Every CVE Search/ Get API key

CVE-2005-3164

Apache Tomcat AJP Connector Information Leak

2.6 Low

The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.

Exploit likelihood

6.52%Up 1.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 2.6

The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.

Record
CVE-2005-3164
CVSS 2.0
2.6 LowAV:N/AC:H/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.

Record
CVE-2005-3164
Updated
2026-11-02
EUVDEUVD-2022-4979 No score

The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.

Record
EUVD-2022-4979
Updated
2026-11-03
GitHub AdvisoriesGHSA-qhqv-q4xg-f6g7 No score

Apache Tomcat AJP Connector Information Leak

The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.

Record
GHSA-qhqv-q4xg-f6g7
Weakness
CWE-200
Updated
2026-11-02
OSVGHSA-qhqv-q4xg-f6g7 No score

Apache Tomcat AJP Connector Information Leak

The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.

Record
GHSA-qhqv-q4xg-f6g7
Weakness
CWE-200
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat
Maven
 4.0.1 to 4.0.6 None known
org.apache.tomcat:tomcat
Maven
 4.1.0 to 4.1.36 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-3164 is a low vulnerability (CVSS 2.6) in Apache Tomcat, published October 6, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.52%, the 93rd percentile. No source names a fixed version.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open