Description
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | tomcat6 | 6.0.45+dfsg-1~deb7u1 | DSA-3530-1 |
| Debian 6.0 | tomcat6 | 6.0.41-2+squeeze7 | DLA-232-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | tomcat6 | 6.0.45+dfsg-1 | — |
| Ubuntu 14.04 LTS | tomcat6 | 6.0.39-1ubuntu0.1 | — |
| Ubuntu 14.04 LTS | tomcat7 | 7.0.52-1ubuntu0.3 | USN-2654-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | tomcat +9 | 7.0.69-10.el7 | RHSA-2016:2599 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 3 | apache-commons-collections-eap6 +1 | 3.2.1-18.redhat_7.1.ep6.el6 | RHSA-2015:2660, RHSA-2015:2659 |
| Red Hat JBoss Web Server 3 | httpd24 +5 | 2.4.6-59.ep7.el6 | RHSA-2015:2660, RHSA-2015:2659 |
| Red Hat JBoss Web Server 3 | mod_bmx | 0.9.5-5.GA.ep7.el6 | RHSA-2015:2660, RHSA-2015:2659, RHEA-2015:1771 |
| Red Hat JBoss Web Server 3 | mod_cluster +2 | 1.3.1-8.Final_redhat_3.1.ep7.el6 | RHEA-2015:1771, RHEA-2015:1770 |
| Red Hat JBoss Web Server 3 | mod_cluster-native | 1.3.1-6.Final_redhat_2.ep7.el6 | RHSA-2015:2660, RHSA-2015:2659 |
| Red Hat JBoss Web Server 3 | mod_jk +2 | 1.2.40-8.redhat_1.ep7.el6 | RHEA-2015:1771, RHEA-2015:1770 |
| Red Hat JBoss Web Server 3 | mod_security-jws3 | 2.8.0-6.GA.ep7.el6 | RHEA-2015:1771, RHEA-2015:1770 |
| Red Hat JBoss Web Server 3 | mod_ssl24 +1 | 1:2.4.6-59.ep7.el6 | RHSA-2015:2660, RHSA-2015:2659 |
| Red Hat JBoss Web Server 3 | tomcat-vault | 1.0.8-4.Final_redhat_4.1.ep7.el6 | RHSA-2015:2660, RHSA-2015:2659 |
| Red Hat JBoss Web Server 3 | tomcat7 +9 | 7.0.59-26_patch_00.ep7.el6 | RHSA-2015:2660, RHSA-2015:2659, RHEA-2015:1771 |
| Red Hat JBoss Web Server 3 | tomcat8 +9 | 8.0.18-25_patch_00.ep7.el6 | RHSA-2015:2660, RHSA-2015:2659, RHEA-2015:1771 |
| Red Hat JBoss Web Server 2 | tomcat6 +10 | 6.0.41-15_patch_04.ep6.el5 | RHSA-2015:1622 |
| Red Hat JBoss Web Server 2 | tomcat7 +10 | 7.0.54-19_patch_04.ep6.el5 | RHSA-2015:1622 |
| Red Hat JBoss EAP 6 | glassfish-jsf-eap6 | 2.1.28-10.SP9_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-11.SP9_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.18-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | ironjacamar-eap6 +9 | 1.0.36-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | jboss-as-ee +61 | 7.5.7-2.Final_redhat_3.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.7-2.Final_redhat_3.ep6.el6 | RHSA-2016:0598 |
| Red Hat JBoss EAP 6 | jboss-hal +1 | 2.5.12-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.3.11-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.5.7-3.Final_redhat_3.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.15-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | resteasy | 2.3.13-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
| Red Hat JBoss EAP 6 | weld-core | 1.1.33-1.Final_redhat_1.1.ep6.el5 | RHSA-2016:0597, RHSA-2016:0596, RHSA-2016:0595 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | tomcat6 | 6.0.41-0.47.1 | SUSE-SU-2015:1565-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 11 SP4 | tomcat6 | 6.0.41-0.47.1 | SUSE-SU-2015:1565-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | >= 6.0.0, < 6.0.44 | 6.0.44 | GHSA-pxcx-cxq8-4mmw |
| Maven | org.apache.tomcat:tomcat | >= 7.0.0, < 7.0.55 | 7.0.55 | GHSA-pxcx-cxq8-4mmw |
| Maven | org.apache.tomcat:tomcat | >= 8.0.0, < 8.0.9 | 8.0.9 | GHSA-pxcx-cxq8-4mmw |
Advisories 14
- RHSA-2016:2599 Red Hat Security Advisory: tomcat security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2016:0598 Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0597 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.7 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0595 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.7 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2016:0596 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.7 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2660 Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.2 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:2659 Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.2 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2015:1622 Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 tomcat security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHEA-2015:1771 Red Hat Enhancement Advisory: Red Hat JBoss Web Server 3.0.1 enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHEA-2015:1770 Red Hat Enhancement Advisory: Red Hat JBoss Web Server 3.0.1 enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-3530-1 tomcat6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-232-1 tomcat6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2654-1 tomcat7 vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2015:1565-1 Security update for tomcat6 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05054964
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- USN-2654-1 vendor-advisory
- RHSA-2015:1622 vendor-advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- https://issues.jboss.org/browse/JWS-220
- DSA-3530 vendor-advisory
- RHSA-2016:0599 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1603779
- http://tomcat.apache.org/security-7.html
- HPSBUX03561 vendor-advisory
- [oss-security] 20150409 Apache Tomcat partial file upload DoS CVE-2014-0230 mailing-list
- http://tomcat.apache.org/security-8.html
- RHSA-2015:2661 vendor-advisory
- RHSA-2016:0596 vendor-advisory
- http://tomcat.apache.org/security-6.html
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
- RHSA-2016:0595 vendor-advisory
- RHSA-2015:2659 vendor-advisory
- [tomcat-announce] 20150505 [SECURITY] CVE-2014-0230: Apache Tomcat DoS mailing-list
- HPSBOV03503 vendor-advisory
- RHSA-2016:0598 vendor-advisory
- RHSA-2015:2660 vendor-advisory
- USN-2655-1 vendor-advisory
- RHSA-2015:1621 vendor-advisory
- 74475 vdb-entry
- https://issues.jboss.org/browse/JWS-219
- DSA-3447 vendor-advisory
- http://svn.apache.org/viewvc?view=revision&revision=1603775
- http://svn.apache.org/viewvc?view=revision&revision=1603770
- RHSA-2016:0597 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- [tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ mailing-list
- [tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ mailing-list
- [tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ mailing-list
- [tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/ mailing-list