Every CVE Search/ Get API key

CVE-2011-3190

Apache Tomcat Allows Remote Attackers to Spoof AJP Requests

7.5 HighFix available

CVE-2011-3190 is a high vulnerability (CVSS 7.5) in Apache Tomcat, published August 31, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 15.2%, the 96th percentile. Fixed in org.apache.tomcat:tomcat 7.0.21.

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.

Exploit likelihood

15.2%Up 7.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.

Record
CVE-2011-3190
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.

Record
CVE-2011-3190
Updated
2026-11-02
EUVDEUVD-2022-3486 No score

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.

Record
EUVD-2022-3486
Updated
2026-11-03
GitHub AdvisoriesGHSA-c38m-v4m2-524v No score

Apache Tomcat Allows Remote Attackers to Spoof AJP Requests

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.

Record
GHSA-c38m-v4m2-524v
Weakness
CWE-287
Updated
2026-11-02
OSVGHSA-c38m-v4m2-524v No score

Apache Tomcat Allows Remote Attackers to Spoof AJP Requests

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.

Record
GHSA-c38m-v4m2-524v
Weakness
CWE-287
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.tomcat:tomcat
Maven
 7.0.0 to 7.0.20
7.0.21
org.apache.tomcat:tomcat
Maven
 6.0.0 to 6.0.33
6.0.34
org.apache.tomcat:tomcat
Maven
 5.0.0 to 5.5.33
5.5.34
tomcat6
Debian:6.0
 before 6.0.35-1+squeeze2, plus listed versions
6.0.28-106.0.28-96.0.28-9+squeeze16.0.32-16.0.32-2
Show 7 moreShow less
6.0.32-36.0.32-46.0.32-56.0.32-66.0.32-76.0.33-16.0.35-1
6.0.35-1+squeeze2
org.apache.tomcat:tomcat
Maven
 7.0.0 up to 7.0.21
7.0.21
org.apache.tomcat:tomcat
Maven
 6.0.0 up to 6.0.34
6.0.34
org.apache.tomcat:tomcat
Maven
 5.0.0 up to 5.5.34
5.5.34
tomcat6
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-35.el6_1
0:6.0.24-35.el6_1
tomcat6-el-2.1-api
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-35.el6_1
0:6.0.24-35.el6_1
tomcat6-jsp-2.1-api
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-35.el6_1
0:6.0.24-35.el6_1
Show 52 moreShow less
Affected packages
PackageAffectedFixed
tomcat6-lib
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-35.el6_1
0:6.0.24-35.el6_1
tomcat6-servlet-2.5-api
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-35.el6_1
0:6.0.24-35.el6_1
tomcat6-admin-webapps
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-35.el6_1
0:6.0.24-35.el6_1
tomcat6-docs-webapp
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-35.el6_1
0:6.0.24-35.el6_1
tomcat6-javadoc
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-35.el6_1
0:6.0.24-35.el6_1
tomcat6-webapps
Red Hat:enterprise_linux:6::server
 before 0:6.0.24-35.el6_1
0:6.0.24-35.el6_1
tomcat5
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.33-27_patch_07.ep5.el5
0:5.5.33-27_patch_07.ep5.el5
tomcat5-admin-webapps
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.33-27_patch_07.ep5.el5
0:5.5.33-27_patch_07.ep5.el5
tomcat5-common-lib
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.33-27_patch_07.ep5.el5
0:5.5.33-27_patch_07.ep5.el5
tomcat5-jasper
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.33-27_patch_07.ep5.el5
0:5.5.33-27_patch_07.ep5.el5
tomcat5-jasper-eclipse
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.33-27_patch_07.ep5.el5
0:5.5.33-27_patch_07.ep5.el5
tomcat5-jasper-javadoc
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.33-27_patch_07.ep5.el5
0:5.5.33-27_patch_07.ep5.el5
tomcat5-jsp-2.0-api
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.33-27_patch_07.ep5.el5
0:5.5.33-27_patch_07.ep5.el5
tomcat5-jsp-2.0-api-javadoc
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.33-27_patch_07.ep5.el5
0:5.5.33-27_patch_07.ep5.el5
tomcat5-parent
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.33-27_patch_07.ep5.el5
0:5.5.33-27_patch_07.ep5.el5
tomcat5-server-lib
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.33-27_patch_07.ep5.el5
0:5.5.33-27_patch_07.ep5.el5
tomcat5-servlet-2.4-api
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.33-27_patch_07.ep5.el5
0:5.5.33-27_patch_07.ep5.el5
tomcat5-servlet-2.4-api-javadoc
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.33-27_patch_07.ep5.el5
0:5.5.33-27_patch_07.ep5.el5
tomcat5-webapps
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:5.5.33-27_patch_07.ep5.el5
0:5.5.33-27_patch_07.ep5.el5
tomcat5
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:5.5.33-28_patch_07.ep5.el6
0:5.5.33-28_patch_07.ep5.el6
tomcat5-admin-webapps
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:5.5.33-28_patch_07.ep5.el6
0:5.5.33-28_patch_07.ep5.el6
tomcat5-common-lib
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:5.5.33-28_patch_07.ep5.el6
0:5.5.33-28_patch_07.ep5.el6
tomcat5-jasper
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:5.5.33-28_patch_07.ep5.el6
0:5.5.33-28_patch_07.ep5.el6
tomcat5-jasper-eclipse
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:5.5.33-28_patch_07.ep5.el6
0:5.5.33-28_patch_07.ep5.el6
tomcat5-jasper-javadoc
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:5.5.33-28_patch_07.ep5.el6
0:5.5.33-28_patch_07.ep5.el6
tomcat5-jsp-2.0-api
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:5.5.33-28_patch_07.ep5.el6
0:5.5.33-28_patch_07.ep5.el6
tomcat5-jsp-2.0-api-javadoc
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:5.5.33-28_patch_07.ep5.el6
0:5.5.33-28_patch_07.ep5.el6
tomcat5-parent
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:5.5.33-28_patch_07.ep5.el6
0:5.5.33-28_patch_07.ep5.el6
tomcat5-server-lib
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:5.5.33-28_patch_07.ep5.el6
0:5.5.33-28_patch_07.ep5.el6
tomcat5-servlet-2.4-api
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:5.5.33-28_patch_07.ep5.el6
0:5.5.33-28_patch_07.ep5.el6
tomcat5-servlet-2.4-api-javadoc
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:5.5.33-28_patch_07.ep5.el6
0:5.5.33-28_patch_07.ep5.el6
tomcat5-webapps
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:5.5.33-28_patch_07.ep5.el6
0:5.5.33-28_patch_07.ep5.el6
tomcat6
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.32-24_patch_07.ep5.el5
0:6.0.32-24_patch_07.ep5.el5
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.32-24_patch_07.ep5.el5
0:6.0.32-24_patch_07.ep5.el5
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.32-24_patch_07.ep5.el5
0:6.0.32-24_patch_07.ep5.el5
tomcat6-el-1.0-api
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.32-24_patch_07.ep5.el5
0:6.0.32-24_patch_07.ep5.el5
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.32-24_patch_07.ep5.el5
0:6.0.32-24_patch_07.ep5.el5
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.32-24_patch_07.ep5.el5
0:6.0.32-24_patch_07.ep5.el5
tomcat6-lib
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.32-24_patch_07.ep5.el5
0:6.0.32-24_patch_07.ep5.el5
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.32-24_patch_07.ep5.el5
0:6.0.32-24_patch_07.ep5.el5
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.32-24_patch_07.ep5.el5
0:6.0.32-24_patch_07.ep5.el5
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:1::el5
 before 0:6.0.32-24_patch_07.ep5.el5
0:6.0.32-24_patch_07.ep5.el5
tomcat6
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:6.0.32-24_patch_07.ep5.el6
0:6.0.32-24_patch_07.ep5.el6
tomcat6-admin-webapps
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:6.0.32-24_patch_07.ep5.el6
0:6.0.32-24_patch_07.ep5.el6
tomcat6-docs-webapp
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:6.0.32-24_patch_07.ep5.el6
0:6.0.32-24_patch_07.ep5.el6
tomcat6-el-1.0-api
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:6.0.32-24_patch_07.ep5.el6
0:6.0.32-24_patch_07.ep5.el6
tomcat6-javadoc
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:6.0.32-24_patch_07.ep5.el6
0:6.0.32-24_patch_07.ep5.el6
tomcat6-jsp-2.1-api
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:6.0.32-24_patch_07.ep5.el6
0:6.0.32-24_patch_07.ep5.el6
tomcat6-lib
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:6.0.32-24_patch_07.ep5.el6
0:6.0.32-24_patch_07.ep5.el6
tomcat6-log4j
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:6.0.32-24_patch_07.ep5.el6
0:6.0.32-24_patch_07.ep5.el6
tomcat6-servlet-2.5-api
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:6.0.32-24_patch_07.ep5.el6
0:6.0.32-24_patch_07.ep5.el6
tomcat6-webapps
Red Hat:jboss_enterprise_web_server:1::el6
 before 0:6.0.32-24_patch_07.ep5.el6
0:6.0.32-24_patch_07.ep5.el6

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 77 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open