CVE-2023-41081
Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request
Important: Authentication Bypass CVE-2023-41081
The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.
This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.
Users are recommended to upgrade to version 1.2.49, which fixes the issue.
History 2023-09-13 Original advisory
2023-09-28 Updated summary
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Important: Authentication Bypass CVE-2023-41081
The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.
This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.
Users are recommended to upgrade to version 1.2.49, which fixes the issue.
History 2023-09-13 Original advisory
2023-09-28 Updated summary
- Record
CVE-2023-41081- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
CVE List
Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request
Important: Authentication Bypass CVE-2023-41081
The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.
This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.
Users are recommended to upgrade to version 1.2.49, which fixes the issue.
History 2023-09-13 Original advisory
2023-09-28 Updated summary
- Record
CVE-2023-41081- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
EUVDEUVD-2023-45601
Important: Authentication Bypass CVE-2023-41081
The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.
This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.
Users are recommended to upgrade to version 1.2.49, which fixes the issue.
History 2023-09-13 Original advisory
2023-09-28 Updated summary
- Record
EUVD-2023-45601- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4wvr-fq5p-2362
The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a...
The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.
This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.
Users are recommended to upgrade to version 1.2.49, which fixes the issue.
- Record
GHSA-4wvr-fq5p-2362- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSV
Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped request
Important: Authentication Bypass CVE-2023-41081
The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected.
This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48.
Users are recommended to upgrade to version 1.2.49, which fixes the issue.
History 2023-09-13 Original advisory
2023-09-28 Updated summary
- Record
CVE-2023-41081- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-41081
Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary
- Record
DEBIAN-CVE-2023-41081- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSVRHSA-2023:7625
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update
- Record
RHSA-2023:7625- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:2387
Red Hat Security Advisory: mod_jk and mod_proxy_cluster security update
- Record
RHSA-2024:2387- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-41081
Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. Only mod_jk is affected by this issue. The ISAPI redirector is not affected. This issue affects Apache Tomcat Connectors (mod_jk only): from 1.2.0 through 1.2.48. Users are recommended to upgrade to version 1.2.49, which fixes the issue. History 2023-09-13 Original advisory 2023-09-28 Updated summary
- Record
UBUNTU-CVE-2023-41081- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVALSA-2024:2387 No score
Moderate: mod_jk and mod_proxy_cluster security update
The mod_jk module is a plugin for the Apache HTTP Server to connect it with the Apache Tomcat servlet engine.
The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.
Security Fix(es):
- httpd: Apache Tomcat Connectors (mod_jk) Information Disclosure (CVE-2023-41081)
- mod_cluster/mod_proxy_cluster: Stored Cross site Scripting (CVE-2023-6710)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2024:2387- Updated
- 2026-11-02
OSVCLSA-2025-1763032400 No score
mod_jk: Fix of CVE-2023-41081
- CVE-2023-41081: fix authentication bypass by removing implicit mapping functionality in mod_jk
- Record
CLSA-2025-1763032400- Updated
- 2026-11-02
OSVMGASA-2024-0130 No score
Updated apache-mod_jk packages fix security vulnerability
The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included "JkOptions +ForwardDirectories" but the configuration did not provide explicit mounts for all possible proxied requests, mod_jk would use an implicit mapping and map the request to the first defined worker. Such an implicit mapping could result in the unintended exposure of the status worker and/or bypass security constraints configured in httpd. As of JK 1.2.49, the implicit mapping functionality has been removed and all mappings must now be via explicit configuration. (CVE-2023-41081)
- Record
MGASA-2024-0130- Updated
- 2026-11-02
OSVSUSE-SU-2024:1198-1 No score
Security update for apache2-mod_jk
This update for apache2-mod_jk fixes the following issues:
- Upgrade from version 1.2.40 to 1.2.49
- CVE-2023-41081: Fix an information disclosure issue in mod_jk. (bsc#1215301)
- Record
SUSE-SU-2024:1198-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:0102-1 No score
Security update for apache2-mod_jk
This update for apache2-mod_jk fixes the following issues:
- Update to version 1.2.50:
- CVE-2024-46544: Fixed incorrect default permissions vulnerabilitymay that could lead to information disclosure and/or denial of service. (bsc#1230916)
- CVE-2023-41081: Fixed information disclosure in mod_jk. (bsc#1215301)
- Record
SUSE-SU-2025:0102-1- Updated
- 2026-11-02
OSVUSN-6826-1 No score
libapache-mod-jk vulnerability
Karl von Randow discovered that mod_jk was vulnerable to an authentication bypass. If the configuration did not provide explicit mounts for all possible proxied requests, an attacker could possibly use this vulnerability to bypass security constraints configured in httpd.
- Record
USN-6826-1- Updated
- 2026-11-02
OSVUSN-8369-2 No score
libapache-mod-jk regression
USN-8369-1 fixed a vulnerability in mod_jk. It was discovered that for Ubuntu 18.04 LTS, during the update preparation phase, a previous fix for CVE-2023-41081 was incorrectly dropped. This update reintroduces the fix for CVE-2023-41081.
We apologize for the inconvenience.
