CVE-2011-1475
Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users
The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."
Exploit likelihood
What each source reports
NVD Score used
The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."
- Record
CVE-2011-1475- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."
- Record
CVE-2011-1475- Updated
- 2026-11-02
EUVDEUVD-2022-4083 No score
The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."
- Record
EUVD-2022-4083- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h6c8-rg87-f3pc No score
Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users
The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."
- Record
GHSA-h6c8-rg87-f3pc- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-h6c8-rg87-f3pc No score
Apache Tomcat HTTP BIO Connector Error Discloses Information From Different Requests to Remote Users
The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users."
- Record
GHSA-h6c8-rg87-f3pc- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
7.0.0 up to 7.0.12 | 7.0.12 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | samaujs/CVE-2011-1475 | 2018-11-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-1475 is a medium vulnerability (CVSS 5.0) in Apache Tomcat, published April 8, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.69%, the 95th percentile. Fixed in org.apache.tomcat:tomcat 7.0.12.
References
vupen.com/english/advisories/2011/0894
securityfocus.com/bid/47199
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12374
securityreason.com/securityalert/8188
tomcat.apache.org/security-7.html
securitytracker.com/id?1025303
Show 14 moreShow less
issues.apache.org/bugzilla/show_bug.cgi?id=50957
svn.apache.org/viewvc?view=revision&revision=1086349
seclists.org/fulldisclosure/2011/Apr/97
exchange.xforce.ibmcloud.com/vulnerabilities/66676
nvd.nist.gov/vuln/detail/CVE-2011-1475
github.com/apache/tomcat/commit/d2e8f2ede7dea39f75f68384f331f38f094e4ed3
web.archive.org/web/20120605200856/http://www.securityfocus.com/bid/47199