If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade tomcat-el-3.0-apiUpgrade tomcat-libUpgrade tomcat-servlet-3.1-apiUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-webappsUpgrade tomcat-jsvcUpgrade tomcat-javadocUpgrade tomcat-docs-webappUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-api | Sep 28, 2023 | Nov 1, 2022 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 10.1.1Upgrade Apache Tomcat to 8.5.83Upgrade Apache Tomcat to 9.0.68Upgrade Apache Tomcat to 10.0.27Upgrade Apache Tomcat to the latest available version | Nov 1, 2022 | Nov 1, 2022 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Jan 16, 2024 |
| Debian | — | Upgrade tomcat9 | Apr 10, 2023 | Nov 1, 2022 |
| Freebsd | — | Upgrade tomcat-develUpgrade tomcat9Upgrade tomcat101Upgrade tomcat85Upgrade tomcatUpgrade tomcat10 | Nov 19, 2022 | Nov 18, 2022 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | May 31, 2023 | Nov 1, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcat-libUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-4.0-apiUpgrade tomcatUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-el-3.0-api | Feb 9, 2023 | Nov 1, 2022 |
| Suse | — | Upgrade tomcat-jsp-2_3-apiUpgrade tomcat-el-3_0-apiUpgrade tomcat-jsvcUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-webappsUpgrade tomcat-libUpgrade tomcat-embedUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-javadocUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-docs-webapp | Nov 24, 2022 | Nov 1, 2022 |
| Ubuntu | — | Upgrade libtomcat9-java (Ubuntu Pro)Upgrade tomcat9Upgrade libtomcat8-java (Ubuntu Pro)Upgrade tomcat9 (Ubuntu Pro)Upgrade tomcat8 (Ubuntu Pro)Upgrade libtomcat9-java | Jul 10, 2024 | Nov 1, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 1, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub