Read the docs
TI-2019-13111 Aliases CVE-2019-17569GHSA-767j-jfh2-jvrc

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to…

Priority LOW 33CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 4 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

Why it matters now

EPSS 0.08872 95th percentileScored 2026-11-07
Fix Partial org.apache.tomcat.embed:tomcat-embed-core (Maven): 7.0.100, 8.5.51, 9.0.31org.apache.tomcat:tomcat (Maven): 7.0.100, 8.5.51, 9.0.31Red Hat: 2 advisoriesRed Hat: 4 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TomcatApache Tomcat 9.0.28 to 9.0.30; 8.5.48 to 8.5.50; 7.0.98 to 7.0.99—No fix listedCNA
—org.apache.tomcat.embed:tomcat-embed-core (Maven)7.0.98 to before 7.0.1007.0.100Patch availableGHSA-767j-jfh2-jvrc
—org.apache.tomcat.embed:tomcat-embed-core (Maven)8.5.48 to before 8.5.518.5.51Patch availableGHSA-767j-jfh2-jvrc
—org.apache.tomcat.embed:tomcat-embed-core (Maven)9.0.28 to before 9.0.319.0.31Patch availableGHSA-767j-jfh2-jvrc
—org.apache.tomcat:tomcat (Maven)7.0.98 to before 7.0.1007.0.100Patch availableGHSA-767j-jfh2-jvrc
—org.apache.tomcat:tomcat (Maven)8.5.48 to before 8.5.518.5.51Patch availableGHSA-767j-jfh2-jvrc
—org.apache.tomcat:tomcat (Maven)9.0.28 to before 9.0.319.0.31Patch availableGHSA-767j-jfh2-jvrc
  • Apache Tomcat VendorApache Affected Apache Tomcat 9.0.28 to 9.0.30; 8.5.48 to 8.5.50; 7.0.98 to 7.0.99 Fixed in — No fix listed CNA
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 7.0.98 to before 7.0.100 Fixed in 7.0.100 Patch available GHSA-767j-jfh2-jvrc
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 8.5.48 to before 8.5.51 Fixed in 8.5.51 Patch available GHSA-767j-jfh2-jvrc
  • org.apache.tomcat.embed:tomcat-embed-core (Maven) Vendor— Affected 9.0.28 to before 9.0.31 Fixed in 9.0.31 Patch available GHSA-767j-jfh2-jvrc
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 7.0.98 to before 7.0.100 Fixed in 7.0.100 Patch available GHSA-767j-jfh2-jvrc
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.5.48 to before 8.5.51 Fixed in 8.5.51 Patch available GHSA-767j-jfh2-jvrc
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 9.0.28 to before 9.0.31 Fixed in 9.0.31 Patch available GHSA-767j-jfh2-jvrc

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*7.0.98 – 7.0.99; 8.5.48 – 8.5.50; 9.0.28 – 9.0.30VulnerableApache
cpe:2.3:a:apache:tomee:7.0.7:*:*:*:*:*:*:*7.0.7VulnerableApache
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*3.0.0 – 3.1.3VulnerableNetApp
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:*6.2.1.0VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:*9.3.3VulnerableOracle
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:*9.3.5VulnerableOracle
  • cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* Versions 7.0.98 – 7.0.99; 8.5.48 – 8.5.50; 9.0.28 – 9.0.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomee:7.0.7:*:*:*:*:*:*:* Versions 7.0.7 Vulnerable ·Apache
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:a:netapp:data_availability_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* Versions 3.0.0 – 3.1.3 Vulnerable ·NetApp
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1.0:*:*:*:*:*:*:* Versions 6.2.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.3:*:*:*:*:*:*:* Versions 9.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.5:*:*:*:*:*:*:* Versions 9.3.5 Vulnerable ·Oracle
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableOracle
cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:*10.0.1.4.0VulnerableOracle
cpe:2.3:a:oracle:health_sciences_empirica_inspections:1.0.1.2:*:*:*:*:*:*:*1.0.1.2VulnerableOracle
cpe:2.3:a:oracle:health_sciences_empirica_signal:7.3.3:*:*:*:*:*:*:*7.3.3VulnerableOracle
cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableOracle
cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*4.2.1VulnerableOracle
cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:*17.1 – 17.3VulnerableOracle
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*up to 4.0.12; 8.0.0 – 8.0.20VulnerableOracle
cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:*6.3.7VulnerableOracle
cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:*12.2.0.1VulnerableOracle
cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:*18cVulnerableOracle
cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:*19cVulnerableOracle
  • cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.4.0:*:*:*:*:*:*:* Versions 10.0.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_empirica_inspections:1.0.1.2:*:*:*:*:*:*:* Versions 1.0.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_empirica_signal:7.3.3:*:*:*:*:*:*:* Versions 7.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:* Versions 17.1 – 17.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 4.0.12; 8.0.0 – 8.0.20 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:transportation_management:6.3.7:*:*:*:*:*:*:* Versions 6.3.7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:12.2.0.1:*:*:*:*:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
  • cpe:2.3:a:oracle:workload_manager:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle

