Read the docs
TI-2014-00070 Aliases CVE-2014-0075GHSA-475f-74wp-pqv5

Integer overflow in the parseChunkHeader function in…

Priority MEDIUM 46CWE-189Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Partial Red Hat: 28 fixed, 4 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-189 and the CVSS impact.

Summary

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.17577 97th percentileScored 2026-11-07
Fix Partial org.apache.tomcat:tomcat (Maven): 6.0.40, 7.0.53, 8.0.4org.apache.tomcat:tomcat-coyote (Maven): 6.0.40, 7.0.53, 8.0.4Red Hat: 16 advisoriesRed Hat: 28 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.tomcat:tomcat (Maven)before 6.0.406.0.40Patch availableGHSA-475f-74wp-pqv5
—org.apache.tomcat:tomcat (Maven)7.0.0 to before 7.0.537.0.53Patch availableGHSA-475f-74wp-pqv5
—org.apache.tomcat:tomcat (Maven)8.0.0 to before 8.0.48.0.4Patch availableGHSA-475f-74wp-pqv5
—org.apache.tomcat:tomcat-coyote (Maven)before 6.0.406.0.40Patch availableGHSA-475f-74wp-pqv5
—org.apache.tomcat:tomcat-coyote (Maven)7.0.0 to before 7.0.537.0.53Patch availableGHSA-475f-74wp-pqv5
—org.apache.tomcat:tomcat-coyote (Maven)8.0.0 to before 8.0.48.0.4Patch availableGHSA-475f-74wp-pqv5
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected before 6.0.40 Fixed in 6.0.40 Patch available GHSA-475f-74wp-pqv5
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 7.0.0 to before 7.0.53 Fixed in 7.0.53 Patch available GHSA-475f-74wp-pqv5
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.0.0 to before 8.0.4 Fixed in 8.0.4 Patch available GHSA-475f-74wp-pqv5
  • org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected before 6.0.40 Fixed in 6.0.40 Patch available GHSA-475f-74wp-pqv5
  • org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 7.0.0 to before 7.0.53 Fixed in 7.0.53 Patch available GHSA-475f-74wp-pqv5
  • org.apache.tomcat:tomcat-coyote (Maven) Vendor— Affected 8.0.0 to before 8.0.4 Fixed in 8.0.4 Patch available GHSA-475f-74wp-pqv5

