If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade tomcat-servlet-4.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-javadocUpgrade tomcat-jsvcUpgrade tomcat-docs-webappUpgrade tomcat-libUpgrade tomcat-el-3.0-apiUpgrade tomcat-webappsUpgrade tomcat-admin-webappsUpgrade tomcat-servlet-3.1-apiUpgrade tomcat | Sep 28, 2023 | Nov 1, 2022 |
| Apache Tomcat | — | Upgrade Apache Tomcat to 10.0.27Upgrade Apache Tomcat to 9.0.68Upgrade Apache Tomcat to 10.1.1Upgrade Apache Tomcat to 8.5.83Upgrade Apache Tomcat to the latest available version | Nov 1, 2022 | Nov 1, 2022 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Jan 16, 2024 |
| Debian | — | Upgrade tomcat9 | Apr 10, 2023 | Nov 1, 2022 |
| Freebsd | — | Upgrade tomcatUpgrade tomcat10Upgrade tomcat85Upgrade tomcat9Upgrade tomcat-develUpgrade tomcat101 | Nov 19, 2022 | Nov 18, 2022 |
| Gentoo Linux | — | Upgrade www-servers/tomcat. | May 31, 2023 | Nov 1, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade tomcatUpgrade tomcat-el-3.0-apiUpgrade tomcat-jsp-2.3-apiUpgrade tomcat-servlet-4.0-apiUpgrade tomcat-libUpgrade tomcat-admin-webapps | Feb 9, 2023 | Nov 1, 2022 |
| Suse | — | Upgrade tomcat-javadocUpgrade tomcat-servlet-3_1-apiUpgrade tomcat-docs-webappUpgrade tomcat-admin-webappsUpgrade tomcatUpgrade tomcat-embedUpgrade tomcat-libUpgrade tomcat-el-3_0-apiUpgrade tomcat-jsvcUpgrade tomcat-servlet-4_0-apiUpgrade tomcat-webappsUpgrade tomcat-jsp-2_3-api | Nov 24, 2022 | Nov 1, 2022 |
| Ubuntu | — | Upgrade libtomcat9-javaUpgrade tomcat8 (Ubuntu Pro)Upgrade tomcat9 (Ubuntu Pro)Upgrade tomcat9Upgrade libtomcat9-java (Ubuntu Pro)Upgrade libtomcat8-java (Ubuntu Pro) | Jul 10, 2024 | Nov 1, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 1, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub