Vulnerability Database

289,598

Total vulnerabilities in the database

CVE-2023-46589

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWEs:

Software From Fixed in
org.apache.tomcat / tomcat-catalina 11.0.0-M1 11.0.0-M11
org.apache.tomcat / tomcat-catalina 10.1.0-M1 10.1.16
org.apache.tomcat / tomcat-catalina 9.0.0-M1 9.0.83
org.apache.tomcat / tomcat-catalina 8.5.0 8.5.96
apache / tomcat 11.0.0-milestone1 11.0.0-milestone1.x
apache / tomcat 11.0.0-milestone2 11.0.0-milestone2.x
apache / tomcat 11.0.0-milestone4 11.0.0-milestone4.x
apache / tomcat 11.0.0-milestone3 11.0.0-milestone3.x
apache / tomcat 11.0.0-milestone5 11.0.0-milestone5.x
apache / tomcat 11.0.0-milestone7 11.0.0-milestone7.x
apache / tomcat 11.0.0-milestone8 11.0.0-milestone8.x
apache / tomcat 11.0.0-milestone9 11.0.0-milestone9.x
apache / tomcat 11.0.0-milestone10 11.0.0-milestone10.x
apache / tomcat 11.0.0-milestone6 11.0.0-milestone6.x
apache / tomcat 10.1.0 10.1.16
apache / tomcat 9.0.0 9.0.83
apache / tomcat 8.5.0 8.5.96
org.apache.tomcat.embed / tomcat-embed-core 11.0.0-M1 11.0.0-M11
org.apache.tomcat.embed / tomcat-embed-core 10.1.0-M1 10.1.16
org.apache.tomcat.embed / tomcat-embed-core 9.0.0-M1 9.0.83
org.apache.tomcat.embed / tomcat-embed-core 8.5.0 8.5.96