Read the docs
TI-2005-03333 Aliases CVE-2005-3510GHSA-8f4w-jwqv-5cxc

Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU…

Priority LOW 32CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.

Why it matters now

EPSS 0.05954 93rd percentileScored 2026-11-07
Fix Fixed org.apache.tomcat:tomcat (Maven): 5.5.12Red Hat: 6 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.tomcat:tomcat (Maven)5.5.0 to before 5.5.125.5.12Patch availableGHSA-8f4w-jwqv-5cxc
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 5.5.0 to before 5.5.12 Fixed in 5.5.12 Patch available GHSA-8f4w-jwqv-5cxc

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:*5.5.0VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:*5.5.1VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:*5.5.2VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:*5.5.3VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:*5.5.4VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:*5.5.5VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:*5.5.6VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:*5.5.7VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:*5.5.8VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:*5.5.9VulnerableApache
  • cpe:2.3:a:apache:tomcat:5.5.0:*:*:*:*:*:*:* Versions 5.5.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.1:*:*:*:*:*:*:* Versions 5.5.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.2:*:*:*:*:*:*:* Versions 5.5.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.3:*:*:*:*:*:*:* Versions 5.5.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.4:*:*:*:*:*:*:* Versions 5.5.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.5:*:*:*:*:*:*:* Versions 5.5.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.6:*:*:*:*:*:*:* Versions 5.5.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.7:*:*:*:*:*:*:* Versions 5.5.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.8:*:*:*:*:*:*:* Versions 5.5.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.9:*:*:*:*:*:*:* Versions 5.5.9 Vulnerable ·Apache
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:*5.5.10VulnerableApache
cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:*5.5.11VulnerableApache
  • cpe:2.3:a:apache:tomcat:5.5.10:*:*:*:*:*:*:* Versions 5.5.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:5.5.11:*:*:*:*:*:*:* Versions 5.5.11 Vulnerable ·Apache

Remediation

  • Fix · GHSA-8f4w-jwqv-5cxc org.apache.tomcat:tomcat (Maven) Fixed in 5.5.12 Advisory →

Red Hat 6 advisories

  • RHSA-2010:0602 Released 2010-08-04 · Red Hat rating Moderate
    Red Hat Certificate System 7.3 security update
    • Red Hat Certificate System 7.3 for 4AS ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
    • Red Hat Certificate System 7.3 for 4ES ant-1.6.5-1jpp_1rh, avalon-logkit-1.2-2jpp_4rh, axis-1.2.1-1jpp_3rh +39
  • RHSA-2008:0524 Released 2008-06-30 · Red Hat rating Low
    Red Hat Network Satellite Server security update
    • Red Hat Satellite v 4.2 (RHEL v.3 AS) jabberd-2.0s10-3.37.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el3.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el3.i386 +8
    • Red Hat Satellite v 4.2 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8
  • RHSA-2008:0261 Released 2008-05-20 · Red Hat rating Moderate
    Red Hat Network Satellite Server security update
    • Red Hat Satellite 5.0 (RHEL v.4 AS) jabberd-2.0s10-3.38.rhn.i386, java-1.4.2-ibm-1.4.2.10-1jpp.2.el4.i386, java-1.4.2-ibm-devel-1.4.2.10-1jpp.2.el4.i386 +8
Show 3 more Red Hat advisories
  • RHSA-2007:1069 Released 2007-11-26 · Red Hat rating Moderate
    tomcat security update for Red Hat Network Satellite Server
    • Red Hat Satellite 5.0 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
    • Red Hat Satellite v 4.0 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
    • Red Hat Satellite v 4.0 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
    • Red Hat Satellite v 4.1 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
    • Red Hat Satellite v 4.1 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
    • Red Hat Satellite v 4.2 (RHEL v.3 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
    • Red Hat Satellite v 4.2 (RHEL v.4 AS) jakarta-commons-pool-1.2-2jpp_2rh, tomcat5-5.0.30-0jpp_6rh, tyrex-1.0.1-2jpp_2rh
  • RHSA-2007:0340 Released 2007-05-08 · Red Hat rating Important
    tomcat security update
    • Red Hat Application Server 3AS tomcat5-5.0.30-0jpp_5rh, tomcat5-admin-webapps-5.0.30-0jpp_5rh, tomcat5-webapps-5.0.30-0jpp_5rh
    • Red Hat Application Server 3ES tomcat5-5.0.30-0jpp_5rh, tomcat5-admin-webapps-5.0.30-0jpp_5rh, tomcat5-webapps-5.0.30-0jpp_5rh
    • Red Hat Application Server 3WS tomcat5-5.0.30-0jpp_5rh, tomcat5-admin-webapps-5.0.30-0jpp_5rh, tomcat5-webapps-5.0.30-0jpp_5rh
  • RHSA-2006:0161 Released 2006-03-07 · Red Hat rating Moderate
    RHAPS security and enhancement update
    • Red Hat Application Server v2 4AS

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Application Server 3ASFixed RHSA-2007:0340
Red Hat Application Server 3ESFixed RHSA-2007:0340
Red Hat Application Server 3WSFixed RHSA-2007:0340
Red Hat Application Server v2 4ASFixed RHSA-2006:0161
Red Hat Certificate System 7.3 for 4ASFixed RHSA-2010:0602
Red Hat Certificate System 7.3 for 4ESFixed RHSA-2010:0602
Red Hat Satellite 5.0 (RHEL v.4 AS)Fixed RHSA-2007:1069, RHSA-2008:0261
Red Hat Satellite v 4.0 (RHEL v.3 AS)Fixed RHSA-2007:1069
Red Hat Satellite v 4.0 (RHEL v.4 AS)Fixed RHSA-2007:1069
Red Hat Satellite v 4.1 (RHEL v.3 AS)Fixed RHSA-2007:1069
Red Hat Satellite v 4.1 (RHEL v.4 AS)Fixed RHSA-2007:1069
Red Hat Satellite v 4.2 (RHEL v.3 AS)Fixed RHSA-2007:1069, RHSA-2008:0524
Red Hat Satellite v 4.2 (RHEL v.4 AS)Fixed RHSA-2007:1069, RHSA-2008:0524

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-3510
  2. 2026-10-03 Alias added: GHSA-8f4w-jwqv-5cxc

References

Advisory 4

Other 19

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences