Apache Tomcat any version

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.

Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.

Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

Apache Tomcat: Fix for CVE-2023-24998 is incomplete

Apache Tomcat: FileUpload large number of parts with headers DoS

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.

Apache Tomcat: Request header mix-up between HTTP/2 streams

Apache Tomcat: HTTP/2 header handling DoS

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

Apache Tomcat h2c request mix-up

DoS via memory leak with WebSocket connections

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet.

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue

Apache Tomcat DoS with unexpected TLS packet

An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a different request.

Apache Tomcat: HTTP/2 excess header handling DoS

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

Apache Tomcat: h2 DoS - Made You Reset

Apache Tomcat: Security constraint bypass for pre/post-resources

Apache Tomcat: HTTP request smuggling via malformed trailer headers

Apache Tomcat: JsonErrorReportValve escaping

Apache Tomcat: DoS via integer overflow in multipart file upload

Apache Tomcat: DoS via excessive h2 streams at connection start

Apache Tomcat: APR/Native Connector crash leading to DoS

Apache Tomcat request smuggling via malformed content-length

Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset

Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control

Apache Tomcat: DoS via WebSocket chat example

Apache Tomcat: Request smuggling via invalid chunk extension

Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

Apache Tomcat: LockOutRealm treats user names as case-sensitive

Apache Tomcat: Incomplete escaping of JSON access logs

Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

Apache Tomcat: TLS cipher order is not preserved