Apache Tomcat Improper Input Validation vulnerability
Moderate severity
GitHub Reviewed
Published
Oct 10, 2023
to the GitHub Advisory Database
•
Updated Apr 24, 2024
Package
Affected versions
>= 11.0.0-M1, < 11.0.0-M12
>= 10.1.0-M1, < 10.1.14
>= 9.0.0-M1, < 9.0.81
>= 8.5.0, < 8.5.94
Patched versions
11.0.0-M12
10.1.14
9.0.81
8.5.94
>= 11.0.0-M1, < 11.0.0-M12
>= 10.1.0-M1, < 10.1.14
>= 9.0.0-M1, < 9.0.81
>= 8.5.0, < 8.5.94
11.0.0-M12
10.1.14
9.0.81
8.5.94
Description
Published by the National Vulnerability Database
Oct 10, 2023
Published to the GitHub Advisory Database
Oct 10, 2023
Reviewed
Oct 10, 2023
Last updated
Apr 24, 2024
Improper Input Validation vulnerability in Apache Tomcat.
Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single
request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.
Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.
References