CPE configurations NVD · 107

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*7.0.0 betaVulnerableApache
cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*7.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*7.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*7.0.2 betaVulnerableApache
cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*7.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*7.0.4VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*7.0.4 betaVulnerableApache
cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*7.0.5VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*7.0.6VulnerableApache
  • cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:* Versions 7.0.0 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:* Versions 7.0.2 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* Versions 7.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:* Versions 7.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:* Versions 7.0.4 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:* Versions 7.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:* Versions 7.0.6 Vulnerable ·Apache
Show 97 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*7.0.7VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*7.0.8VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*7.0.9VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*7.0.10VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*7.0.11VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*7.0.12VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*7.0.13VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*7.0.14VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*7.0.15VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*7.0.16VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*7.0.17VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*7.0.18VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*7.0.19VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*7.0.20VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*7.0.21VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*7.0.22VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*7.0.23VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*7.0.24VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*7.0.25VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*7.0.26VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*7.0.27VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*7.0.28VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*7.0.29VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*7.0.30VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*7.0.31VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*7.0.32VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*7.0.33VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*7.0.34VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*7.0.35VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*7.0.36VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*7.0.37VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*7.0.38VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*7.0.39VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*7.0.40VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*7.0.41VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*7.0.42VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*7.0.43VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*7.0.44VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*7.0.45VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*7.0.46VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*7.0.47VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*7.0.48VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*7.0.49VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*7.0.50VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:*7.0.52VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*8.0.0 rc1VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*8.0.0 rc10VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*8.0.0 rc2VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*8.0.0 rc5VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*8.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:*8.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*up to 6.0.39VulnerableApache
cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:*6VulnerableApache
cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:*6.0VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:*6.0.0 alphaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:*6.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:*6.0.1 alphaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:*6.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:*6.0.2 alphaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:*6.0.2 betaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:*6.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:*6.0.4VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:*6.0.4 alphaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:*6.0.5VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:*6.0.6VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:*6.0.6 alphaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:*6.0.7VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:*6.0.7 alphaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:*6.0.7 betaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:*6.0.8VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:*6.0.8 alphaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:*6.0.9VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:*6.0.9 betaVulnerableApache
cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:*6.0.10VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:*6.0.11VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:*6.0.12VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:*6.0.13VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:*6.0.14VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:*6.0.15VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:*6.0.16VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:*6.0.17VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:*6.0.18VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:*6.0.19VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:*6.0.20VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:*6.0.24VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:*6.0.26VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:*6.0.27VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:*6.0.28VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:*6.0.29VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:*6.0.30VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:*6.0.31VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:*6.0.32VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:*6.0.33VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:*6.0.35VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:*6.0.36VulnerableApache
cpe:2.3:a:apache:tomcat:6.0.37:*:*:*:*:*:*:*6.0.37VulnerableApache
  • cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:* Versions 7.0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:* Versions 7.0.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:* Versions 7.0.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:* Versions 7.0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:* Versions 7.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:* Versions 7.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:* Versions 7.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:* Versions 7.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:* Versions 7.0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:* Versions 7.0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:* Versions 7.0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:* Versions 7.0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:* Versions 7.0.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:* Versions 7.0.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:* Versions 7.0.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:* Versions 7.0.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:* Versions 7.0.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:* Versions 7.0.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:* Versions 7.0.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:* Versions 7.0.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:* Versions 7.0.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:* Versions 7.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:* Versions 7.0.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:* Versions 7.0.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:* Versions 7.0.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:* Versions 7.0.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:* Versions 7.0.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:* Versions 7.0.34 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:* Versions 7.0.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:* Versions 7.0.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:* Versions 7.0.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:* Versions 7.0.38 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:* Versions 7.0.39 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:* Versions 7.0.40 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:* Versions 7.0.41 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:* Versions 7.0.42 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:* Versions 7.0.43 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:* Versions 7.0.44 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:* Versions 7.0.45 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:* Versions 7.0.46 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:* Versions 7.0.47 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:* Versions 7.0.48 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:* Versions 7.0.49 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:* Versions 7.0.50 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.52:*:*:*:*:*:*:* Versions 7.0.52 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:* Versions 8.0.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:* Versions 8.0.0 rc10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:* Versions 8.0.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:* Versions 8.0.0 rc5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:* Versions 8.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.3:*:*:*:*:*:*:* Versions 8.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions up to 6.0.39 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6:*:*:*:*:*:*:* Versions 6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.0:alpha:*:*:*:*:*:* Versions 6.0.0 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.1:*:*:*:*:*:*:* Versions 6.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.1:alpha:*:*:*:*:*:* Versions 6.0.1 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.2:*:*:*:*:*:*:* Versions 6.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.2:alpha:*:*:*:*:*:* Versions 6.0.2 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.2:beta:*:*:*:*:*:* Versions 6.0.2 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.3:*:*:*:*:*:*:* Versions 6.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.4:*:*:*:*:*:*:* Versions 6.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.4:alpha:*:*:*:*:*:* Versions 6.0.4 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.5:*:*:*:*:*:*:* Versions 6.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.6:*:*:*:*:*:*:* Versions 6.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.6:alpha:*:*:*:*:*:* Versions 6.0.6 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.7:*:*:*:*:*:*:* Versions 6.0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.7:alpha:*:*:*:*:*:* Versions 6.0.7 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.7:beta:*:*:*:*:*:* Versions 6.0.7 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.8:*:*:*:*:*:*:* Versions 6.0.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.8:alpha:*:*:*:*:*:* Versions 6.0.8 alpha Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.9:*:*:*:*:*:*:* Versions 6.0.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.9:beta:*:*:*:*:*:* Versions 6.0.9 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.10:*:*:*:*:*:*:* Versions 6.0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.11:*:*:*:*:*:*:* Versions 6.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.12:*:*:*:*:*:*:* Versions 6.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.13:*:*:*:*:*:*:* Versions 6.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.14:*:*:*:*:*:*:* Versions 6.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.15:*:*:*:*:*:*:* Versions 6.0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.16:*:*:*:*:*:*:* Versions 6.0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.17:*:*:*:*:*:*:* Versions 6.0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.18:*:*:*:*:*:*:* Versions 6.0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.19:*:*:*:*:*:*:* Versions 6.0.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.20:*:*:*:*:*:*:* Versions 6.0.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.24:*:*:*:*:*:*:* Versions 6.0.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.26:*:*:*:*:*:*:* Versions 6.0.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.27:*:*:*:*:*:*:* Versions 6.0.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.28:*:*:*:*:*:*:* Versions 6.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.29:*:*:*:*:*:*:* Versions 6.0.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.30:*:*:*:*:*:*:* Versions 6.0.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.31:*:*:*:*:*:*:* Versions 6.0.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.32:*:*:*:*:*:*:* Versions 6.0.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.33:*:*:*:*:*:*:* Versions 6.0.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.35:*:*:*:*:*:*:* Versions 6.0.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.36:*:*:*:*:*:*:* Versions 6.0.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:6.0.37:*:*:*:*:*:*:* Versions 6.0.37 Vulnerable ·Apache

