Iniciar sesión
Deutsch English Español Polski
Media

Potential HTTP request smuggling in Apache Tomcat

  • Publicada: 28.02.2020
  • Actualizado: 11.10.2026 11:22

The refactoring present in Apache Tomcat versions 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Java / Kotlin (Maven) org.apache.tomcat.embed:tomcat-embed-core >= 7.0.98, < 7.0.100, >= 8.5.48, < 8.5.51, >= 9.0.28, < 9.0.31 7.0.100, 8.5.51, 9.0.31
Java / Kotlin (Maven) org.apache.tomcat:tomcat >= 7.0.98, < 7.0.100, >= 8.5.48, < 8.5.51, >= 9.0.28, < 9.0.31 7.0.100, 8.5.51, 9.0.31

Referencias

Puntuación CVSS 4.8/10
Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Debilidad (CWE)
CWE-444
Plataforma
Java / Kotlin (Maven)
Paquete
org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat
Publicada
28.02.2020
Actualizado
11.10.2026 11:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-767j-jfh2-jvrc - CC BY 4.0

Historial de vulnerabilidades: org.apache.tomcat.embed:tomcat-embed-core

Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (77) en el archivo
Entradas en total
77
Primera → última
10.2018 08.2026
Sin corrección
0
Explotada en ataques
5

Distribución por gravedad

  • Crítica 11
  • Alta 36
  • Media 25
  • Baja 5

Divulgaciones por año

Gravedad:
  1. Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
    Crítica · 9.8 CVE-2026-65905 >= 11.0.0-M1, < 11.0.25, >= 10.1.0-M1, < 10.1.58, >= 9.0.0.M1, < 9.0.121, >= 8.5.0, <= 8.5.100, >= 7.0.30, <= 7.0.109 11.0.25, 10.1.58, 9.0.121
  2. Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
    Crítica · 9.1 CVE-2026-65182 >= 11.0.0-M1, < 11.0.25, >= 10.1.0-M1, < 10.1.58, >= 9.0.0-M1, < 9.0.121, >= 8.5.0, <= 8.5.100, >= 7.0.0, <= 7.0.109 11.0.25, 10.1.58, 9.0.121
  3. Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
    Crítica · 9.1 CVE-2026-68525 >= 11.0.0-M1, < 11.0.25, >= 10.1.0-M1, < 10.1.58, >= 9.0.0-M1, < 9.0.121, >= 8.5.0, <= 8.5.100, >= 7.0.0, <= 7.0.109 11.0.25, 10.1.58, 9.0.121
  4. Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
    Alta · 7.5 CVE-2026-41284 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  5. Apache Tomcat - Digest authenticator will authenticate any unknown user
    Crítica · 9.8 CVE-2026-43512 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  6. Apache Tomcat: LockOutRealm treats user names as case-sensitive
    Alta · 7.5 CVE-2026-43513 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  7. Apache Tomcat - Security constraints not correctly applied
    Crítica · 9.1 CVE-2026-43515 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  8. Apache Tomcat - WebSocket authentication header exposure
    Alta · 7.3 CVE-2026-42498 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  9. Apache Tomcat - HTTP/2 request headers not validated
    Crítica · 9.8 CVE-2026-41293 >= 8.5.0, < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  10. Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File
    Alta · 7.5 CVE-2026-34487 >= 9.0.13, < 9.0.117, >= 10.1.0-M1, < 10.1.54, >= 11.0.0-M1, < 11.0.21 9.0.117, 10.1.54, 11.0.21
  11. Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve
    Alta · 7.5 CVE-2026-34483 >= 9.0.40, < 9.0.116, >= 10.1.0-M1, < 10.1.54, >= 11.0.0-M1, < 11.0.21 9.0.116, 10.1.54, 11.0.21
  12. Apache Tomcat has an HTTP Request/Response Smuggling vulnerability
    Alta · 7.5 CVE-2026-24880 >= 7.0.0, < 9.0.116, >= 10.1.0-M1, < 10.1.52, >= 11.0.0-M1, < 11.0.20 9.0.116, 10.1.52, 11.0.20
  13. Apache Tomcat: Configured cipher preference order not preserved
    Alta · 7.5 CVE-2026-29129 >= 9.0.114, < 9.0.116, >= 10.1.51, < 10.1.53, >= 11.0.16, < 11.0.20 9.0.116, 10.1.53, 11.0.20
  14. Apache Tomcat has an Improper Input Validation vulnerability
    Alta · 7.5 CVE-2026-24734 >= 11.0.0-M1, < 11.0.18, >= 10.1.0-M7, < 10.1.52, >= 9.0.83, < 9.0.115 11.0.18, 10.1.52, 9.0.115
  15. Apache Tomcat Vulnerable to Relative Path Traversal
    Alta · 7.5 CVE-2025-55752 >= 11.0.0-M1, < 11.0.11, >= 10.1.0-M1, < 10.1.45, >= 9.0.0-M11, < 9.0.109, >= 8.5.6, <= 8.5.100 11.0.11, 10.1.45, 9.0.109
  16. Apache Tomcat Improper Resource Shutdown or Release vulnerability
    Alta · 7.5 CVE-2025-48989 >= 11.0.0-M1, < 11.0.10, >= 10.1.0-M1, < 10.1.44, >= 9.0.0.M1, < 9.0.108 11.0.10, 10.1.44, 9.0.108
  17. Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams
    Alta · 7.5 CVE-2025-53506 >= 8.5.0, <= 8.5.100, >= 9.0.0.M1, < 9.0.107, >= 10.1.0-M1, < 10.1.43, >= 11.0.0-M1, < 11.0.9 9.0.107, 10.1.43, 11.0.9
  18. Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits
    Alta · 7.5 CVE-2025-52520 >= 11.0.0-M1, < 11.0.9, >= 10.1.0-M1, < 10.1.43, >= 9.0.0.M1, < 9.0.107, >= 8.5.0, <= 8.5.100 11.0.9, 10.1.43, 9.0.107
  19. Apache Tomcat - DoS in multipart upload
    Alta · 7.5 CVE-2025-48988 >= 11.0.0-M1, < 11.0.8, >= 10.1.0-M1, < 10.1.42, >= 9.0.0.M1, < 9.0.106, >= 8.5.0, <= 8.5.100 11.0.8, 10.1.42, 9.0.106
  20. Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
    Crítica · 9.8 Explotada en ataques CVE-2025-24813 >= 11.0.0-M1, < 11.0.3, >= 10.1.0-M1, < 10.1.35, >= 9.0.0.M1, < 9.0.99, >= 8.5.0, <= 8.5.100 11.0.3, 10.1.35, 9.0.99
  21. Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
    Alta CVE-2024-56337 >= 11.0.0-M1, < 11.0.2, >= 10.1.0-M1, < 10.1.34, >= 9.0.0.M1, < 9.0.98 11.0.2, 10.1.34, 9.0.98
  22. Apache Tomcat Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
    Alta · 9.8 CVE-2024-50379 >= 11.0.0-M1, < 11.0.2, >= 10.1.0-M1, < 10.1.34, >= 9.0.0.M1, < 9.0.98, >= 8.5.0, <= 8.5.100 11.0.2, 10.1.34, 9.0.98
  23. Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability
    Alta · 8.6 CVE-2024-38286 >= 11.0.0-M1, < 11.0.0-M21, >= 10.1.0-M1, < 10.1.25, >= 9.0.13, < 9.0.90, >= 8.5.35, <= 8.5.100, >= 7.0.92, <= 7.0.109 11.0.0-M21, 10.1.25, 9.0.90
  24. Apache Tomcat - Denial of Service
    Alta · 7.5 CVE-2024-34750 >= 11.0.0-M1, < 11.0.0-M21, >= 10.1.0-M1, < 10.1.25, >= 9.0.0-M1, < 9.0.90, >= 8.5.0, <= 8.5.100 11.0.0-M21, 10.1.25, 9.0.90
  25. Apache Tomcat Improper Input Validation vulnerability
    Alta · 7.5 CVE-2023-46589 >= 11.0.0-M1, < 11.0.0-M11, >= 10.1.0-M1, < 10.1.16, >= 9.0.0-M1, < 9.0.83, >= 8.5.0, < 8.5.96 11.0.0-M11, 10.1.16, 9.0.83, 8.5.96
  26. Apache Tomcat - Fix for CVE-2023-24998 was incomplete
    Alta · 7.5 CVE-2023-28709 >= 11.0.0-M2, < 11.0.0-M5, >= 10.1.5, < 10.1.8, >= 9.0.71, < 9.0.74 11.0.0-M5, 10.1.8, 9.0.74
  27. Apache Tomcat vulnerable to information leak
    Alta · 7.5 CVE-2023-34981 >= 11.0.0-M5, < 11.0.0-M6, >= 10.1.8, < 10.1.9, >= 9.0.74, < 9.0.75 11.0.0-M6, 10.1.9, 9.0.75
  28. Apache Commons FileUpload denial of service vulnerability
    Alta · 7.5 CVE-2023-24998 >= 10.1.0-M1, < 10.1.5, >= 11.0.0-M2, < 11.0.0-M5, >= 8.5.85, < 8.5.88, >= 9.0.0-M1, < 9.0.71 10.1.5, 11.0.0-M5, 8.5.88, 9.0.71
  29. Apache Tomcat improperly escapes input from JsonErrorReportValve
    Alta · 7.5 CVE-2022-45143 >= 8.5.83, < 8.5.84, >= 9.0.40, < 9.0.69, >= 10.1.0, < 10.1.2 8.5.84, 9.0.69, 10.1.2
  30. Apache Tomcat may reject request containing invalid Content-Length header
    Alta · 7.5 CVE-2022-42252 >= 8.5.0, < 8.5.83, >= 9.0.0-M1, < 9.0.68, >= 10.0.0-M1, < 10.0.27, >= 10.1.0-M1, < 10.1.1 8.5.83, 9.0.68, 10.0.27, 10.1.1
  31. Unrestricted Upload of File with Dangerous Type Apache Tomcat
    Alta · 8.1 Explotada en ataques CVE-2017-12617 >= 9.0.0.M1, < 9.0.1, >= 8.5.0, < 8.5.23, >= 8.0.0-RC1, < 8.0.47, >= 7.0.0, < 7.0.82 9.0.1, 8.5.23, 8.0.47, 7.0.82
  32. Expected Behavior Violation in Apache Tomcat
    Crítica · 9.8 CVE-2017-5651 >= 9.0.0.M1, < 9.0.0.M19, >= 8.5.0, < 8.5.13 9.0.0.M19, 8.5.13
  33. Exposure of Resource to Wrong Sphere in Apache Tomcat
    Crítica · 9.1 CVE-2017-5648 >= 9.0.0.M1, < 9.0.0.M18, >= 8.5.0, < 8.5.13, >= 8.0.0, < 8.0.42, >= 7.0.0, < 7.0.76 9.0.0.M18, 8.5.13, 8.0.42, 7.0.76
  34. Uncontrolled Resource Consumption in Apache Tomcat
    Alta · 7.5 CVE-2020-11996 >= 10.0.0-M1, < 10.0.0-M5, >= 9.0.0.M1, < 9.0.35, >= 8.5.0, < 8.5.55 10.0.0-M5, 9.0.35, 8.5.55
  35. Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
    Alta · 7.5 CVE-2021-25122 >= 10.0.0-M1, < 10.0.2, >= 9.0.0-M1, < 9.0.43, >= 8.5.0, < 8.5.63 10.0.2, 9.0.43, 8.5.63
  36. Potential remote code execution in Apache Tomcat
    Alta · 7.0 CVE-2021-25329 >= 10.0.0-M1, < 10.0.2, >= 9.0.0, < 9.0.41, >= 8.0.0, < 8.5.61, >= 7.0.0, < 7.0.108 10.0.2, 9.0.41, 8.5.61, 7.0.108
  37. Improper Privilege Management in Tomcat
    Crítica · 9.8 Explotada en ataques CVE-2020-1938 >= 9.0.0, < 9.0.31, >= 8.0.0, < 8.5.51, >= 7.0.0, < 7.0.100 9.0.31, 8.5.51, 7.0.100
  38. Apache Tomcat Denial of Service vulnerability
    Alta · 7.5 CVE-2019-0199 >= 9.0.0, < 9.0.16, >= 8.0.0, < 8.5.38 9.0.16, 8.5.38
  39. Potential remote code execution in Apache Tomcat
    Alta · 7.0 CVE-2020-9484 >= 10.0.0-M1, < 10.0.0-M5, >= 9.0.0, < 9.0.35, >= 8.0.0, < 8.5.55, >= 7.0.0, < 7.0.104 10.0.0-M5, 9.0.35, 8.5.55, 7.0.104
  40. Potential HTTP request smuggling in Apache Tomcat esta entrada
    Media · 4.8 CVE-2019-17569 >= 7.0.98, < 7.0.100, >= 8.5.48, < 8.5.51, >= 9.0.28, < 9.0.31 7.0.100, 8.5.51, 9.0.31
  41. Insufficiently Protected Credentials in Apache Tomcat
    Alta · 7.0 CVE-2019-12418 < 7.0.99, >= 8.0.0, < 8.5.49, >= 9.0.0, < 9.0.29 7.0.99, 8.5.49, 9.0.29
  42. In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack
    Alta · 7.5 CVE-2019-17563 < 7.0.99, >= 8.0.0, < 8.5.50, >= 9.0.0, < 9.0.30 7.0.99, 8.5.50, 9.0.30
  43. Improper Locking in Apache Tomcat
    Alta · 7.5 CVE-2019-10072 >= 9.0.0.M1, < 9.0.20, >= 8.5.0, < 8.5.41 9.0.20, 8.5.41
  44. Apache Tomcat OS Command Injection vulnerability
    Alta · 8.1 CVE-2019-0232 >= 9.0.0.M1, < 9.0.17, >= 8.0.0, < 8.5.40, >= 7.0.0, < 7.0.94 9.0.17, 8.5.40, 7.0.94
  45. The host name verification missing in Apache Tomcat
    Alta · 7.5 CVE-2018-8034 >= 9.0.0, < 9.0.10, >= 8.5.0, < 8.5.32, >= 8.0.0, < 8.0.53, >= 7.0.35, < 7.0.90 9.0.10, 8.5.32, 8.0.53, 7.0.90
  46. The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins
    Crítica · 9.8 CVE-2018-8014 >= 9.0.0.M1, < 9.0.9, >= 8.5.0, < 8.5.32, >= 8.0.0RC1, < 8.0.53, >= 7.0.41, < 7.0.88 9.0.9, 8.5.32, 8.0.53, 7.0.88
  47. In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder
    Alta · 7.5 CVE-2018-1336 >= 9.0.0.M9, < 9.0.8, >= 8.5.0, < 8.5.31, >= 8.0.0RC1, < 8.0.51, >= 7.0.28, < 7.0.87 9.0.8, 8.5.31, 8.0.51, 7.0.87
  48. When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server
    Alta · 8.1 Explotada en ataques CVE-2017-12615 >= 7.0.0, < 7.0.79 7.0.79

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.