Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-5CW4-GGX9-36VG
HistoryMay 02, 2022 - 3:12 a.m.

Apache Tomcat Denial of Service via Malformed Request Headers

2022-05-0203:12:29
CWE-20
CWE-400
GitHub Advisory Database
github.com
8

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

6.7 Medium

AI Score

Confidence

High

0.01 Low

EPSS

Percentile

84.0%

JSON

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.

Affected configurations

Vulners
Node
org.apache.tomcat\Matchtomcat
OR
org.apache.tomcat\Matchtomcat
OR
org.apache.tomcat\Matchtomcat

References

Related

cve 1
jvn 1
securityvulns 4
prion 1
osv 1
seebug 1
ubuntucve 1
nvd 1
veracode 1
cvelist 1
altlinux 2
openvas 47
fedora 4
redhat 7
nessus 26
tomcat 3
ubuntu 1
oraclelinux 1
centos 1
debian 1
gentoo 1
ibm 1
vmware 2
threatpost 1
cve
cve
CVE-2009-0033
2009-06-05 16:00:00
jvn
jvn
JVN#87272440: Apache Tomcat denial of service (DoS) vulnerability
2009-06-09 00:00:00
securityvulns
securityvulns
[SECURITY] CVE-2009-0033 Apache Tomcat DoS when using Java AJP connector
2009-06-05 00:00:00
Apache Tomcat multiple security vulnerabilities
2009-06-14 00:00:00
[security bulletin] HPSBMA02535 SSRT100029 rev.1 - HP Performance Manager, Remote Unauthorized Access, Cross Site Scripting (XSS), Denial of Service (DoS)
2010-05-20 00:00:00
prion
prion
Design/Logic Flaw
2009-06-05 16:00:00
osv
osv
Apache Tomcat Denial of Service via Malformed Request Headers
2022-05-02 03:12:29
seebug
seebug
Apache Tomcat Java AJP连ζŽ₯ε™¨ζ— ζ•ˆε€΄ζ‹’η»ζœεŠ‘ζΌζ΄ž
2009-06-05 00:00:00
ubuntucve
ubuntucve
CVE-2009-0033
2009-06-05 00:00:00
nvd
nvd
CVE-2009-0033
2009-06-05 16:00:00
veracode
veracode
Denial Of Service (DoS)
2019-03-25 08:40:42
cvelist
cvelist
CVE-2009-0033
2009-06-05 15:25:00
altlinux
altlinux
Security fix for the ALT Linux 5 package tomcat5 version 0:5.5.27-alt4_7.4jpp5
2010-03-19 00:00:00
Security fix for the ALT Linux 5 package tomcat6 version 0:6.0.18-alt6_8jpp5
2010-01-14 00:00:00
openvas
openvas
Fedora Update for tomcat6 FEDORA-2010-16248
2010-11-16 00:00:00
Fedora Update for tomcat6 FEDORA-2010-16248
2010-11-16 00:00:00
Apache Tomcat Multiple Vulnerabilities (Jun 2009)
2009-06-16 00:00:00
fedora
fedora
[SECURITY] Fedora 12 Update: tomcat6-6.0.26-3.fc12
2010-11-01 20:55:02
[SECURITY] Fedora 12 Update: tomcat6-6.0.20-1.fc12
2009-11-27 21:50:49
[SECURITY] Fedora 11 Update: tomcat6-6.0.20-1.fc11
2009-11-27 21:36:22
redhat
redhat
(RHSA-2009:1617) Low: tomcat security update for Red Hat Network Satellite Server
2009-11-30 00:00:00
(RHSA-2009:1506) Important: tomcat6 security update
2009-10-14 00:00:00
(RHSA-2009:1563) Important: tomcat security update
2009-11-09 00:00:00
nessus
nessus
RHEL 4 : tomcat in Satellite Server (RHSA-2009:1617)
2010-01-10 00:00:00
Mandriva Linux Security Advisory : tomcat5 (MDVSA-2009:138)
2009-06-23 00:00:00
Ubuntu 8.10 / 9.04 : tomcat6 vulnerabilities (USN-788-1)
2009-06-16 00:00:00
tomcat
tomcat
Fixed in Apache Tomcat 4.1.40
2008-12-12 00:00:00
Fixed in Apache Tomcat 6.0.20
2009-06-03 00:00:00
Fixed in Apache Tomcat 5.5.28
2009-09-04 00:00:00
ubuntu
ubuntu
Tomcat vulnerabilities
2009-06-15 00:00:00
oraclelinux
oraclelinux
tomcat security update
2009-07-21 00:00:00
centos
centos
tomcat5 security update
2009-07-29 17:30:22
debian
debian
[SECURITY] [DSA 2207-1] tomcat5.5 security update
2011-03-29 22:35:34
gentoo
gentoo
Apache Tomcat: Multiple vulnerabilities
2012-06-24 00:00:00
ibm
ibm
Security Bulletin: TADDM affected by multiple vulnerabilities due to Apache Tomcat libraries
2023-01-27 10:54:22
vmware
vmware
VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
2009-11-20 00:00:00
VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components
2009-11-20 00:00:00
threatpost
threatpost
Apple Mega Patch Covers 88 Mac OS X Vulnerabilities
2010-03-29 17:15:44

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

6.7 Medium

AI Score

Confidence

High

0.01 Low

EPSS

Percentile

84.0%

JSON
Related for GHSA-5CW4-GGX9-36VG
cve1jvn1securityvulns4prion1osv1seebug1ubuntucve1nvd1veracode1cvelist1altlinux2openvas47fedora4redhat7nessus26tomcat3ubuntu1oraclelinux1centos1debian1gentoo1ibm1vmware2threatpost1