CVE-2002-0935
Apache Tomcat DoS Via Requests Including Null Characters
Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
Exploit likelihood
What each source reports
NVD Score used
Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
- Record
CVE-2002-0935- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
- Record
CVE-2002-0935- Updated
- 2026-11-02
EUVDEUVD-2022-1871 No score
Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
- Record
EUVD-2022-1871- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xmf4-j3j7-xj7q No score
Apache Tomcat DoS Via Requests Including Null Characters
Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
- Record
GHSA-xmf4-j3j7-xj7q- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-xmf4-j3j7-xj7q No score
Apache Tomcat DoS Via Requests Including Null Characters
Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
- Record
GHSA-xmf4-j3j7-xj7q- Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
before 4.1.3-beta | 4.1.3-beta |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2002-0935 is a medium vulnerability (CVSS 5.0) in Apache Tomcat, published October 4, 2002. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.85%, the 94th percentile. Fixed in org.apache.tomcat:tomcat 4.1.3-beta.
References
online.securityfocus.com/archive/1/277940
archives.neohapsis.com/archives/vulnwatch/2002-q2/0120.html
osvdb.org/5051
securityfocus.com/bid/5067
iss.net/security_center/static/9396.php
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2002-0935
web.archive.org/web/20020822030311/http://www.iss.net/security_center/static/9396.php
github.com/advisories/GHSA-xmf4-j3j7-xj7q