If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade tomcat-javadocUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-webappsUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcatUpgrade tomcat-el-3.0-api | Sep 28, 2023 | Nov 1, 2022 |
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.68Upgrade Apache Tomcat to 10.1.1Upgrade Apache Tomcat to 10.0.27Upgrade Apache Tomcat to 8.5.83 | Nov 1, 2022 | Nov 1, 2022 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Jan 16, 2024 |
| Debian | — | Upgrade tomcat9 | Apr 10, 2023 | Nov 1, 2022 |
| Freebsd | — | Upgrade tomcat9Upgrade tomcat-develUpgrade tomcat101Upgrade tomcat85Upgrade tomcatUpgrade tomcat10 | Nov 19, 2022 | Nov 18, 2022 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | May 31, 2023 | Nov 1, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcatUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-lib | Feb 9, 2023 | Nov 1, 2022 |
| Suse | — | Upgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-embedUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-jsvcUpgrade tomcat-servlet-3_1-apiUpgrade tomcatUpgrade tomcat-admin-webappsUpgrade tomcat-docs-webappUpgrade tomcat-javadoc | Nov 24, 2022 | Nov 1, 2022 |
| Ubuntu | — | Upgrade libtomcat9-javaUpgrade libtomcat9-java (Ubuntu Pro)Upgrade libtomcat8-java (Ubuntu Pro)Upgrade tomcat9Upgrade tomcat9 (Ubuntu Pro) | Jul 10, 2024 | Nov 1, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 1, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub