Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers…
Priority MEDIUM 42Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Why it matters now
EPSS 0.26114 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 9 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 5.0.0 – 5.0.19 | — | No fix listed | GHSA-f2gq-p6qv-ccw4 |
| — | org.apache.tomcat:tomcat (Maven) | 4.0.0 – 4.1.24 | — | No fix listed | GHSA-f2gq-p6qv-ccw4 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 5.0.0 – 5.0.19 Fixed in — No fix listed GHSA-f2gq-p6qv-ccw4
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 4.0.0 – 4.1.24 Fixed in — No fix listed GHSA-f2gq-p6qv-ccw4
Remediation
Red Hat 9 advisories
- RHSA-2010:0602 Released 2010-08-04 · Red Hat rating ModerateRed Hat Certificate System 7.3 security update
- Red Hat Certificate System 7.3 for 4AS ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
- Red Hat Certificate System 7.3 for 4ES ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
- RHSA-2008:0524 Released 2008-06-30 · Red Hat rating LowRed Hat Network Satellite Server security update
- Red Hat Satellite v 4.2 (RHEL v.3 AS) jabberd-2.0s10-3.37.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el3.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el3.i386 +8
- Red Hat Satellite v 4.2 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8
- RHSA-2008:0261 Released 2008-05-20 · Red Hat rating ModerateRed Hat Network Satellite Server security update
- Red Hat Satellite 5.0 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8
Show 6 more Red Hat advisories
- RHSA-2007:1069 Released 2007-11-26 · Red Hat rating Moderatetomcat security update for Red Hat Network Satellite Server
- Red Hat Satellite 5.0 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.0 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.0 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.1 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.1 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.2 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- Red Hat Satellite v 4.2 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
- RHSA-2007:0360 Released 2007-05-24 · Red Hat rating Importantjbossas security update
- Red Hat Application Stack v1 for Enterprise Linux AS (v.4) jbossas-4.0.5-2.CP04.el4s1.2
- Red Hat Application Stack v1 for Enterprise Linux ES (v.4) jbossas-4.0.5-2.CP04.el4s1.2
- RHSA-2007:0328 Released 2007-05-24 · Red Hat rating Importanttomcat security update
- Red Hat Developer Suite v.3 (AS v.4) jakarta-commons-modeler-2.0-3jpp_3rh, tomcat5-5.5.23-0jpp_6rh, tomcat5-common-lib-5.5.23-0jpp_6rh +4
- RHSA-2007:0326 Released 2007-05-21 · Red Hat rating Importanttomcat security update
- Red Hat Application Server v2 4AS jakarta-commons-modeler-2.0-3jpp_2rh, jakarta-commons-modeler-javadoc-2.0-3jpp_2rh, tomcat5-5.5.23-0jpp_4rh.3 +10
- Red Hat Application Server v2 4ES jakarta-commons-modeler-2.0-3jpp_2rh, jakarta-commons-modeler-javadoc-2.0-3jpp_2rh, tomcat5-5.5.23-0jpp_4rh.3 +10
- Red Hat Application Server v2 4WS jakarta-commons-modeler-2.0-3jpp_2rh, jakarta-commons-modeler-javadoc-2.0-3jpp_2rh, tomcat5-5.5.23-0jpp_4rh.3 +10
- RHSA-2007:0327 Released 2007-05-14 · Red Hat rating Importanttomcat security update
- Red Hat Enterprise Linux (v. 5 server) jakarta-commons-modeler-1.1-8jpp.1.0.2.el5, jakarta-commons-modeler-1.1-8jpp.1.0.2.el5.i386, jakarta-commons-modeler-1.1-8jpp.1.0.2.el5.ia64 +47
- Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5-5.5.23-0jpp.1.0.3.el5, tomcat5-jsp-2.0-api-5.5.23-0jpp.1.0.3.el5, tomcat5-jsp-2.0-api-5.5.23-0jpp.1.0.3.el5.i386 +2
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) jakarta-commons-modeler-1.1-8jpp.1.0.2.el5, jakarta-commons-modeler-1.1-8jpp.1.0.2.el5.i386, jakarta-commons-modeler-javadoc-1.1-8jpp.1.0.2.el5 +19
- RHSA-2007:0340 Released 2007-05-08 · Red Hat rating Importanttomcat security update
- Red Hat Application Server 3AS tomcat5-5.0.30-0jpp_5rh, tomcat5-admin-webapps-5.0.30-0jpp_5rh, tomcat5-webapps-5.0.30-0jpp_5rh
- Red Hat Application Server 3ES tomcat5-5.0.30-0jpp_5rh, tomcat5-admin-webapps-5.0.30-0jpp_5rh, tomcat5-webapps-5.0.30-0jpp_5rh
- Red Hat Application Server 3WS tomcat5-5.0.30-0jpp_5rh, tomcat5-admin-webapps-5.0.30-0jpp_5rh, tomcat5-webapps-5.0.30-0jpp_5rh
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Application Server 3AS | Fixed | RHSA-2007:0340 |
| Red Hat Application Server 3ES | Fixed | RHSA-2007:0340 |
| Red Hat Application Server 3WS | Fixed | RHSA-2007:0340 |
| Red Hat Application Server v2 4AS | Fixed | RHSA-2007:0326 |
| Red Hat Application Server v2 4ES | Fixed | RHSA-2007:0326 |
| Red Hat Application Server v2 4WS | Fixed | RHSA-2007:0326 |
| Red Hat Application Stack v1 for Enterprise Linux AS (v.4) | Fixed | RHSA-2007:0360 |
| Red Hat Application Stack v1 for Enterprise Linux ES (v.4) | Fixed | RHSA-2007:0360 |
| Red Hat Certificate System 7.3 for 4AS | Fixed | RHSA-2010:0602 |
| Red Hat Certificate System 7.3 for 4ES | Fixed | RHSA-2010:0602 |
| Red Hat Developer Suite v.3 (AS v.4) | Fixed | RHSA-2007:0328 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2007:0327 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2007:0327 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2007:0327 |
| Red Hat Satellite 5.0 (RHEL v.4 AS) | Fixed | RHSA-2007:1069, RHSA-2008:0261 |
| Red Hat Satellite v 4.0 (RHEL v.3 AS) | Fixed | RHSA-2007:1069 |
| Red Hat Satellite v 4.0 (RHEL v.4 AS) | Fixed | RHSA-2007:1069 |
| Red Hat Satellite v 4.1 (RHEL v.3 AS) | Fixed | RHSA-2007:1069 |
| Red Hat Satellite v 4.1 (RHEL v.4 AS) | Fixed | RHSA-2007:1069 |
| Red Hat Satellite v 4.2 (RHEL v.3 AS) | Fixed | RHSA-2007:1069, RHSA-2008:0524 |
| Red Hat Satellite v 4.2 (RHEL v.4 AS) | Fixed | RHSA-2007:1069, RHSA-2008:0524 |
Not affected: 2 products
- Red Hat Application Stack v1 for Enterprise Linux AS (v.4)
- Red Hat Application Stack v1 for Enterprise Linux ES (v.4)
Timeline
- 2026-10-02 Threatist record created from CVE-2005-2090
- 2026-10-03 Alias added: GHSA-f2gq-p6qv-ccw4
References
Advisory 18
- http://www.fujitsu.com/global/support/software/security/products-f/interstage-200703e.html
- http://tomcat.apache.org/security-4.html
- [Security-announce] 20080107 VMSA-2008-0002 Low severity security update for VirtualCenter and ESX Server 3.0.2, and ESX 3.0.1
- 239312
- APPLE-SA-2007-07-31
- SUSE-SR:2008:005
- RHSA-2007:0360
- oval:org.mitre.oval:def:10499
- http://support.avaya.com/elmodocs2/security/ASA-2007-206.htm
- http://tomcat.apache.org/security-6.html
- http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf
- RHSA-2007:0327
- SSRT071447
- http://tomcat.apache.org/security-5.html
- RHSA-2008:0261
- 20050606 A new whitepaper by Watchfire - HTTP Request Smuggling
- http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
- https://nvd.nist.gov/vuln/detail/CVE-2005-2090
Other 26
- ADV-2007-2732
- ADV-2007-3087
- ADV-2008-1979
- ADV-2008-0065
- ADV-2009-0233
- ADV-2007-3386
- http://docs.info.apple.com/article.html?artnum=306172
- http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
- https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2005-2090 · CVE Program
- CVE-2005-2090 · NVD
- FIRST EPSS
- GHSA-f2gq-p6qv-ccw4 · GitHub Advisory Database · CC BY 4.0
- CVE-2005-2090 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences