A denial of service flaw was found in the way chunked transfer encoding input filter of Apache Tomcat, an Apache Servlet/JSP Engine, processed CRLF sequences at the end of data chunks in certain circumstances. When the chunked transfer encoding was enabled, a remote attacker could issue a specially-crafted request that, when processed would lead to (limited) denial of service of the Apache Tomcat server.
Relevant upstream patch: for Apache Tomcat 6.x: http://svn.apache.org/viewvc?view=revision&revision=1476592
for Apache Tomcat 7:x: http://svn.apache.org/viewvc?view=rev&rev=1378702 http://svn.apache.org/viewvc?view=rev&rev=1378921
Severity: low
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.6 - Apache Tomcat 10.1.0-M1 through 10.1.40 - Apache Tomcat 9.0.0.M1 through 9.0.104
Description:
Credit:
Greg K (https://github.com/gregk4sec) (finder)
References:
https://lists.apache.org/thread/xhqqk9w5q45srcdqhogdk04lhdscv30j https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2025-46701
Severity: low
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.5 - Apache Tomcat 10.1.0-M1 through 10.1.39 - Apache Tomcat 9.0.0.M1 through 9.0.102
Description: for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those constraints could be bypassed.
Credit:
COSCO Shipping Lines DIC (finder)
References:
https://lists.apache.org/list.html?announce () tomcat apache org https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2025-31651
Severity: important
Affected versions:
- Apache Tomcat 9.0.76 through 9.0.102 - Apache Tomcat 10.1.10 through 10.1.39 - Apache Tomcat 11.0.0-M2 through 11.0.5
Description:
References:
https://lists.apache.org/thread/j6zzk0y3yym9pzfzkq5vcyxzz0yzh826 https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2025-31650
USN-7469-1 fixed a vulnerability in Apache Traffic Server. This update provides the corresponding updates for Apache Tomcat. Original advisory details: It was discovered that Apache Traffic Server exhibited poor server resource management in its HTTP/2 protocol. An attacker could possibly use this issue to cause Apache Traffic Server to crash, resulting in a denial of service.
Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
Severity: important
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.2 - Apache Tomcat 10.1.0-M1 through 10.1.34 - Apache Tomcat 9.0.0.M1 through 9.0.98
Description:
- writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default)
Credit:
COSCO Shipping Lines DIC (finder) sw0rd1ight (https://github.com/sw0rd1ight) (finder)
References:
https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2025-24813
Severity: important
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.1 - Apache Tomcat 10.1.0-M1 through 10.1.33 - Apache Tomcat 9.0.0.M1 through 9.0.97
Description:
The mitigation for CVE-2024-50379 was incomplete. - running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true) - running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Credit: References:
https://www.cve.org/CVERecord?id=CVE-2024-50379 https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-56337
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97
Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.08 Should that last fixed version be 9.0.98 ?
Nick
On 17/12/2024 16:23, Agostino Sarubbo wrote: On martedì 17 dicembre 2024 13:46:54 CET Mark Thomas wrote:
> - Apache Tomcat 9.0.0.M1 through 9.9.97
I think this is 9.0.97 instead of 9.9.97 Yes, that is correct. I've submitted a correction to cve.org.
Kind regards,
Mark
On martedì 17 dicembre 2024 13:46:54 CET Mark Thomas wrote: - Apache Tomcat 9.0.0.M1 through 9.9.97 I think this is 9.0.97 instead of 9.9.97
Agostino
Severity: low
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.1 - Apache Tomcat 10.1.0-M1 through 10.1.33 - Apache Tomcat 9.0.0.M1 through 9.9.97
Description:
References:
https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-54677
Severity: important
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.1 - Apache Tomcat 10.1.0-M1 through 10.1.33 - Apache Tomcat 9.0.0.M1 through 9.0.97
Description:
Credit:
Nacl, WHOAMI, Yemoli and Ruozhi (finder)
References:
https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-50379
Severity: important
Affected versions:
- Apache Tomcat 11.0.0 - Apache Tomcat 10.1.31 - Apache Tomcat 9.0.96
Description:
Incorrect object recycling and reuse vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Note: 10.1.32 includes the fix but was not released
References:
https://lists.apache.org/thread/co243cw1nlh6p521c5265cm839wkqdp9 https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-52318
Severity: important
Affected versions:
- Apache Tomcat 11.0.0-M23 through 11.0.0-M26 - Apache Tomcat 10.1.27 through 10.1.30 - Apache Tomcat 9.0.92 through 9.0.95
Description: could lead to request and/or response mix-up between users.
References:
https://lists.apache.org/thread/ty376mrxy1mmxtw3ogo53nc9l3co3dfs https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-52317
Severity: low
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.0-M26 - Apache Tomcat 10.1.0-M1 through 10.1.30 - Apache Tomcat 9.0.0-M1 through 9.0.95
Description:
References:
https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928 https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-52316
The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.
Affected versions:
- Apache Tomcat 11.0.0-M1 through 11.0.0-M20 - Apache Tomcat 10.1.0-M1 through 10.1.24 - Apache Tomcat 9.0.13 through 9.0.89
Description:
Credit:
Ozaki, North Grid Corporation (reporter)
References:
https://lists.apache.org/thread/wms60cvbsz3fpbz9psxtfx8r41jl6d4s https://tomcat.apache.org/ https://www.cve.org/CVERecord?id=CVE-2024-38286
Timeline:
2024-06-04: Issue reported to Apache Tomcat Security Team
From http://tomcat.apache.org/security-5.html
Fixed in Apache Tomcat 5.5.23
Information disclosure CVE-2005-2090
Requests with multiple content-length headers should be rejected as invalid. When multiple components (firewalls, caches, proxies and Tomcat) process a sequence of requests where one or more requests contain multiple content-length headers and several components do not reject the request and make different decisions as to which content-length leader to use an attacker can poision a web-cache, perform an XSS attack and obtain senstive information from requests other then their own. Tomcat now returns 400 for requests with multiple content-length headers.
Affects: 5.0.0-5.0.HEAD, 5.5.0-5.5.22
According to http://tomcat.apache.org/security-5.html
Fixed in Apache Tomcat 5.5.18
Cross-site scripting CVE-2006-7195
The implict-objects.jsp in the examples webapp displayed a number of unfiltered header values. This enabled a XSS attack. These values are now filtered.
Affects: 5.0.0-5.0.HEAD, 5.5.0-5.5.17
The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.
Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed concurrently with another request but in a different thread, leading to an instance-variable overwrite associated with a "synchronization problem" and lack of thread safety, and related to RemoteFilterValve, RemoteAddrValve, and RemoteHostValve.
Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and modjk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.