CVE-2011-0534
Apache Tomcat does not enforce the maxHttpHeaderSize limit
5.0 MediumFix available
Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
Exploit likelihood
7.89%Up 1.5 points since Feb 4, 2022
What each source reports
NVD Score used
Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
- Record
CVE-2011-0534- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
- Record
CVE-2011-0534- Updated
- 2026-11-02
EUVDEUVD-2022-2286 No score
Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
- Record
EUVD-2022-2286- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-43v2-6grp-9pp9
Apache Tomcat does not enforce the maxHttpHeaderSize limit
Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
- Record
GHSA-43v2-6grp-9pp9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-43v2-6grp-9pp9
Apache Tomcat does not enforce the maxHttpHeaderSize limit
Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
- Record
GHSA-43v2-6grp-9pp9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
6.0.0 to 6.0.30 | 6.0.32 |
org.apache.tomcat:tomcatMaven |
7.0.0 to 7.0.6 | 7.0.8 |
tomcat6Debian:6.0 From an advisory covering 3 CVEs |
before 6.0.28-9+squeeze1, plus listed versions 6.0.28-9 |
6.0.28-9+squeeze1 |
org.apache.tomcat:tomcatMaven |
6.0.0 up to 6.0.32 | 6.0.32 |
org.apache.tomcat:tomcatMaven |
7.0.0 up to 7.0.8 | 7.0.8 |
tomcat6Red Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-javadocRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
Show 55 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-libRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-log4jRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-webappsRed Hat:enterprise_linux:6::client From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6Red Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-javadocRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-libRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-log4jRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-webappsRed Hat:enterprise_linux:6::computenode From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-javadocRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-log4jRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-webappsRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-libRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::server From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6Red Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-javadocRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-log4jRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-webappsRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-libRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 2 CVEs |
before 0:6.0.24-24.el6_0 | 0:6.0.24-24.el6_0 |
tomcat6Red Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el4 | 0:6.0.24-11.patch_03.ep5.el4 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el4 | 0:6.0.24-11.patch_03.ep5.el4 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el4 | 0:6.0.24-11.patch_03.ep5.el4 |
tomcat6-el-1.0-apiRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el4 | 0:6.0.24-11.patch_03.ep5.el4 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el4 | 0:6.0.24-11.patch_03.ep5.el4 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el4 | 0:6.0.24-11.patch_03.ep5.el4 |
tomcat6-libRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el4 | 0:6.0.24-11.patch_03.ep5.el4 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el4 | 0:6.0.24-11.patch_03.ep5.el4 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el4 | 0:6.0.24-11.patch_03.ep5.el4 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:1::el4 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el4 | 0:6.0.24-11.patch_03.ep5.el4 |
tomcat6Red Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el5 | 0:6.0.24-11.patch_03.ep5.el5 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el5 | 0:6.0.24-11.patch_03.ep5.el5 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el5 | 0:6.0.24-11.patch_03.ep5.el5 |
tomcat6-el-1.0-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el5 | 0:6.0.24-11.patch_03.ep5.el5 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el5 | 0:6.0.24-11.patch_03.ep5.el5 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el5 | 0:6.0.24-11.patch_03.ep5.el5 |
tomcat6-libRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el5 | 0:6.0.24-11.patch_03.ep5.el5 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el5 | 0:6.0.24-11.patch_03.ep5.el5 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el5 | 0:6.0.24-11.patch_03.ep5.el5 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:1::el5 From an advisory covering 2 CVEs |
before 0:6.0.24-11.patch_03.ep5.el5 | 0:6.0.24-11.patch_03.ep5.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-0534 is a medium vulnerability (CVSS 5.0) in Apache Tomcat, published February 10, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.89%, the 94th percentile. Fixed in org.apache.tomcat:tomcat 6.0.32.
References
securityreason.com/securityalert/8074
securitytracker.com/id?1025027
secunia.com/advisories/45022
lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html
osvdb.org/70809
securityfocus.com/archive/1/516214/100/0/threaded
Show 36 moreShow less
lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
vupen.com/english/advisories/2011/0293
exchange.xforce.ibmcloud.com/vulnerabilities/65162
debian.org/security/2011/dsa-2160
support.apple.com/kb/HT5002
tomcat.apache.org/security-7.html
marc.info?l=bugtraq&m=139344343412337&w=2
support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html
nvd.nist.gov/vuln/detail/CVE-2011-0534
github.com/apache/tomcat/commit/008447095ce8c3a8f713093d5e618f3f06f94ea8
web.archive.org/web/20110801035315/http://secunia.com/advisories/45022
access.redhat.com/errata/RHSA-2011:0335
bugzilla.redhat.com/show_bug.cgi?id=674336
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0335.json
cve.org/CVERecord?id=CVE-2010-4476