The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes…
Priority MEDIUM 40CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Complete · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.
Why it matters now
EPSS 0.03474 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 4.1.15 – 4.1.40 | — | No fix listed | GHSA-qrcx-p4rr-g48h |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 4.1.15 – 4.1.40 Fixed in — No fix listed GHSA-qrcx-p4rr-g48h
CPE configurations NVD · 26
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:* | 4.1.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.16:*:*:*:*:*:*:* | 4.1.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.17:*:*:*:*:*:*:* | 4.1.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.18:*:*:*:*:*:*:* | 4.1.18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.19:*:*:*:*:*:*:* | 4.1.19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.20:*:*:*:*:*:*:* | 4.1.20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.21:*:*:*:*:*:*:* | 4.1.21 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.22:*:*:*:*:*:*:* | 4.1.22 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.23:*:*:*:*:*:*:* | 4.1.23 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:* | 4.1.24 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:4.1.15:*:*:*:*:*:*:* Versions 4.1.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.16:*:*:*:*:*:*:* Versions 4.1.16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.17:*:*:*:*:*:*:* Versions 4.1.17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.18:*:*:*:*:*:*:* Versions 4.1.18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.19:*:*:*:*:*:*:* Versions 4.1.19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.20:*:*:*:*:*:*:* Versions 4.1.20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.21:*:*:*:*:*:*:* Versions 4.1.21 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.22:*:*:*:*:*:*:* Versions 4.1.22 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.23:*:*:*:*:*:*:* Versions 4.1.23 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:* Versions 4.1.24 Vulnerable ·Apache
Show 16 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:4.1.25:*:*:*:*:*:*:* | 4.1.25 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.26:*:*:*:*:*:*:* | 4.1.26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.27:*:*:*:*:*:*:* | 4.1.27 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.28:alpha:*:*:*:*:*:* | 4.1.28 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:* | 4.1.29 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.29:alpha:*:*:*:*:*:* | 4.1.29 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.30:*:*:*:*:*:*:* | 4.1.30 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:* | 4.1.31 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.32:*:*:*:*:*:*:* | 4.1.32 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.33:*:*:*:*:*:*:* | 4.1.33 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.34:*:*:*:*:*:*:* | 4.1.34 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:* | 4.1.35 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:* | 4.1.36 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.37:*:*:*:*:*:*:* | 4.1.37 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.39:*:*:*:*:*:*:* | 4.1.39 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:4.1.40:*:*:*:*:*:*:* | 4.1.40 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:4.1.25:*:*:*:*:*:*:* Versions 4.1.25 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.26:*:*:*:*:*:*:* Versions 4.1.26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.27:*:*:*:*:*:*:* Versions 4.1.27 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.28:alpha:*:*:*:*:*:* Versions 4.1.28 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.29:*:*:*:*:*:*:* Versions 4.1.29 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.29:alpha:*:*:*:*:*:* Versions 4.1.29 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.30:*:*:*:*:*:*:* Versions 4.1.30 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.31:*:*:*:*:*:*:* Versions 4.1.31 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.32:*:*:*:*:*:*:* Versions 4.1.32 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.33:*:*:*:*:*:*:* Versions 4.1.33 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.34:*:*:*:*:*:*:* Versions 4.1.34 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:* Versions 4.1.35 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.36:*:*:*:*:*:*:* Versions 4.1.36 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.37:*:*:*:*:*:*:* Versions 4.1.37 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.39:*:*:*:*:*:*:* Versions 4.1.39 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:4.1.40:*:*:*:*:*:*:* Versions 4.1.40 Vulnerable ·Apache
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2005-4836
- 2026-10-03 Alias added: GHSA-qrcx-p4rr-g48h
References
Other 7
- http://tomcat.apache.org/security-4.html
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/
- https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2005-4836 · CVE Program
- CVE-2005-4836 · NVD
- FIRST EPSS
- GHSA-qrcx-p4rr-g48h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences