Description
Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | tomcat6 | 6.0.35-1+squeeze2 | DSA-2401-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | tomcat6 +8 | 6.0.24-36.el6_2 | RHSA-2012:0475 |
| RHEL 5 | tomcat5 +10 | 5.5.23-0jpp.31.el5_8 | RHSA-2012:0474 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 1 | tomcat5 +12 | 5.5.33-27_patch_07.ep5.el5 | RHSA-2012:0680 |
| Red Hat JBoss Web Server 1 | tomcat6 +9 | 6.0.32-24_patch_07.ep5.el5 | RHSA-2012:0682 |
| Red Hat JBoss Web Platform 5 | jbossweb +4 | 2.1.12-3_patch_03.2.ep5.el5 | RHSA-2012:0076 |
| Red Hat JBoss EAP 5 | jbossweb +4 | 2.1.12-3_patch_03.2.ep5.el4 | RHSA-2012:0074 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 5.5.0, < 5.5.35 | 5.5.35 | GHSA-8h2q-qm9x-55jc |
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.34 | 6.0.34 | GHSA-8h2q-qm9x-55jc |
| Maven | org.apache.tomcat:tomcat | >= 7.0.0, < 7.0.23 | 7.0.23 | GHSA-8h2q-qm9x-55jc |
Advisories 7
- RHSA-2012:0682 Red Hat Security Advisory: tomcat6 security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0680 Red Hat Security Advisory: tomcat5 security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0474 Red Hat Security Advisory: tomcat5 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0475 Red Hat Security Advisory: tomcat6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0076 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2012:0074 Red Hat Security Advisory: jbossweb security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-2401-1 tomcat6 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-2401 vendor-advisory
- RHSA-2012:0325 vendor-advisory
- apache-tomcat-parameter-dos(72425) vdb-entry
- HPSBUX02860 vendor-advisory
- oval:org.mitre.oval:def:16925 vdb-entry signature
- RHSA-2012:0078 vendor-advisory
- MDVSA-2012:085 vendor-advisory
- 48791 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
- 51447 vdb-entry
- RHSA-2012:0075 vendor-advisory
- RHSA-2012:0074 vendor-advisory
- http://tomcat.apache.org/security-7.html
- 48549 third-party-advisory
- oval:org.mitre.oval:def:18934 vdb-entry signature
- 48790 third-party-advisory
- http://tomcat.apache.org/security-6.html
- 20120117 [SECURITY] CVE-2012-0022 Apache Tomcat Denial of Service mailing-list
- RHSA-2012:1331 vendor-advisory
- 50863 third-party-advisory
- RHSA-2012:0345 vendor-advisory
- http://tomcat.apache.org/security-5.html
- SSRT100771 vendor-advisory
- SSRT100728 vendor-advisory
- MDVSA-2013:150 vendor-advisory
- RHSA-2012:0076 vendor-advisory
- 48213 third-party-advisory
- RHSA-2012:0077 vendor-advisory
- [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/ mailing-list