If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade tomcat-servlet-4.0-apiUpgrade tomcat-docs-webappUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-jsvcUpgrade tomcat-javadocUpgrade tomcat-admin-webappsUpgrade tomcat-el-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-servlet-3.1-apiUpgrade tomcatUpgrade tomcat-lib | Sep 28, 2023 | Nov 1, 2022 |
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 8.5.83Upgrade Apache Tomcat to 10.0.27Upgrade Apache Tomcat to 9.0.68Upgrade Apache Tomcat to 10.1.1 | Nov 1, 2022 | Nov 1, 2022 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Jan 16, 2024 |
| Debian | — | Upgrade tomcat9 | Apr 10, 2023 | Nov 1, 2022 |
| Freebsd | — | Upgrade tomcat85Upgrade tomcat10Upgrade tomcatUpgrade tomcat9Upgrade tomcat101Upgrade tomcat-devel | Nov 19, 2022 | Nov 18, 2022 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | May 31, 2023 | Nov 1, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-libUpgrade tomcat-admin-webapps | Feb 9, 2023 | Nov 1, 2022 |
| Suse | — | Upgrade tomcat-embedUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-el-3_0-apiUpgrade tomcat-libUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-javadoc | Nov 24, 2022 | Nov 1, 2022 |
| Ubuntu | — | Upgrade tomcat9 (Ubuntu Pro)Upgrade tomcat8 (Ubuntu Pro)Upgrade libtomcat9-java (Ubuntu Pro)Upgrade libtomcat8-java (Ubuntu Pro)Upgrade tomcat9Upgrade libtomcat9-java | Jul 10, 2024 | Nov 1, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 1, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub