CVE-2014-0075: Integer Overflow
Apache Tomcat did not limit the length of chunk sizes when using chunked transfer coding. A remote attacker could use this flaw to perform a denial of service attack against Tomcat, by streaming an unlimited quantity of data, leading to consumption of server resources.
Other sources
Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0075?
CVE-2014-0075 has a severity rating that indicates a potential denial of service risk due to its exploitation.
How do I fix CVE-2014-0075?
To remediate CVE-2014-0075, upgrade your Apache Tomcat installation to versions 6.0.40, 7.0.53, or 8.0.4 and later.
What software is affected by CVE-2014-0075?
CVE-2014-0075 affects multiple versions of Apache Tomcat, specifically versions 6.0.0 to 6.0.39, 7.0.0 to 7.0.52, and 8.0.0-rc1 to 8.0.3.
Can CVE-2014-0075 lead to data loss?
CVE-2014-0075 primarily presents a denial of service risk, which may indirectly affect data availability but does not directly cause data loss.
Is CVE-2014-0075 related to resource exhaustion?
Yes, CVE-2014-0075 can lead to resource exhaustion on the server through uncontrolled chunked transfer coding.