Description
Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that triggers the overflow in a URI worker map routine.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache-mod-jk | 1:1.2.21-1 | — |
| Debian 13 | libapache-mod-jk | 1:1.2.21-1 | — |
| Debian 12 | libapache-mod-jk | 1:1.2.21-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | mod_jk +2 | 1.2.20-1.el4s1.2 | RHSA-2007:0096 |
| Red Hat Rhel Application Server 2 | mod_jk +2 | 1.2.20-1jpp_1rh | RHSA-2007:0164 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2-mod_jk | 1.2.48-2.9 | openSUSE-SU-2024:10625-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Apache mod_jk 1.2.20 Buffer Overflow
exploit/windows/http/apache_modjk_overflow
Exploit-DB 2
- Apache Tomcat mod_jk 1.2.20 - Remote Buffer Overflow (Metasploit) EDB-16798 · remote · Jul 25, 2010 · verified
- Apache Tomcat Connector mod_jk - 'exec-shield' Remote Overflow EDB-4162 · remote · Jul 8, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2007:0164 Red Hat Security Advisory: mod_jk security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10625-1 apache2-mod_jk-1.2.48-2.9 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2007:0096 Red Hat Security Advisory: mod_jk security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html
- RHSA-2007:0096 vendor-advisory
- ADV-2007-0809 vdb-entry
- tomcat-mapuritoworker-bo(32794) vdb-entry
- 24558 third-party-advisory
- 1017719 vdb-entry
- 20070302 ZDI-07-008: Apache Tomcat JK Web Server Connector Long URL Stack Overflow Vulnerability mailing-list
- 24398 third-party-advisory
- 20080130 Cisco Wireless Control System Tomcat mod_jk.so Vulnerability vendor-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-07-008.html
- ADV-2007-3386 vdb-entry
- oval:org.mitre.oval:def:5513 vdb-entry signature
- 27037 third-party-advisory
- 28711 third-party-advisory
- SSRT071447 vendor-advisory
- http://tomcat.apache.org/security-jk.html
- ADV-2008-0331 vdb-entry
- 22791 vdb-entry
- GLSA-200703-16 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [25/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [18/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [20/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [30/34] - /tomcat/site/trunk/docs/ mailing-list