Description
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | tomcat5.5 | 5.5.26-5lenny2 | DSA-2207-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.7.el5_3.2 | RHSA-2009:1164 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Developer Suite 3 | tomcat5 +5 | 5.5.23-0jpp_18rh | RHSA-2009:1563 |
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.16 | RHSA-2009:1562 |
| Red Hat Network Satellite 5 | tomcat5 | 5.0.30-0jpp_16rh | RHSA-2009:1617, RHSA-2009:1616 |
| Red Hat Network Satellite 5 | tomcat5-jasper +4 | 5.5.23-0jpp_18rh | RHSA-2009:1616 |
| Red Hat JBoss Web Server 1 | tomcat5 +10 | 5.5.23-0jpp.9.6.ep5.el5 | RHSA-2009:1454 |
| Red Hat JBoss Web Server 1 | tomcat6 +9 | 6.0.18-11.3.ep5.el4 | RHSA-2009:1506 |
| Red Hat Certificate System 7 | ant | 1.6.5-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | avalon-logkit | 1.2-2jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | axis | 1.2.1-1jpp_3rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-jaf | 1.0-2jpp_6rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | classpathx-mail | 1.1.1-2jpp_8rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | geronimo-specs +10 | 1.0-0.M4.1jpp_10rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | jakarta-commons-modeler | 2.0-3jpp_2rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | log4j | 1.2.12-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | mx4j | 1:3.0.1-1jpp_4rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | pcsc-lite +2 | 1.3.3-3.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-ca | 7.3.0-20.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-java-tools | 7.3.0-10.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-kra | 7.3.0-14.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-manage | 7.3.0-19.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-native-tools | 7.3.0-6.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | rhpki-tks +1 | 7.3.0-13.el4 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.16 | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xerces-j2 | 2.7.1-1jpp_1rh | RHSA-2010:0602 |
| Red Hat Certificate System 7 | xml-commons +1 | 1.3.02-2jpp_1rh | RHSA-2010:0602 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 4.1.0, <= 4.1.39 | — | GHSA-5cw4-ggx9-36vg |
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, <= 5.5.27 | — | GHSA-5cw4-ggx9-36vg |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, <= 6.0.18 | — | GHSA-5cw4-ggx9-36vg |
Advisories 9
- RHSA-2010:0602 Red Hat Security Advisory: Red Hat Certificate System 7.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1164 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2207-1 tomcat5.5 - several Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2009:1617 Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1616 Red Hat Security Advisory: tomcat security update for Red Hat Network Satellite Server Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1563 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1562 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1506 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:1454 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://tomcat.apache.org/security-4.html
- HPSBMA02535 vendor-advisory
- 35326 third-party-advisory
- MDVSA-2009:138 vendor-advisory
- FEDORA-2009-11356 vendor-advisory
- DSA-2207 vendor-advisory
- 35344 third-party-advisory
- HPSBUX02860 vendor-advisory
- 37460 third-party-advisory
- ADV-2010-3056 vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 35788 third-party-advisory
- APPLE-SA-2010-03-29-1 vendor-advisory
- JVN#87272440 third-party-advisory
- ADV-2009-1496 vdb-entry
- HPSBOV02762 vendor-advisory
- 1022331 vdb-entry
- ADV-2009-1856 vdb-entry
- oval:org.mitre.oval:def:10231 vdb-entry signature
- 35193 vdb-entry
- MDVSA-2010:176 vendor-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- 42368 third-party-advisory
- http://tomcat.apache.org/security-6.html
- 20090603 [SECURITY] CVE-2009-0033 Apache Tomcat DoS when using Java AJP connector mailing-list
- http://support.apple.com/kb/HT4077
- http://svn.apache.org/viewvc?rev=742915&view=rev
- FEDORA-2009-11374 vendor-advisory
- http://svn.apache.org/viewvc?rev=781362&view=rev
- 35685 third-party-advisory
- FEDORA-2009-11352 vendor-advisory
- http://tomcat.apache.org/security-5.html
- oval:org.mitre.oval:def:19110 vdb-entry signature
- SUSE-SR:2009:012 vendor-advisory
- HPSBUX02579 vendor-advisory
- MDVSA-2009:136 vendor-advisory
- 263529 vendor-advisory
- tomcat-ajp-dos(50928) vdb-entry
- ADV-2009-3316 vdb-entry
- oval:org.mitre.oval:def:5739 vdb-entry signature
- [tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list