Skip to content
OpenAdvisories
High USN-7032-1 1 CVE

tomcat8, tomcat9 vulnerability

Published Sep 24, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Tomcat incorrectly handled HTTP trailer headers. A
remote attacker could possibly use this issue to perform HTTP request
smuggling.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS tomcat9 9.0.31-1ubuntu0.7
Ubuntu · 24.04 LTS 24.04:LTS tomcat9 9.0.70-2ubuntu0.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS tomcat8 8.5.39-1ubuntu1~18.04.3+esm3
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS tomcat9 9.0.16-3ubuntu0.18.04.2+esm3
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS tomcat9 9.0.58-1ubuntu0.1+esm3

Vulnerabilities 1

  • High 7.5
    CVE-2023-46589

    Apache Tomcat: HTTP request smuggling via malformed trailer headers

    Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that e…

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2023-46589