Remediation

  • Fix · GHSA-475f-74wp-pqv5 org.apache.tomcat:tomcat (Maven) Fixed in 6.0.40 Advisory →
  • Fix · GHSA-475f-74wp-pqv5 org.apache.tomcat:tomcat (Maven) Fixed in 7.0.53 Advisory →
  • Fix · GHSA-475f-74wp-pqv5 org.apache.tomcat:tomcat (Maven) Fixed in 8.0.4 Advisory →
  • Fix · GHSA-475f-74wp-pqv5 org.apache.tomcat:tomcat-coyote (Maven) Fixed in 6.0.40 Advisory →
  • Fix · GHSA-475f-74wp-pqv5 org.apache.tomcat:tomcat-coyote (Maven) Fixed in 7.0.53 Advisory →
  • Fix · GHSA-475f-74wp-pqv5 org.apache.tomcat:tomcat-coyote (Maven) Fixed in 8.0.4 Advisory →

Red Hat 16 advisories

  • RHSA-2015:1009 Released 2015-05-14 · Red Hat rating Important
    Red Hat JBoss Portal 6.2.0 update
    • Red Hat JBoss Portal 6.2
  • RHSA-2015:0765 Released 2015-03-31 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.0.0 security update
    • Red Hat JBoss Data Virtualization 6.0
  • RHSA-2015:0720 Released 2015-03-24 · Red Hat rating Important
    Red Hat JBoss Fuse Service Works 6.0.0 security update
    • Red Hat JBoss Fuse Service Works 6.0
Show 13 more Red Hat advisories
  • RHSA-2015:0675 Released 2015-03-11 · Red Hat rating Important
    Red Hat JBoss Data Virtualization 6.1.0 update
    • Red Hat JBoss Data Virtualization 6.1
  • RHSA-2015:0234 Released 2015-02-17 · Red Hat rating Important
    Red Hat JBoss BPM Suite 6.0.3 security update
    • Red Hat JBoss BPMS 6.0
  • RHSA-2015:0235 Released 2015-02-17 · Red Hat rating Important
    Red Hat JBoss BRMS 6.0.3 security update
    • Red Hat JBoss BRMS 6.0
  • RHSA-2014:1149 Released 2014-09-03 · Red Hat rating Moderate
    Red Hat JBoss Operations Network 3.2.3 update
    • Red Hat JBoss Operations Network 3.2
  • RHSA-2014:0895 Released 2014-07-16 · Red Hat rating Moderate
    Red Hat JBoss Data Grid 6.3.0 update
    • Red Hat JBoss Data Grid 6.3
  • RHSA-2014:0865 Released 2014-07-09 · Red Hat rating Moderate
    tomcat6 security and bug fix update
    • Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6-6.0.24-72.el6_5, tomcat6-admin-webapps-6.0.24-72.el6_5, tomcat6-docs-webapp-6.0.24-72.el6_5 +6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6-6.0.24-72.el6_5, tomcat6-admin-webapps-6.0.24-72.el6_5, tomcat6-docs-webapp-6.0.24-72.el6_5 +6
    • Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-72.el6_5, tomcat6-el-2.1-api-6.0.24-72.el6_5, tomcat6-jsp-2.1-api-6.0.24-72.el6_5 +2
    • Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-6.0.24-72.el6_5, tomcat6-admin-webapps-6.0.24-72.el6_5, tomcat6-docs-webapp-6.0.24-72.el6_5 +2
    • Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-72.el6_5, tomcat6-el-2.1-api-6.0.24-72.el6_5, tomcat6-jsp-2.1-api-6.0.24-72.el6_5 +2
    • Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-6.0.24-72.el6_5, tomcat6-admin-webapps-6.0.24-72.el6_5, tomcat6-docs-webapp-6.0.24-72.el6_5 +2
  • RHSA-2014:0842 Released 2014-07-07 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.2.4 security update
    • Red Hat JBoss Enterprise Application Platform 6.2
  • RHSA-2014:0843 Released 2014-07-07 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.2.4 security update
    • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server jbossweb-7.3.2-4.Final_redhat_3.1.ep6.el5
    • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server jbossweb-7.3.2-4.Final_redhat_3.1.ep6.el6
  • RHSA-2014:0833 Released 2014-07-03 · Red Hat rating Moderate
    Red Hat JBoss Web Server 2.0.1 tomcat6 security update
    • Red Hat JBoss Web Server 2.0
  • RHSA-2014:0834 Released 2014-07-03 · Red Hat rating Moderate
    Red Hat JBoss Web Server 2.0.1 tomcat6 security and bug fix update
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server tomcat6-6.0.37-20_patch_04.ep6.el5, tomcat6-admin-webapps-6.0.37-20_patch_04.ep6.el5, tomcat6-docs-webapp-6.0.37-20_patch_04.ep6.el5 +7
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server tomcat6-6.0.37-29_patch_05.ep6.el6, tomcat6-admin-webapps-6.0.37-29_patch_05.ep6.el6, tomcat6-docs-webapp-6.0.37-29_patch_05.ep6.el6 +7
  • RHSA-2014:0835 Released 2014-07-03 · Red Hat rating Moderate
    Red Hat JBoss Web Server 2.0.1 tomcat7 security update
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server tomcat7-7.0.40-14_patch_03.ep6.el5, tomcat7-admin-webapps-7.0.40-14_patch_03.ep6.el5, tomcat7-docs-webapp-7.0.40-14_patch_03.ep6.el5 +7
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server tomcat7-7.0.40-11_patch_03.ep6.el6, tomcat7-admin-webapps-7.0.40-11_patch_03.ep6.el6, tomcat7-docs-webapp-7.0.40-11_patch_03.ep6.el6 +7
  • RHSA-2014:0836 Released 2014-07-03 · Red Hat rating Moderate
    Red Hat JBoss Web Server 2.0.1 tomcat7 security update
    • Red Hat JBoss Web Server 2.0
  • RHSA-2014:0827 Released 2014-07-02 · Red Hat rating Moderate
    tomcat security update
    • Red Hat Enterprise Linux Client (v. 7) tomcat-7.0.42-6.el7_0, tomcat-servlet-3.0-api-7.0.42-6.el7_0
    • Red Hat Enterprise Linux Client Optional (v. 7) tomcat-7.0.42-6.el7_0, tomcat-admin-webapps-7.0.42-6.el7_0, tomcat-docs-webapp-7.0.42-6.el7_0 +6
    • Red Hat Enterprise Linux ComputeNode (v. 7) tomcat-7.0.42-6.el7_0, tomcat-servlet-3.0-api-7.0.42-6.el7_0
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat-7.0.42-6.el7_0, tomcat-admin-webapps-7.0.42-6.el7_0, tomcat-docs-webapp-7.0.42-6.el7_0 +6
    • Red Hat Enterprise Linux Server (v. 7) tomcat-7.0.42-6.el7_0, tomcat-admin-webapps-7.0.42-6.el7_0, tomcat-el-2.2-api-7.0.42-6.el7_0 +4
    • Red Hat Enterprise Linux Server Optional (v. 7) tomcat-7.0.42-6.el7_0, tomcat-admin-webapps-7.0.42-6.el7_0, tomcat-docs-webapp-7.0.42-6.el7_0 +6
    • Red Hat Enterprise Linux Workstation (v. 7) tomcat-7.0.42-6.el7_0, tomcat-admin-webapps-7.0.42-6.el7_0, tomcat-el-2.2-api-7.0.42-6.el7_0 +4
    • Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-docs-webapp-7.0.42-6.el7_0, tomcat-javadoc-7.0.42-6.el7_0, tomcat-jsvc-7.0.42-6.el7_0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 1AffectedNo fix planned: Will not fix
Red Hat JBoss Operations Network 3AffectedNo fix yet
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2014:0827
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2014:0827
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2014:0827
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2014:0827
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2014:0865
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2014:0865
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:0865
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2014:0827
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2014:0865
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2014:0827
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:0865
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2014:0827
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2014:0865
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2014:0827
Red Hat JBoss BPMS 6.0Fixed RHSA-2015:0234
Red Hat JBoss BRMS 6.0Fixed RHSA-2015:0235
Red Hat JBoss Data Grid 6.3Fixed RHSA-2014:0895
Red Hat JBoss Data Virtualization 6.0Fixed RHSA-2015:0765
Red Hat JBoss Data Virtualization 6.1Fixed RHSA-2015:0675
Red Hat JBoss Enterprise Application Platform 6.2Fixed RHSA-2014:0842
Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 ServerFixed RHSA-2014:0843
Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 ServerFixed RHSA-2014:0843
Red Hat JBoss Enterprise Web Server 2 for RHEL 5 ServerFixed RHSA-2014:0834, RHSA-2014:0835
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 ServerFixed RHSA-2014:0834, RHSA-2014:0835
Red Hat JBoss Fuse Service Works 6.0Fixed RHSA-2015:0720
Red Hat JBoss Operations Network 3.2Fixed RHSA-2014:1149
Red Hat JBoss Portal 6.2Fixed RHSA-2015:1009
Red Hat JBoss Web Server 2.0Fixed RHSA-2014:0833

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0075
  2. 2026-10-03 Alias added: GHSA-475f-74wp-pqv5
  3. 2026-10-15 CISA SSVC decision points changed

References

Advisory 16

Other 33

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences