Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk…
Priority MEDIUM 42CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Partial Red Hat: 3 fixed, 1 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.11001 95th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 6.0.37, 7.0.30Red Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 6.0.0 to before 6.0.37 | 6.0.37 | Patch available | GHSA-qfxv-3ppc-7qg5 |
| — | org.apache.tomcat:tomcat (Maven) | 7.0.0 to before 7.0.30 | 7.0.30 | Patch available | GHSA-qfxv-3ppc-7qg5 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 6.0.0 to before 6.0.37 Fixed in 6.0.37 Patch available GHSA-qfxv-3ppc-7qg5
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 7.0.0 to before 7.0.30 Fixed in 7.0.30 Patch available GHSA-qfxv-3ppc-7qg5
CPE configurations NVD · 72
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* | 6.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:* | 6.0.0 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* | 6.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:* | 6.0.1 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* | 6.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:* | 6.0.2 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:* | 6.0.2 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* | 6.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* | 6.0.4 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:* Versions 6.0.0 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:* Versions 6.0.1 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* Versions 6.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:* Versions 6.0.2 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:* Versions 6.0.2 beta Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* Versions 6.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* Versions 6.0.4 Vulnerable ·Apache
Show 62 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:* | 6.0.4 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* | 6.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* | 6.0.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:* | 6.0.6 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* | 6.0.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:* | 6.0.7 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:* | 6.0.7 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* | 6.0.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:* | 6.0.8 alpha | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* | 6.0.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:* | 6.0.9 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* | 6.0.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* | 6.0.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* | 6.0.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* | 6.0.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* | 6.0.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* | 6.0.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* | 6.0.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* | 6.0.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* | 6.0.18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* | 6.0.19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* | 6.0.20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:* | 6.0.24 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:* | 6.0.26 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:* | 6.0.27 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:* | 6.0.28 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:* | 6.0.29 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:* | 6.0.30 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:* | 6.0.31 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:* | 6.0.32 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:* | 6.0.33 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:* | 6.0.35 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:* | 6.0.36 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:* | 7.0.0 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* | 7.0.1 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* | 7.0.2 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:* | 7.0.2 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* | 7.0.3 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:* | 7.0.4 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:* | 7.0.4 beta | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:* | 7.0.5 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:* | 7.0.6 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:* | 7.0.7 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:* | 7.0.8 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:* | 7.0.9 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:* | 7.0.10 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:* | 7.0.11 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:* | 7.0.12 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:* | 7.0.13 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:* | 7.0.14 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:* | 7.0.15 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:* | 7.0.16 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:* | 7.0.17 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:* | 7.0.18 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:* | 7.0.19 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:* | 7.0.20 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:* | 7.0.21 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:* | 7.0.22 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:* | 7.0.23 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:* | 7.0.25 | Vulnerable | Apache |
| cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:* | 7.0.28 | Vulnerable | Apache |
- cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:* Versions 6.0.4 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* Versions 6.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* Versions 6.0.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:* Versions 6.0.6 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* Versions 6.0.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:* Versions 6.0.7 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:* Versions 6.0.7 beta Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* Versions 6.0.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:* Versions 6.0.8 alpha Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* Versions 6.0.9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:* Versions 6.0.9 beta Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* Versions 6.0.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* Versions 6.0.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* Versions 6.0.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* Versions 6.0.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* Versions 6.0.14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* Versions 6.0.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* Versions 6.0.16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* Versions 6.0.17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* Versions 6.0.18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* Versions 6.0.19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* Versions 6.0.20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:* Versions 6.0.24 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:* Versions 6.0.26 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:* Versions 6.0.27 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:* Versions 6.0.28 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:* Versions 6.0.29 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:* Versions 6.0.30 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:* Versions 6.0.31 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:* Versions 6.0.32 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:* Versions 6.0.33 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:* Versions 6.0.35 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:* Versions 6.0.36 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:* Versions 7.0.0 beta Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:* Versions 7.0.2 beta Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* Versions 7.0.3 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:* Versions 7.0.4 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:* Versions 7.0.4 beta Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:* Versions 7.0.5 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:* Versions 7.0.6 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:* Versions 7.0.7 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:* Versions 7.0.8 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:* Versions 7.0.9 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:* Versions 7.0.10 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:* Versions 7.0.11 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:* Versions 7.0.12 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:* Versions 7.0.13 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:* Versions 7.0.14 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:* Versions 7.0.15 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:* Versions 7.0.16 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:* Versions 7.0.17 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:* Versions 7.0.18 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:* Versions 7.0.19 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:* Versions 7.0.20 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:* Versions 7.0.21 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:* Versions 7.0.22 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:* Versions 7.0.23 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:* Versions 7.0.25 Vulnerable ·Apache
- cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:* Versions 7.0.28 Vulnerable ·Apache
Remediation
- Fix · GHSA-qfxv-3ppc-7qg5 org.apache.tomcat:tomcat (Maven) Fixed in 6.0.37 Advisory →
- Fix · GHSA-qfxv-3ppc-7qg5 org.apache.tomcat:tomcat (Maven) Fixed in 7.0.30 Advisory →
Red Hat 3 advisories
- RHSA-2013:1013 Released 2013-07-03 · Red Hat rating ModerateRed Hat JBoss Web Server 2.0.1 update
- Red Hat JBoss Web Server 2.0
- RHSA-2013:1012 Released 2013-07-03 · Red Hat rating ModerateRed Hat JBoss Web Server 2.0.1 update
- Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server apache-commons-daemon-eap6-1:1.0.15-4.redhat_1.ep6.el6, apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el6, apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el6.i386 +47
- RHSA-2013:1011 Released 2013-07-03 · Red Hat rating ModerateRed Hat JBoss Web Server 2.0.1 update
- Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server apache-commons-daemon-eap6-1:1.0.15-4.redhat_1.ep6.el5, apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el5, apache-commons-daemon-jsvc-eap6-1:1.0.15-1.redhat_1.ep6.el5.i386 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Web Server 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server | Fixed | RHSA-2013:1011 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server | Fixed | RHSA-2013:1012 |
| Red Hat JBoss Web Server 2.0 | Fixed | RHSA-2013:1013 |
Not affected: 4 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Enterprise Web Server 1
Timeline
- 2026-10-02 Threatist record created from CVE-2012-3544
- 2026-10-03 Alias added: GHSA-qfxv-3ppc-7qg5
- 2026-10-10 CISA SSVC decision points changed
- 2026-10-10 Priority changed: LOW → MEDIUM
References
Patch 4
- http://svn.apache.org/viewvc?view=revision&revision=1378702
- http://svn.apache.org/viewvc?view=revision&revision=1378921
- http://svn.apache.org/viewvc?view=revision&revision=1476592
- http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java?r1=1476592&r2=1476591&pathrev=1476592
Advisory 4
Other 18
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
- 20130510 [SECURITY] CVE-2012-3544 Chunked transfer encoding extension size is not limited
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
More Apache Tomcat vulnerabilities
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2012-3544 · CVE Program
- CVE-2012-3544 · NVD
- FIRST EPSS
- GHSA-qfxv-3ppc-7qg5 · GitHub Advisory Database · CC BY 4.0
- CVE-2012-3544 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences