GitHub Advisoryadvisory · Maven

GHSA-43v2-6grp-9pp9 Apache Tomcat does not enforce the maxHttpHeaderSize limit

HIGH Published 2022-05-14 Modified 2024-02-21 Official page ↗
Aliases
CVE-2011-0534
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Reviewed
2024-02-21

Affected packages

• Maven org.apache.tomcat:tomcat: >= 6.0.0, < 6.0.32 → fixed in 6.0.32 • Maven org.apache.tomcat:tomcat: >= 7.0.0, < 7.0.8 → fixed in 7.0.8

Description

Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.

Related

Alias · CVE (1)

  • CVE-2011-0534 Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP… vulnerability

References