Remediation

  • Fix · GHSA-767j-jfh2-jvrc org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 7.0.100 Advisory →
  • Fix · GHSA-767j-jfh2-jvrc org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 8.5.51 Advisory →
  • Fix · GHSA-767j-jfh2-jvrc org.apache.tomcat.embed:tomcat-embed-core (Maven) Fixed in 9.0.31 Advisory →
  • Fix · GHSA-767j-jfh2-jvrc org.apache.tomcat:tomcat (Maven) Fixed in 7.0.100 Advisory →
  • Fix · GHSA-767j-jfh2-jvrc org.apache.tomcat:tomcat (Maven) Fixed in 8.5.51 Advisory →
  • Fix · GHSA-767j-jfh2-jvrc org.apache.tomcat:tomcat (Maven) Fixed in 9.0.31 Advisory →

Red Hat 2 advisories

  • RHSA-2020:1520 Released 2020-04-21 · Red Hat rating Important
    Red Hat JBoss Web Server 5.3 release
    • Red Hat JBoss Web Server 5.3 for RHEL 6 Server jws5-tomcat-9.0.30-3.redhat_4.1.el6jws, jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el6jws, jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el6jws +8
    • Red Hat JBoss Web Server 5.3 for RHEL 7 Server jws5-tomcat-9.0.30-3.redhat_4.1.el7jws, jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el7jws, jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el7jws +8
    • Red Hat JBoss Web Server 5.3 for RHEL 8 jws5-tomcat-9.0.30-3.redhat_4.1.el8jws, jws5-tomcat-admin-webapps-9.0.30-3.redhat_4.1.el8jws, jws5-tomcat-docs-webapp-9.0.30-3.redhat_4.1.el8jws +8
  • RHSA-2020:1521 Released 2020-04-21 · Red Hat rating Important
    Red Hat JBoss Web Server 5.3 release
    • Red Hat JBoss Web Server (JWS) 5.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache Tomcat — openSUSE-SU-2020:0345

    3 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2020-01862 Improper privilege management in Apache TomcatPriority CRITICAL 100
    • TI-2020-01859 In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header…Priority MEDIUM 40
    Show all 3 records → Advisory →
  • Advisory ·

    Apache Tomcat — DSA-4673

    3 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2020-01862 Improper privilege management in Apache TomcatPriority CRITICAL 100
    • TI-2020-01859 In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header…Priority MEDIUM 40
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat JBoss Web Server (JWS) 5.3Fixed RHSA-2020:1521
Red Hat JBoss Web Server 5.3 for RHEL 6 ServerFixed RHSA-2020:1520
Red Hat JBoss Web Server 5.3 for RHEL 7 ServerFixed RHSA-2020:1520
Red Hat JBoss Web Server 5.3 for RHEL 8Fixed RHSA-2020:1520
Not affected: 9 products
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Fuse 7
  • Red Hat JBoss Web Server 3
  • Red Hat Process Automation 7
  • Red Hat support for Spring Boot

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-17569
  2. 2026-10-03 Alias added: GHSA-767j-jfh2-jvrc

References

Patch 3

Advisory 7

Other 5

  • TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
  • TI-2020-01862 Improper privilege management in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-07192 Improper access control in Apache Tomcat KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-09340 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2026-26741 Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor KEVCVSS 3.1HIGH 7.5
See all 273 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences