CVE-2014-0227 — Improper Input Validation in Apache Tomcat

Description

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 7	tomcat6	6.0.45+dfsg-1~deb7u1	DSA-3530-1
Debian 6.0	tomcat6	6.0.41-2+squeeze7	DLA-232-1

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	tomcat6	6.0.45+dfsg-1	—
Ubuntu 14.04 LTS	tomcat6	6.0.39-1ubuntu0.1	—
Ubuntu 14.04 LTS	tomcat7	7.0.52-1ubuntu0.3	USN-2654-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 7	tomcat +5	7.0.54-2.el7_1	RHSA-2015:0983
RHEL 7	tomcat-jsvc +3	7.0.54-2.ael7b_1	RHSA-2015:0983
RHEL 6	tomcat6 +8	6.0.24-83.el6_6	RHSA-2015:0991

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Server 2	antlr-eap6	2.7.7-17.redhat_4.1.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	apache-commons-collections-eap6 +1	3.2.1-15.redhat_3.1.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	apache-commons-daemon-eap6	1:1.0.15-5.redhat_1.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	apache-commons-daemon-jsvc-eap6	1:1.0.15-6.redhat_2.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	apache-commons-logging-eap6 +1	1.1.1-7.9_redhat_1.ep6.el6	RHSA-2014:1087
Red Hat JBoss Web Server 2	apache-commons-pool-eap6 +1	1.6-7.redhat_6.1.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	dom4j-eap6	1.6.1-20.redhat_6.1.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	ecj3	1:3.7.2-9.redhat_3.1.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	hibernate4-eap6 +5	4.2.14-3.SP1_redhat_1.1.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	httpd +3	2.2.26-35.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	javassist-eap6	3.18.1-1.GA_redhat_1.1.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	jboss-logging	3.1.4-1.GA_redhat_1.1.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	jboss-transaction-api_1.1_spec	1.0.1-12.Final_redhat_2.2.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	mod_cluster +2	1.2.9-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	mod_cluster-native	1.2.9-3.Final_redhat_2.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	mod_jk +2	1.2.40-2.redhat_1.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	mod_rt	2.4.1-6.GA.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	mod_snmp	2.4.1-13.GA.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	mod_ssl	1:2.2.26-35.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	storeconfig-tc6	0.0.1-7.Alpha3_redhat_12.3.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	storeconfig-tc7	0.0.1-7.Alpha3_redhat_12.5.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	tomcat-native	1.1.30-2.redhat_1.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	tomcat6 +9	6.0.41-5_patch_02.ep6.el6	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss Web Server 2	tomcat7 +9	7.0.54-6_patch_02.ep6.el5	RHSA-2014:1088, RHSA-2014:1087
Red Hat JBoss EAP 6	apache-commons-beanutils-eap6	1.8.3-7.redhat_6.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-cli-eap6	1.2-6.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-codec-eap6	1.4-16.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-collections-eap6	3.2.1-15.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-configuration-eap6	1.6-1.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-daemon-jsvc-eap6	1:1.0.15-6.redhat_2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-io-eap6	2.1-8.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-commons-lang-eap6	2.6-8.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	apache-mime4j	0.6-10.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	cal10n-eap6	0.7.3-2.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	codehaus-jackson +4	1.9.9-7.redhat_3.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	ecj-eap6	4.3.1-3.redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	glassfish-jaf	1.1.1-16.redhat_2.ep6.el6	RHSA-2014:1020
Red Hat JBoss EAP 6	glassfish-jaxb-eap6	2.2.5-20.redhat_8.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	gnu-getopt-eap6	1.0.13-1.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	guava-libraries	13.0.1-3.redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	h2database	1.3.168-7.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	hibernate4-eap6 +4	4.2.14-2.SP1_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	hibernate4-validator	4.3.1-2.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	hornetq	2.3.20-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	hornetq-native +1	2.3.20-2.Final_redhat_1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	httpcomponents-eap6 +1	6-10.redhat_1.3.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	httpcore-eap6 +4	4.2.1-10.redhat_1.3.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	httpd +3	2.2.26-35.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	infinispan +4	5.2.10-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	ironjacamar-eap6 +9	1.0.26-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jandex-eap6	1.0.3-3.Final_redhat_2.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jansi-eap6	1.9-2.redhat_4.3.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jaxbintros	1.0.2-17.GA_redhat_6.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jaxen-eap6	1.1.3-2.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-as-ee +50	7.4.0-13.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-as-security +1	7.4.0-14.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-genericjms	1.0.5-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-hal +1	2.2.8-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-jaxws-api_2.2_spec	2.0.2-4.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-jms-api_1.1_spec	1.0.1-8.Final_redhat_2.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-jstl-api_1.2_spec	1.0.6-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-logging	3.1.4-1.GA_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-marshalling	1.4.6-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-metadata +5	7.1.0-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-msc	1.1.5-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-remoting3	3.3.1-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-saaj-api_1.3_spec	1.0.3-3.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-sasl	1.0.4-2.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-security-negotiation	2.3.3-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-transaction-api_1.1_spec	1.0.1-10.Final_redhat_2.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-transaction-spi	7.1.0-2.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jboss-vfs2	3.2.5-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossas-core	7.4.0-16.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossas-domain +4	7.4.0-15.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossas-javadocs	7.4.0-20.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossas-modules-eap	7.4.0-38.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossas-product-eap	7.4.0-19.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossas-welcome-content-eap	7.4.0-17.Final_redhat_19.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossts	1:4.17.21-2.Final_redhat_2.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossweb	7.4.8-4.Final_redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossws-common	2.3.0-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossws-cxf	4.3.0-3.Final_redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossws-native	4.2.0-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jbossws-spi	2.3.0-2.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jdom-eap6	1.1.2-6.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jettison-eap6	1.3.1-3.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jgroups	1:3.2.13-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	joda-time-eap6	1.6.2-1.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	jython-eap6	2.5.2-6.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	mod_cluster +1	1.2.9-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	mod_cluster-native	1.2.9-3.Final_redhat_2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	mod_jk +1	1.2.40-2.redhat_1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	mod_rt	2.4.1-3.GA.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	mod_snmp	2.4.1-7.GA.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	mod_ssl	1:2.2.26-35.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	netty	3.6.9-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	opensaml	2.5.3-4.redhat_2.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	openws	1.4.4-3.redhat_2.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	picketlink-bindings	2.5.3-8.SP10_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	picketlink-federation	2.5.3-9.SP10_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	resteasy	2.3.8-4.Final_redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	rngom-eap6	201103-2.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	scannotation	1.0.3-6.redhat_4.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	slf4j +1	1.7.2-13.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	slf4j-jboss-logmanager	1.0.3-1.GA_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	snakeyaml-eap6	1.8-1.redhat_2.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	stilts	0.1.26-13.redhat_4.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	sun-codemodel	2.6-4.redhat_2.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	sun-istack-commons	1:2.6.1-10.redhat_2.2.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	sun-saaj-1.3-impl	1.3.16-9.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	sun-txw2	20110809-7.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	sun-xsom	20110809-7.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	tomcat-native +1	1.1.30-2.redhat_1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	weld-core	1.1.23-1.Final_redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	woodstox-core-eap6	4.2.0-12.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	woodstox-stax2-api-eap6	3.1.3-3.redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	ws-commons-neethi	3.0.2-8.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	wsdl4j-eap6	1.6.3-1.redhat_1.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	xml-commons-resolver-eap6	1.2-17.redhat_9.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	xmltooling	1.3.4-6.redhat_3.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019
Red Hat JBoss EAP 6	xom	1.2.7-3.redhat_4.1.ep6.el5	RHSA-2014:1020, RHSA-2014:1019

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 11 SP4	tomcat6	6.0.41-0.47.1	SUSE-SU-2015:1565-1

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLES for SAP 11 SP4	tomcat6	6.0.41-0.47.1	SUSE-SU-2015:1565-1

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 7	tomcat +9	7.0.54-2.el7_1	ELSA-2015-0983

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.tomcat:tomcat	>= 6.0.0, < 6.0.42	6.0.42	GHSA-42j3-498q-m6vp
Maven	org.apache.tomcat:tomcat	>= 7.0.0, < 7.0.55	7.0.55	GHSA-42j3-498q-m6vp
Maven	org.apache.tomcat:tomcat	>= 8.0.0, < 8.0.9	8.0.9	GHSA-42j3-498q-m6vp

Advisories 12

RHSA-2015:0991 Red Hat Security Advisory: tomcat6 security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2015:0983 Red Hat Security Advisory: tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2014:1088 Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2014:1087 Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2014:1020 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2014:1019 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
DSA-3530-1 tomcat6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
DLA-232-1 tomcat6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
USN-2654-1 tomcat7 vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
SUSE-SU-2015:1565-1 Security update for tomcat6 SUSE / openSUSE Security Updates · Feb 4, 2026
WID-SEC-2023-0451 Apache Tomcat: Schwachstelle ermöglicht Denial of Service und Manipulation BSI CERT-Bund (WID) · Feb 21, 2023
ELSA-2015-0983 Moderate: tomcat security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · May 12, 2015

References

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
USN-2654-1 vendor-advisory
RHSA-2015:0765 vendor-advisory
RHSA-2015:0675 vendor-advisory
MDVSA-2015:052 vendor-advisory
HPSBUX03341 vendor-advisory
RHSA-2015:0720 vendor-advisory
72717 vdb-entry
RHSA-2015:0991 vendor-advisory
MDVSA-2015:084 vendor-advisory
DSA-3530 vendor-advisory
1032791 vdb-entry
http://tomcat.apache.org/security-7.html
RHSA-2015:0983 vendor-advisory
SSRT102066 vendor-advisory
MDVSA-2015:053 vendor-advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
FEDORA-2015-2109 vendor-advisory
http://tomcat.apache.org/security-8.html
https://bugzilla.redhat.com/show_bug.cgi?id=1109196
https://source.jboss.org/changelog/JBossWeb?cs=2455
20150209 [SECURITY] CVE-2014-0227 Apache Tomcat Request Smuggling mailing-list
http://advisories.mageia.org/MGASA-2015-0081.html
http://tomcat.apache.org/security-6.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
USN-2655-1 vendor-advisory
http://svn.apache.org/viewvc?view=revision&revision=1600984
DSA-3447 vendor-advisory
[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/ mailing-list