GHSA-5cw4-ggx9-36vg

Source

https://github.com/advisories/GHSA-5cw4-ggx9-36vg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-5cw4-ggx9-36vg/GHSA-5cw4-ggx9-36vg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5cw4-ggx9-36vg

Aliases

CVE-2009-0033

Published

2022-05-02T03:12:29Z

Modified

2024-01-23T18:11:45.013010Z

Summary

Apache Tomcat Denial of Service via Malformed Request Headers

Details

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.

Database specific

{
    "nvd_published_at": "2009-06-05T16:00:00Z",
    "cwe_ids": [
        "CWE-20",
        "CWE-400"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-23T17:52:36Z"
}

References

Affected packages

Maven / org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.1.0

Last affected

4.1.39

Maven / org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.5.0

Last affected

5.5.27

Maven / org.apache.tomcat:tomcat

Package

Name: org.apache.tomcat:tomcat; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.0.0

Last affected

6.0.18