Description
Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | < 4.1.3-beta | 4.1.3-beta | GHSA-xmf4-j3j7-xj7q |
References
- 20020620 KPMG-2002025: Apache Tomcat Denial of Service mailing-list
- 20020620 [VulnWatch] KPMG-2002025: Apache Tomcat Denial of Service mailing-list
- 5051 vdb-entry
- 5067 vdb-entry
- tomcat-null-thread-dos(9396) vdb-entry
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list