CVE-2003-0866
Apache Tomcat Denial of Service vulnerability in the Catalina package
The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
Exploit likelihood
What each source reports
NVD Score used
The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
- Record
CVE-2003-0866- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
- Record
CVE-2003-0866- Updated
- 2026-11-02
EUVDEUVD-2022-1670 No score
The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
- Record
EUVD-2022-1670- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7wj2-48c4-2684 No score
Apache Tomcat Denial of Service vulnerability in the Catalina package
The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.6 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
- Record
GHSA-7wj2-48c4-2684- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-7wj2-48c4-2684 No score
Apache Tomcat Denial of Service vulnerability in the Catalina package
The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.6 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
- Record
GHSA-7wj2-48c4-2684- Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
4.0 up to 4.1.0 | 4.1.0 |
tomcat4Debian:3.0 |
before 4.0.3-3woody3 | 4.0.3-3woody3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Tomcat 4.0.x - Non-HTTP Request Denial of Service | 2003-10-15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2003-0866 is a medium vulnerability (CVSS 5.0) in Apache Tomcat, published October 15, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 34.8%, the 98th percentile. Fixed in org.apache.tomcat:tomcat 4.1.0.
References
tomcat.apache.org/security-4.html
secunia.com/advisories/30908
securityfocus.com/bid/8824
sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1
vupen.com/english/advisories/2008/1979/references
Show 11 moreShow less
debian.org/security/2003/dsa-395
bugs.debian.org/cgi-bin/bugreport.cgi?bug=215506
exchange.xforce.ibmcloud.com/vulnerabilities/13429
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2003-0866
github.com/advisories/GHSA-7wj2-48c4-2684