https://seclists.org/oss-sec/2023/q4/242: CVE-2023-46589: Apache Tomcat: HTTP request smuggling via malformed trailer headers

Q: Which Apache Tomcat releases are affected?

Affected releases are Tomcat 11.0.0-M1 through 11.0.0-M10, 10.1.0-M1 through 10.1.15, 9.0.0-M1 through 9.0.82, and 8.5.0 through 8.5.95.

Q: Which deployments are most exposed to this issue?

The issue applies when Tomcat is deployed behind a reverse proxy. In that configuration, malformed trailer headers may cause a request to be interpreted as multiple requests, creating a request-smuggling possibility.

Q: What does an attacker need to send to attempt exploitation?

The described trigger involves malformed trailer headers. The advisory identifies the resulting risk as request smuggling when the affected Tomcat instance is behind a reverse proxy.

Published Nov 28, 2023

Updated

Affected Software

4 affected components

Apache Tomcat>=11.0.0-M1<=11.0.0-M10

Apache Tomcat>=10.1.0-M1<=10.1.15

Apache Tomcat>=9.0.0-M1<=9.0.82

Apache Tomcat>=8.5.0<=8.5.95

Frequently Asked Questions

Which Apache Tomcat releases are affected?

Affected releases are Tomcat 11.0.0-M1 through 11.0.0-M10, 10.1.0-M1 through 10.1.15, 9.0.0-M1 through 9.0.82, and 8.5.0 through 8.5.95.

Which deployments are most exposed to this issue?

The issue applies when Tomcat is deployed behind a reverse proxy. In that configuration, malformed trailer headers may cause a request to be interpreted as multiple requests, creating a request-smuggling possibility.

What does an attacker need to send to attempt exploitation?

The described trigger involves malformed trailer headers. The advisory identifies the resulting risk as request smuggling when the affected Tomcat instance is behind a reverse proxy.