CVE-2013-4322
Apache Tomcat Denial of Service vulnerability
4.3 MediumPublic exploitFix available
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
Exploit likelihood
9.10%Up 1.8 points since Feb 4, 2022
What each source reports
NVD Score used
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
- Record
CVE-2013-4322- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
- Record
CVE-2013-4322- Updated
- 2026-11-02
EUVDEUVD-2022-5618 No score
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
- Record
EUVD-2022-5618- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wq2p-q66w-q8gp No score
Apache Tomcat Denial of Service vulnerability
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
- Record
GHSA-wq2p-q66w-q8gp- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-wq2p-q66w-q8gp No score
Apache Tomcat Denial of Service vulnerability
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
- Record
GHSA-wq2p-q66w-q8gp- Weakness
- CWE-400
- Updated
- 2026-11-02
OSVMGASA-2014-0148 No score
Updated tomcat package fixes security vulnerabilities
Apache Tomcat 7.x before 7.0.47, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header (CVE-2013-4286).
Apache Tomcat 7.x before 7.0.50 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data (CVE-2013-4322).
Apache Tomcat 7.x before 7.0.50 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2013-4590).
- Record
MGASA-2014-0148- Updated
- 2026-11-02
OSVMGASA-2014-0149 No score
Updated tomcat package fixes security vulnerabilities
Apache Tomcat 7.x before 7.0.50 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data (CVE-2013-4322).
Apache Tomcat 7.x before 7.0.50 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue (CVE-2013-4590).
- Record
MGASA-2014-0149- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4322 No score
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
- Record
UBUNTU-CVE-2013-4322- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
before 6.0.39 | 6.0.39 |
org.apache.tomcat:tomcatMaven |
8.0.0-RC1 up to 8.0.0-RC10 | 8.0.0-RC10 |
org.apache.tomcat:tomcatMaven |
7.0.0 up to 7.0.50 | 7.0.50 |
tomcat6Debian:6.0 From an advisory covering 4 CVEs |
before 6.0.41-2+squeeze5, plus listed versions 6.0.28-106.0.28-96.0.28-9+squeeze16.0.32-16.0.32-2 Show 21 moreShow less6.0.32-36.0.32-46.0.32-56.0.32-66.0.32-76.0.33-16.0.35-16.0.35-1+squeeze26.0.35-1+squeeze36.0.35-1+squeeze46.0.35-26.0.35-36.0.35-46.0.35-56.0.35-5+nmu16.0.35-66.0.35-76.0.37-16.0.39-16.0.41-16.0.41-2 |
6.0.41-2+squeeze5 |
tomcat7Debian:7 From an advisory covering 6 CVEs |
before 7.0.28-4+deb7u1, plus listed versions 7.0.28-4 |
7.0.28-4+deb7u1 |
tomcat6Debian:7 From an advisory covering 18 CVEs |
before 6.0.45+dfsg-1~deb7u1, plus listed versions 6.0.35-66.0.35-6+deb7u16.0.35-76.0.37-16.0.39-1 Show 8 moreShow less6.0.41-16.0.41-26.0.41-2+squeeze56.0.41-2+squeeze66.0.41-2+squeeze76.0.41-36.0.41-46.0.45-1~deb6u1 |
6.0.45+dfsg-1~deb7u1 |
org.apache.tomcat:tomcatMaven |
7.0.0 up to 7.0.50, plus listed versions 7.0.357.0.377.0.397.0.407.0.417.0.427.0.47 |
7.0.50 |
org.apache.tomcat:tomcatMaven |
8.0.0-RC1 up to 8.0.0-RC10, plus listed versions 8.0.0-RC38.0.0-RC5 |
8.0.0-RC10 |
tomcatMageia:3 From an advisory covering 3 CVEs |
before 7.0.52-1.mga3 | 7.0.52-1.mga3 |
tomcatMageia:4 From an advisory covering 3 CVEs |
before 7.0.52-1.mga4 | 7.0.52-1.mga4 |
Show 116 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat6Red Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6Red Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6Red Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6Red Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-el-2.1-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-jsp-2.1-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-libRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-servlet-2.5-apiRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-admin-webappsRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-docs-webappRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-javadocRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6-webappsRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:6.0.24-64.el6_5 | 0:6.0.24-64.el6_5 |
tomcat6Red Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs |
before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs |
before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs |
before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-el-2.1-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs |
before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs |
before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs |
before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-libRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs |
before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs |
before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs |
before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 4 CVEs |
before 0:6.0.37-19_patch_04.ep6.el5 | 0:6.0.37-19_patch_04.ep6.el5 |
tomcat6Red Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs |
before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-admin-webappsRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs |
before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-docs-webappRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs |
before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-el-2.1-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs |
before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-javadocRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs |
before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-jsp-2.1-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs |
before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-libRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs |
before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-log4jRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs |
