CVE-2014-0227: Input Validation
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
Other sources
It was discovered that the ChunkedInputFilter implementation did not fail subsequent attempts to read input early enough. A remote attacker could use this flaw to perform a denial of service attack, by streaming an unlimited quantity of data, leading to consumption of server resources.
— Red Hat
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0227?
CVE-2014-0227 has a medium severity level, allowing for potential HTTP request smuggling attacks.
How do I fix CVE-2014-0227?
To fix CVE-2014-0227, upgrade Apache Tomcat to version 6.0.42, 7.0.55, or 8.0.9 or later.
What versions are affected by CVE-2014-0227?
CVE-2014-0227 affects Apache Tomcat versions 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9.
What type of attacks can CVE-2014-0227 facilitate?
CVE-2014-0227 can facilitate HTTP request smuggling attacks due to improper handling of error states.
Is CVE-2014-0227 specific to any software framework?
Yes, CVE-2014-0227 is specific to the Apache Tomcat web server framework.