CVE-2012-2733: Input Validation
java/org/apache/coyote/http11/InternalNioInputBuffer.java in the HTTP NIO connector in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28 does not properly restrict the request-header size, which allows remote attackers to cause a denial of service (memory consumption) via a large amount of header data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2733?
CVE-2012-2733 is classified as a denial of service vulnerability due to insufficient request-header size restrictions.
How do I fix CVE-2012-2733?
To fix CVE-2012-2733, update Apache Tomcat to version 6.0.36 or later, or 7.0.28 or later.
Which versions of Apache Tomcat are affected by CVE-2012-2733?
CVE-2012-2733 affects Apache Tomcat versions 6.0.0 through 6.0.35 and 7.0.0 through 7.0.27.
What kind of attacks can exploit CVE-2012-2733?
Attackers can exploit CVE-2012-2733 to affect server performance by causing high memory consumption.
Is there a workaround for CVE-2012-2733?
A temporary workaround for CVE-2012-2733 includes limiting the header size via configuration, but the best resolution is to update to a patched version.