{"id":"CVE-2012-3544","aliases":["DSA-2725-1","DSA-2897-1","EUVD-2012-3492","GHSA-qfxv-3ppc-7qg5","MGASA-2014-0082","RHSA-2013:1011","RHSA-2013:1012","SUSE-SU-2015:1337-1","UBUNTU-CVE-2012-3544"],"status":"published","title":"Apache Tomcat Vulnerable to Denial of Service (DoS) via Improper Handling of chunk extensions","description":"Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.11001,"percentile":0.95931,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2012-12-31T00:00:00Z","modified":"2026-10-09T20:17:03Z","fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","fixed_in":["6.0.37","7.0.30"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.37"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.30"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.35-1+squeeze3"}]}],"versions":["6.0.28-10","6.0.28-9","6.0.28-9+squeeze1","6.0.32-1","6.0.32-2","6.0.32-3","6.0.32-4","6.0.32-5","6.0.32-6","6.0.32-7","6.0.33-1","6.0.35-1","6.0.35-1+squeeze2"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.35-6+deb7u1"}]}],"versions":["6.0.35-6"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.28-4+deb7u1"}]}],"versions":["7.0.28-4"],"bundled":6},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.37"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.30"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.39-1.1.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-daemon-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-4.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-daemon-jsvc-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-1.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-pool-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.redhat_4.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"apache-commons-pool-tomcat-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.redhat_4.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"dom4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-19.redhat_5.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"ecj3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.2-6.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster-tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_cluster-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_jk-ap22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-23.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.27-4.redhat_1.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-8_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el5","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-9_patch_01.ep6.el5"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-daemon-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-4.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-daemon-jsvc-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-1.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-daemon-jsvc-eap6-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.15-1.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-pool-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.redhat_4.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"apache-commons-pool-tomcat-eap6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6-6.redhat_4.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"dom4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-19.redhat_5.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"ecj3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.7.2-6.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.22-23.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-demo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_cluster-tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.4-1.Final_redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk-ap22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_jk-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.37-2.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.2.22-23.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.27-4.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat-native-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.27-4.redhat_1.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-jsp-2.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-servlet-2.5-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat6-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.37-10_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-el-1.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-jsp-2.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-servlet-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:2::el6","package":"tomcat7-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.40-5_patch_01.ep6.el6"}]}],"bundled":5}],"products":[{"vendor":"apache","product":"tomcat"}],"references":[{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1378702","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://www.securityfocus.com/bid/59797","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1378921","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2014-0012.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://tomcat.apache.org/security-7.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://www.securityfocus.com/archive/1/534161/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1476592","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java?r1=1476592\u0026r2=1476591\u0026pathrev=1476592","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://tomcat.apache.org/security-6.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","report"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2014/Dec/23","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2013-05/0042.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.ubuntu.com/usn/USN-1841-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/64758","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3544","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qfxv-3ppc-7qg5"},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0082.html","tags":["advisory"]},{"url":"http://www.ubuntu.com/usn/usn-1841-1/","tags":["web"]},{"url":"https://rhn.redhat.com/errata/RHSA-2013-0869.html","tags":["web"]},{"url":"http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.39","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10201","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1011","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/JBoss_Enterprise_Web_Server/2/html-single/Installation_Guide/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=915883","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=915884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=961779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=961783","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=961803","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1011.