If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade tomcat-servlet-3.1-apiUpgrade tomcatUpgrade tomcat-libUpgrade tomcat-el-3.0-apiUpgrade tomcat-admin-webappsUpgrade tomcat-webappsUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsvcUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-javadoc | Sep 28, 2023 | Nov 1, 2022 |
| Apache Tomcat | — | Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 9.0.68Upgrade Apache Tomcat to 10.1.1Upgrade Apache Tomcat to 10.0.27Upgrade Apache Tomcat to 8.5.83 | Nov 1, 2022 | Nov 1, 2022 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Jan 16, 2024 |
| Debian | — | Upgrade tomcat9 | Apr 10, 2023 | Nov 1, 2022 |
| Freebsd | — | Upgrade tomcat-develUpgrade tomcat9Upgrade tomcat101Upgrade tomcatUpgrade tomcat10Upgrade tomcat85 | Nov 19, 2022 | Nov 18, 2022 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | May 31, 2023 | Nov 1, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-admin-webappsUpgrade tomcat-libUpgrade tomcat-el-3.0-apiUpgrade tomcatUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-api | Feb 9, 2023 | Nov 1, 2022 |
| Suse | — | Upgrade tomcat-el-3_0-apiUpgrade tomcat-jsvcUpgrade tomcat-embedUpgrade tomcat-jsp-2_3-apiUpgrade tomcat-webappsUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-libUpgrade tomcat-docs-webappUpgrade tomcatUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-javadocUpgrade tomcat-admin-webapps | Nov 24, 2022 | Nov 1, 2022 |
| Ubuntu | — | Upgrade libtomcat9-java (Ubuntu Pro)Upgrade tomcat9 (Ubuntu Pro)Upgrade tomcat9Upgrade tomcat8 (Ubuntu Pro)Upgrade libtomcat8-java (Ubuntu Pro)Upgrade libtomcat9-java | Jul 10, 2024 | Nov 1, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 1, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub