~ / search / GHSA-5cw4-ggx9-36vg

GHSA-5cw4-ggx9-36vg

Apache Tomcat Denial of Service via Malformed Request Headers

Source: GitHub Advisory Database (reviewed) Moderate CVE-2009-0033

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.tomcat:tomcat >= 4.1.0, <= 4.1.39 no fix listed
Maven org.apache.tomcat:tomcat >= 5.5.0, <= 5.5.27 no fix listed
Maven org.apache.tomcat:tomcat >= 6.0.0, <= 6.0.18 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.

References

External links from the advisory. They lead to third-party sites.