before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-servlet-2.5-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs |
before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat6-webappsRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 4 CVEs |
before 0:6.0.37-27_patch_04.ep6.el6 | 0:6.0.37-27_patch_04.ep6.el6 |
tomcat7Red Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-admin-webappsRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-docs-webappRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-el-2.2-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-javadocRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-jsp-2.2-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-libRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-log4jRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-servlet-3.0-apiRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7-webappsRed Hat:jboss_enterprise_web_server:2::el5 From an advisory covering 3 CVEs |
before 0:7.0.40-13_patch_02.ep6.el5 | 0:7.0.40-13_patch_02.ep6.el5 |
tomcat7Red Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-admin-webappsRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-docs-webappRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-el-2.2-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-javadocRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-jsp-2.2-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-libRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-log4jRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-servlet-3.0-apiRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcat7-webappsRed Hat:jboss_enterprise_web_server:2::el6 From an advisory covering 3 CVEs |
before 0:7.0.40-9_patch_02.ep6.el6 | 0:7.0.40-9_patch_02.ep6.el6 |
tomcatRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-servlet-3.0-apiRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-admin-webappsRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-docs-webappRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-el-2.2-apiRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-javadocRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-jsp-2.2-apiRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-jsvcRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-libRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-webappsRed Hat:enterprise_linux:7::client From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcatRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-servlet-3.0-apiRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-admin-webappsRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-docs-webappRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-el-2.2-apiRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-javadocRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-jsp-2.2-apiRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-jsvcRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-libRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-webappsRed Hat:enterprise_linux:7::computenode From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcatRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-admin-webappsRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-el-2.2-apiRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-jsp-2.2-apiRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-libRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-servlet-3.0-apiRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-webappsRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-docs-webappRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-javadocRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-jsvcRed Hat:enterprise_linux:7::server From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcatRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-admin-webappsRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-el-2.2-apiRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-jsp-2.2-apiRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-libRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-servlet-3.0-apiRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-webappsRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-docs-webappRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-javadocRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
tomcat-jsvcRed Hat:enterprise_linux:7::workstation From an advisory covering 3 CVEs |
before 0:7.0.42-5.el7_0 | 0:7.0.42-5.el7_0 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | LiviuPtr/CVE-2013-4322_PoC | 2026-01-18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4322 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published February 26, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.10%, the 95th percentile. Fixed in org.apache.tomcat:tomcat 6.0.39.
References
vmware.com/security/advisories/VMSA-2014-0008.html
svn.apache.org/viewvc?view=revision&revision=1549522
rhn.redhat.com/errata/RHSA-2014-0686.html
mandriva.com/security/advisories?name=MDVSA-2015:052
Show 89 moreShow less
secunia.com/advisories/59724
bugzilla.redhat.com/show_bug.cgi?id=1069905
debian.org/security/2016/dsa-3530
tomcat.apache.org/security-7.html
securityfocus.com/archive/1/534161/100/0/threaded
oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
www-01.ibm.com/support/docview.wss?uid=swg21678113
advisories.mageia.org/MGASA-2014-0148.html
h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013
ubuntu.com/usn/USN-2130-1
seclists.org/fulldisclosure/2014/Dec/23
marc.info?l=bugtraq&m=144498216801440&w=2
lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2013-4322
github.com/apache/tomcat/commit/70dc3b279f7c99136c2c51bce8812508b4893c8b
web.archive.org/web/20140315211337/http://www.securityfocus.com/bid/65767
bugs.mageia.org/show_bug.cgi?id=12955
access.redhat.com/errata/RHSA-2014:0429
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0429.json
cve.org/CVERecord?id=CVE-2013-4286
ubuntu.com/security/CVE-2013-4322