpgrade tomcat6-docs-webappUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat6-javadoc | Dec 1, 2016 | Feb 26, 2014 |
| Debian | — | Upgrade tomcat7Upgrade tomcat6 | Mar 28, 2016 | Feb 26, 2014 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | Oct 30, 2017 | Feb 26, 2014 |
| Oracle Solaris | — | Upgrade web/java-servlet/tomcat to version 6.0.39-0.175.1.19.0.2.0 on Solaris 11.1Upgrade web/java-servlet/tomcat/tomcat-examples to version 6.0.39-0.175.1.19.0.2.0 on Solaris 11.1 | May 29, 2017 | Feb 26, 2014 |
| Oracle_linux | — | Upgrade tomcat-servlet-3.0-apiUpgrade tomcat6-webappsUpgrade tomcat-docs-webappUpgrade tomcat-javadocUpgrade tomcat-jsp-2.2-apiUpgrade tomcat6-javadocUpgrade tomcat6-el-2.1-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-el-2.2-apiUpgrade tomcat6-libUpgrade tomcat-webappsUpgrade tomcat6-servlet-2.5-apiUpgrade tomcat-libUpgrade tomcat6Upgrade tomcat6-docs-webappUpgrade tomcat6-jsp-2.1-apiUpgrade tomcat-jsvcUpgrade tomcat6-admin-webapps | Aug 8, 2017 | Feb 26, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 25, 2014 |
| Suse | — | Upgrade tomcat6-jsp-2_1-apiUpgrade tomcat6-libUpgrade tomcat6-admin-webappsUpgrade tomcat6-docs-webappUpgrade libtcnative-1-0Upgrade tomcat6-javadocUpgrade tomcat6Upgrade tomcat6-webappsUpgrade tomcat6-servlet-2_5-api | Sep 30, 2014 | Feb 26, 2014 |
| Ubuntu | — | Upgrade libtomcat6-javaUpgrade libtomcat7-java | Nov 8, 2024 | Feb 26, 2014 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub