Description
Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | tomcat5.5 | 5.5.26-5lenny2 | DSA-2207-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.9.el5_5 | RHSA-2010:0580 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Developer Suite 3 | tomcat5 +5 | 5.5.23-0jpp_21rh | RHSA-2010:0583 |
| Red Hat Rhel Application Server 2 | tomcat5 +10 | 5.5.23-0jpp_4rh.17 | RHSA-2010:0582 |
| Red Hat JBoss Web Server 1 | tomcat5 +12 | 5.5.28-9.patch_01.jdk6.ep5.el4 | RHSA-2010:0581 |
| Red Hat JBoss Web Server 1 | tomcat6 +9 | 6.0.24-7.patch_01.jdk6.ep5.el4 | RHSA-2010:0581 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-6.CP14.0jpp.ep1.1.el4 | RHSA-2010:0584 |
| Red Hat Certificate System 7 | tomcat5 +5 | 5.5.23-0jpp_4rh.19 | RHSA-2010:0693 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
Slowloris Denial of Service Attack
auxiliary/dos/http/slowloris
-
Apache Tomcat Transfer-Encoding Information Disclosure and DoS
auxiliary/dos/http/apache_tomcat_transfer_encoding
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 7.0.0, < 7.0.2 | 7.0.2 | GHSA-cxg2-49rq-8gcr |
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, < 5.5.30 | 5.5.30 | GHSA-cxg2-49rq-8gcr |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.28 | 6.0.28 | GHSA-cxg2-49rq-8gcr |
Advisories 7
- RHSA-2010:0693 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2010:0583 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2010:0584 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2010:0581 Red Hat Security Advisory: tomcat5 and tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2010:0582 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2010:0580 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-2207-1 tomcat5.5 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.novell.com/support/viewContent.do?externalId=7007274
- 20100709 [SECURITY] CVE-2010-2227: Apache Tomcat Remote Denial Of Service and Information Disclosure Vulnerability mailing-list
- 42079 third-party-advisory
- DSA-2207 vendor-advisory
- HPSBUX02860 vendor-advisory
- http://www.novell.com/support/viewContent.do?externalId=7007275
- MDVSA-2010:177 vendor-advisory
- ADV-2010-3056 vdb-entry
- 43310 third-party-advisory
- RHSA-2010:0581 vendor-advisory
- 41544 vdb-entry
- http://tomcat.apache.org/security-7.html
- FEDORA-2010-16270 vendor-advisory
- ADV-2010-1986 vdb-entry
- http://svn.apache.org/viewvc?view=revision&revision=959428
- 44183 third-party-advisory
- RHSA-2010:0580 vendor-advisory
- 41025 third-party-advisory
- FEDORA-2010-16248 vendor-advisory
- http://geronimo.apache.org/22x-security-report.html
- 40813 third-party-advisory
- APPLE-SA-2011-10-12-3 vendor-advisory
- MDVSA-2010:176 vendor-advisory
- 42368 third-party-advisory
- http://tomcat.apache.org/security-6.html
- 57126 third-party-advisory
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- oval:org.mitre.oval:def:18532 vdb-entry signature
- 1024180 vdb-entry
- SUSE-SR:2010:017 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=958911
- http://tomcat.apache.org/security-5.html
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- HPSBUX02579 vendor-advisory
- tomcat-transferencoding-dos(60264) vdb-entry
- http://support.apple.com/kb/HT5002
- RHSA-2010:0582 vendor-advisory
- ADV-2010-2868 vdb-entry
- http://geronimo.apache.org/21x-security-report.html
- 42454 third-party-advisory
- 20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX mailing-list
- HPSBST02955 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=958977
- RHSA-2010:0583 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list