Description
The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache-mod-jk | 1:1.2.26-2.1 | — |
| Debian 13 | libapache-mod-jk | 1:1.2.26-2.1 | — |
| Debian 12 | libapache-mod-jk | 1:1.2.26-2.1 | — |
| Debian 5.0 | libapache-mod-jk | 1:1.2.26-2+lenny1 | DSA-1810-1 |
| Debian 4.0 | libapache-mod-jk | 1:1.2.18-3etch2 | DSA-1810-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 2 | mod_jk +1 | 1.2.28-1.el5s2 | RHSA-2009:0446 |
| Red Hat Rhel Application Server 2 | mod_jk +2 | 1.2.28-1jpp_3rh | RHSA-2009:1087 |
| Red Hat Network Satellite 5 | mod_jk +1 | 1.2.25-10 | RHSA-2009:1618 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2-mod_jk | 1.2.41-1.5 | openSUSE-SU-2024:10488-1 |
Advisories 5
- RHSA-2009:1087 Red Hat Security Advisory: mod_jk security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1810-1 libapache-mod-jk - information Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:1618 Red Hat Security Advisory: mod_jk security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:0446 Red Hat Security Advisory: mod_jk security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- openSUSE-SU-2024:10488-1 apache2-mod_jk-1.2.41-1.5 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- ADV-2009-0973 vdb-entry
- http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html
- 34621 third-party-advisory
- SUSE-SR:2009:018 vendor-advisory
- 1022001 vdb-entry
- 34412 vdb-entry
- [oss-security] 20090408 CVE-2008-5519: mod_jk session information leak vulnerability mailing-list
- http://svn.eu.apache.org/viewvc/tomcat/connectors/trunk/jk/native/common/jk_ajp_common.c?r1=702387&r2=702540&pathrev=702540&diff_format=h
- RHSA-2009:0446 vendor-advisory
- [www-announce] 20090407 [SECURITY] CVE-2008-5519: Apache Tomcat mod_jk information disclosure vulnerability mailing-list
- http://svn.eu.apache.org/viewvc?view=rev&revision=702540
- [tomcat-dev] 20090407 [SECURITY] CVE-2008-5519: Apache Tomcat mod_jk information disclosure vulnerability mailing-list
- 20090407 [SECURITY] CVE-2008-5519: Apache Tomcat mod_jk information disclosure vulnerability mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=490201
- 29283 third-party-advisory
- http://tomcat.apache.org/security-jk.html
- 35537 third-party-advisory
- DSA-1810 vendor-advisory
- 262468 vendor-advisory
- http://svn.eu.apache.org/viewvc/tomcat/connectors/trunk/jk/xdocs/miscellaneous/changelog.xml?view=markup&pathrev=702540
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [25/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [18/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [20/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [30/34] - /tomcat/site/trunk/docs/ mailing-list