Skip to content
OpenAdvisories
High USN-6880-1 1 CVE

Tomcat vulnerability

Published Jul 9, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Sam Shahsavar discovered that Apache Tomcat did not properly reject
HTTP requests with an invalid Content-Length header. A remote attacker
could possibly use this issue to perform HTTP request smuggling attacks.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS tomcat9 9.0.31-1ubuntu0.5
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS tomcat8 8.5.39-1ubuntu1~18.04.3+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS tomcat9 9.0.16-3ubuntu0.18.04.2+esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS tomcat9 9.0.58-1ubuntu0.1+esm1

Vulnerabilities 1

  • High 7.5
    CVE-2022-42252

    Apache Tomcat request smuggling via malformed content-length

    If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing a…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2022-42252