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-3499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3499","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-3544","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3544","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-4558","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4558","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4558","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2067","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2067","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2067","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2071","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2071","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1012","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1012.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151337-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/768772","tags":["report"]},{"url":"https://bugzilla.suse.com/804992","tags":["report"]},{"url":"https://bugzilla.suse.com/818948","tags":["report"]},{"url":"https://bugzilla.suse.com/822177","tags":["report"]},{"url":"https://bugzilla.suse.com/831119","tags":["report"]},{"url":"https://bugzilla.suse.com/906152","tags":["report"]},{"url":"https://bugzilla.suse.com/917127","tags":["report"]},{"url":"https://bugzilla.suse.com/918195","tags":["report"]},{"url":"https://bugzilla.suse.com/926762","tags":["report"]},{"url":"https://bugzilla.suse.com/931442","tags":["report"]},{"url":"https://bugzilla.suse.com/932698","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7810","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2012-3544","tags":["report"]},{"url":"http://mail-archives.apache.org/mod_mbox/tomcat-announce/201305.mbox/%3C518CB1D9.6020808@apache.org%3E","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-1841-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2012-3544","description":"Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.","status":"published","published":"2013-06-01T10:00:00Z","modified":"2026-10-09T19:07:16.429Z","updated_at":"2026-11-02T14:34:50.94153Z"}],"euvd":[{"id":"EUVD-2012-3492","description":"Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.","status":"published","published":"2013-06-01T10:00:00Z","modified":"2026-10-09T19:07:16Z","updated_at":"2026-11-02T17:27:24.157251Z"}],"ghsa":[{"id":"GHSA-qfxv-3ppc-7qg5","title":"Apache Tomcat Vulnerable to Denial of Service (DoS) via Improper Handling of chunk extensions","description":"Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.","status":"published","published":"2022-05-14T01:10:36Z","modified":"2025-04-12T00:09:10Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:39.044439Z"}],"nvd":[{"id":"CVE-2012-3544","description":"Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.","status":"published","published":"2013-06-01T14:21:05.75Z","modified":"2026-10-09T20:17:03.893Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:17.375282Z"}],"osv":[{"id":"DSA-2725-1","title":"tomcat6 - several","status":"published","published":"2013-07-18T00:00:00Z","modified":"2026-03-09T01:22:19.845174Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"DSA-2897-1","title":"tomcat7 - security update","status":"published","published":"2014-04-08T00:00:00Z","modified":"2026-03-09T01:18:45.204972Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"GHSA-qfxv-3ppc-7qg5","title":"Apache Tomcat Vulnerable to Denial of Service (DoS) via Improper Handling of chunk extensions","description":"Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.","status":"published","published":"2022-05-14T01:10:36Z","modified":"2025-04-12T00:27:23.089376Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"MGASA-2014-0082","title":"Updated tomcat6 packages fix multiple vulnerabilities and logging","description":"Updated tomcat6 packages fix security vulnerabilities:\n\nIt was discovered that Tomcat incorrectly handled certain requests\nsubmitted using chunked transfer encoding. A remote attacker could use this\nflaw to cause the Tomcat server to stop responding, resulting in a denial\nof service (CVE-2012-3544).\n\nA frame injection in the Javadoc component in Oracle Java SE 7 Update 21\nand earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier;\nJavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect\nintegrity via unknown vectors related to Javadoc (CVE-2013-1571)\n\nA flaw was found in the way the tomcat6 init script handled the\ntomcat6-initd.log log file. A malicious web application deployed on Tomcat\ncould use this flaw to perform a symbolic link attack to change the\nownership of an arbitrary system file to that of the tomcat user, allowing\nthem to escalate their privileges to root (CVE-2013-1976).\n\nIt was discovered that Tomcat incorrectly handled certain authentication\nrequests. A remote attacker could possibly use this flaw to inject a\nrequest that would get executed with a victim's credentials (CVE-2013-2067).\n\nNote: With this update, tomcat6-initd.log has been moved from\n/var/log/tomcat6/ to the /var/log/ directory.\n","status":"published","published":"2014-02-17T18:13:24Z","modified":"2026-04-16T06:25:08.521378458Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"RHSA-2013:1011","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 update","status":"published","published":"2024-09-15T20:50:45Z","modified":"2026-08-05T10:02:15Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:1012","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 update","status":"published","published":"2024-09-15T20:50:50Z","modified":"2026-08-05T10:02:16Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"SUSE-SU-2015:1337-1","title":"Security update for tomcat6","description":"\nThis update of tomcat6 fixes:\n\n    * apache-tomcat-CVE-2012-3544.patch (bnc#831119)\n    * use chown --no-dereference to prevent symlink attacks on log\n      (bnc#822177#c7/prevents CVE-2013-1976)\n    * Fix tomcat init scripts generating malformed classpath (\n      http://youtrack.jetbrains.com/issue/JT-18545\n      \u003chttp://youtrack.jetbrains.com/issue/JT-18545\u003e ) bnc#804992 (patch\n      from m407)\n    * fix a typo in initscript (bnc#768772 )\n    * copy all shell scripts (bnc#818948)\n\nSecurity Issue references:\n\n    * CVE-2012-3544\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3544\u003e\n    * CVE-2013-1976\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1976\u003e\n    * CVE-2012-0022\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0022\u003e\n\n","status":"published","published":"2013-08-02T13:29:14Z","modified":"2026-02-04T03:53:07.546995Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2012-3544","description":"Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.","status":"withdrawn","published":"2012-12-31T00:00:00Z","modified":"2026-02-04T03:40:06.820171Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}