Original advisory details:
It was discovered that Apache Tomcat Connectors used incorrect default permissions for shared memory on Unix-like systems. A local attacker could possibly use this issue to view or modify mod_jk configuration data in shared memory, resulting in sensitive information exposure or a denial of service.
- Record
USN-8369-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mod_jkAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.2.49-1.el9_4 | 1.2.49-1.el9_4 |
mod_proxy_clusterAlmaLinux:9 From an advisory covering 2 CVEs |
before 1.3.20-1.el9_4 | 1.3.20-1.el9_4 |
mod_jkTuxCare:AlmaLinux:9.2 |
before 1.2.48-23.el9.tuxcare.els1 | 1.2.48-23.el9.tuxcare.els1 |
libapache-mod-jkDebian:12 |
before 1:1.2.48-2+deb12u1, plus listed versions 1:1.2.48-2 |
1:1.2.48-2+deb12u1 |
libapache-mod-jkDebian:13 |
before 1:1.2.49-1 | 1:1.2.49-1 |
libapache-mod-jkDebian:14 |
before 1:1.2.49-1 | 1:1.2.49-1 |
libapache-mod-jkDebian:10 |
before 1:1.2.46-1+deb10u2, plus listed versions 1:1.2.46-11:1.2.46-1+deb10u1 |
1:1.2.46-1+deb10u2 |
apache-mod_jkMageia:9 |
before 1.2.49-1.mga9 | 1.2.49-1.mga9 |
jbcs-httpd24-opensslRed Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 1:1.1.1k-16.el7jbcs | 1:1.1.1k-16.el7jbcs |
jbcs-httpd24-openssl-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 1:1.1.1k-16.el7jbcs | 1:1.1.1k-16.el7jbcs |
Show 45 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jbcs-httpd24-openssl-develRed Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 1:1.1.1k-16.el7jbcs | 1:1.1.1k-16.el7jbcs |
jbcs-httpd24-openssl-libsRed Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 1:1.1.1k-16.el7jbcs | 1:1.1.1k-16.el7jbcs |
jbcs-httpd24-openssl-perlRed Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 1:1.1.1k-16.el7jbcs | 1:1.1.1k-16.el7jbcs |
jbcs-httpd24-openssl-staticRed Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 1:1.1.1k-16.el7jbcs | 1:1.1.1k-16.el7jbcs |
jbcs-httpd24-opensslRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 1:1.1.1k-16.el8jbcs | 1:1.1.1k-16.el8jbcs |
jbcs-httpd24-openssl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 1:1.1.1k-16.el8jbcs | 1:1.1.1k-16.el8jbcs |
jbcs-httpd24-openssl-develRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 1:1.1.1k-16.el8jbcs | 1:1.1.1k-16.el8jbcs |
jbcs-httpd24-openssl-libsRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 1:1.1.1k-16.el8jbcs | 1:1.1.1k-16.el8jbcs |
jbcs-httpd24-openssl-libs-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 1:1.1.1k-16.el8jbcs | 1:1.1.1k-16.el8jbcs |
jbcs-httpd24-openssl-perlRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 1:1.1.1k-16.el8jbcs | 1:1.1.1k-16.el8jbcs |
jbcs-httpd24-openssl-staticRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 1:1.1.1k-16.el8jbcs | 1:1.1.1k-16.el8jbcs |
jbcs-httpd24-curlRed Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 0:8.4.0-2.el7jbcs | 0:8.4.0-2.el7jbcs |
jbcs-httpd24-curl-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 0:8.4.0-2.el7jbcs | 0:8.4.0-2.el7jbcs |
jbcs-httpd24-libcurlRed Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 0:8.4.0-2.el7jbcs | 0:8.4.0-2.el7jbcs |
jbcs-httpd24-libcurl-develRed Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 0:8.4.0-2.el7jbcs | 0:8.4.0-2.el7jbcs |
jbcs-httpd24-curlRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 0:8.4.0-2.el8jbcs | 0:8.4.0-2.el8jbcs |
jbcs-httpd24-curl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 0:8.4.0-2.el8jbcs | 0:8.4.0-2.el8jbcs |
jbcs-httpd24-libcurlRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 0:8.4.0-2.el8jbcs | 0:8.4.0-2.el8jbcs |
jbcs-httpd24-libcurl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 0:8.4.0-2.el8jbcs | 0:8.4.0-2.el8jbcs |
jbcs-httpd24-libcurl-develRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 0:8.4.0-2.el8jbcs | 0:8.4.0-2.el8jbcs |
jbcs-httpd24-mod_jkRed Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 0:1.2.49-1.redhat_1.el7jbcs | 0:1.2.49-1.redhat_1.el7jbcs |
jbcs-httpd24-mod_jk-ap24Red Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 0:1.2.49-1.redhat_1.el7jbcs | 0:1.2.49-1.redhat_1.el7jbcs |
jbcs-httpd24-mod_jk-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 0:1.2.49-1.redhat_1.el7jbcs | 0:1.2.49-1.redhat_1.el7jbcs |
jbcs-httpd24-mod_jkRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 0:1.2.49-1.redhat_1.el8jbcs | 0:1.2.49-1.redhat_1.el8jbcs |
jbcs-httpd24-mod_jk-ap24Red Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 0:1.2.49-1.redhat_1.el8jbcs | 0:1.2.49-1.redhat_1.el8jbcs |
jbcs-httpd24-mod_jk-ap24-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 0:1.2.49-1.redhat_1.el8jbcs | 0:1.2.49-1.redhat_1.el8jbcs |
jbcs-httpd24-mod_http2Red Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 0:1.15.19-32.el7jbcs | 0:1.15.19-32.el7jbcs |
jbcs-httpd24-mod_http2-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 11 CVEs |
before 0:1.15.19-32.el7jbcs | 0:1.15.19-32.el7jbcs |
jbcs-httpd24-mod_http2Red Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 0:1.15.19-32.el8jbcs | 0:1.15.19-32.el8jbcs |
jbcs-httpd24-mod_http2-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 11 CVEs |
before 0:1.15.19-32.el8jbcs | 0:1.15.19-32.el8jbcs |
mod_proxy_clusterRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.3.20-1.el9_4 | 0:1.3.20-1.el9_4 |
mod_proxy_cluster-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.3.20-1.el9_4 | 0:1.3.20-1.el9_4 |
mod_proxy_cluster-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.3.20-1.el9_4 | 0:1.3.20-1.el9_4 |
mod_jkRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.2.49-1.el9_4 | 0:1.2.49-1.el9_4 |
mod_jk-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.2.49-1.el9_4 | 0:1.2.49-1.el9_4 |
mod_jk-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 2 CVEs |
before 0:1.2.49-1.el9_4 | 0:1.2.49-1.el9_4 |
apache2-mod_jkSUSE:Linux Enterprise Server 12 SP5 |
before 1.2.49-7.9.1 | 1.2.49-7.9.1 |
apache2-mod_jkSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.2.49-7.9.1 | 1.2.49-7.9.1 |
apache2-mod_jkSUSE:Linux Enterprise Module for Server Applications 15 SP6 From an advisory covering 2 CVEs |
before 1.2.50-150100.6.12.1 | 1.2.50-150100.6.12.1 |
apache2-mod_jkopenSUSE:Leap 15.6 From an advisory covering 2 CVEs |
before 1.2.50-150100.6.12.1 | 1.2.50-150100.6.12.1 |
libapache-mod-jkUbuntu:Pro:16.04:LTS |
before 1:1.2.41-1ubuntu0.1~esm1, plus listed versions 1:1.2.40+svn150520-11:1.2.41-1 |
1:1.2.41-1ubuntu0.1~esm1 |
libapache-mod-jkUbuntu:Pro:18.04:LTS |
before 1:1.2.43-1ubuntu0.1~esm1, plus listed versions 1:1.2.42-11:1.2.43-1 |
1:1.2.43-1ubuntu0.1~esm1 |
libapache-mod-jkUbuntu:20.04:LTS |
before 1:1.2.46-1ubuntu0.1, plus listed versions 1:1.2.46-1 |
1:1.2.46-1ubuntu0.1 |
libapache-mod-jkUbuntu:22.04:LTS |
before 1:1.2.48-1ubuntu0.1, plus listed versions 1:1.2.48-1 |
1:1.2.48-1ubuntu0.1 |
libapache-mod-jkUbuntu:Pro:16.04:LTS |
before 1:1.2.41-1ubuntu0.1~esm2, plus listed versions 1:1.2.40+svn150520-11:1.2.41-11:1.2.41-1ubuntu0.1~esm1 |
1:1.2.41-1ubuntu0.1~esm2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-41081 is a high vulnerability (CVSS 7.5) in Apache Tomcat Connectors, published September 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.59%, the 75th percentile. Fixed in mod_jk 1.2.48-23.el9.tuxcare.els1.
References
lists.apache.org/thread/rd1r26w7271jyqgzr4492tooyt583d8b
openwall.com/lists/oss-security/2023/09/13/2
lists.debian.org/debian-lts-announce/2023/09/msg00027.html
nvd.nist.gov/vuln/detail/CVE-2023-41081
github.com/advisories/GHSA-4wvr-fq5p-2362
Show 87 moreShow less
access.redhat.com/errata/RHSA-2024:2387
bugzilla.redhat.com/2238847
errata.almalinux.org/9/ALSA-2024-2387.html
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1763032400.html
security-tracker.debian.org/tracker/CVE-2023-41081
advisories.mageia.org/MGASA-2024-0130.html
bugs.mageia.org/show_bug.cgi?id=33083
lwn.net/Articles/969302
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7625.json
cve.org/CVERecord?id=CVE-2023-0464
openssl.org/news/secadv/20230322.txt
curl.se/docs/CVE-2023-38039.html
httpd.apache.org/security/vulnerabilities_24.html
issues.redhat.com/browse/RHEL-27497
suse.com/support/update/announcement/2024/suse-su-20241198-1
bugzilla.suse.com/1167896
ubuntu.com/security/CVE-2023-41081
tomcat.apache.org/security-jk.html
launchpad.net/bugs/2161580