MEDIUM
tomcat: incomplete fix for CVE-2012-3544
Published Feb 26, 2014
4.3
MEDIUMCVSS 2.0
EPSS 9.46%
Description
Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
Affected products
No data.
Configuration 1
OR
- 7.0.0
- 7.0.0
- 7.0.1
- 7.0.2
- 7.0.2
- 7.0.3
- 7.0.4
- 7.0.4
- 7.0.10
- 7.0.11
- 7.0.12
- 7.0.13
- 7.0.14
- 7.0.15
- 7.0.16
- 7.0.17
- 7.0.18
- 7.0.19
- 7.0.20
- 7.0.21
- 7.0.22
- 7.0.23
- 7.0.24
- 7.0.25
- 7.0.26
- 7.0.27
- 7.0.28
- 7.0.29
- 7.0.30
- 7.0.31
- 7.0.32
- 7.0.33
- 7.0.34
- 7.0.35
- 7.0.36
- 7.0.37
- 7.0.38
- 7.0.39
- 7.0.40
- 7.0.41
- 7.0.42
- 7.0.43
- 7.0.44
- 7.0.45
- 7.0.46
- 7.0.50
Configuration 2
OR
- ≤ 6.0.37
- 1.1.3
- 3.0
- 3.1
- 3.1.1
- 3.2
- 3.2.1
- 3.2.2
- 3.2.2
- 3.2.3
- 3.2.4
- 3.3
- 3.3.1
- 3.3.1a
- 3.3.2
- 4
- 4.0.0
- 4.0.1
- 4.0.2
- 4.0.3
- 4.0.4
- 4.0.5
- 4.0.6
- 4.1.0
- 4.1.1
- 4.1.2
- 4.1.3
- 4.1.3
- 4.1.9
- 4.1.10
- 4.1.12
- 4.1.15
- 4.1.24
- 4.1.28
- 4.1.29
- 4.1.31
- 4.1.36
- 5
- 5.0.0
- 5.0.1
- 5.0.2
- 5.0.3
- 5.0.4
- 5.0.5
- 5.0.6
- 5.0.7
- 5.0.8
- 5.0.9
- 5.0.10
- 5.0.11
- 5.0.12
- 5.0.13
- 5.0.14
- 5.0.15
- 5.0.16
- 5.0.17
- 5.0.18
- 5.0.19
- 5.0.21
- 5.0.22
- 5.0.23
- 5.0.24
- 5.0.25
- 5.0.26
- 5.0.27
- 5.0.28
- 5.0.29
- 5.0.30
- 5.5.0
- 5.5.1
- 5.5.2
- 5.5.3
- 5.5.4
- 5.5.5
- 5.5.6
- 5.5.7
- 5.5.8
- 5.5.9
- 5.5.10
- 5.5.11
- 5.5.12
- 5.5.13
- 5.5.14
- 5.5.15
- 5.5.16
- 5.5.17
- 5.5.18
- 5.5.19
- 5.5.20
- 5.5.21
- 5.5.22
- 5.5.23
- 5.5.24
- 5.5.25
- 5.5.26
- 5.5.27
- 5.5.28
- 5.5.29
- 5.5.30
- 5.5.31
- 5.5.32
- 5.5.33
- 5.5.34
- 5.5.35
- 6
- 6.0
- 6.0.0
- 6.0.0
- 6.0.1
- 6.0.1
- 6.0.2
- 6.0.2
- 6.0.2
- 6.0.3
- 6.0.10
- 6.0.11
- 6.0.12
- 6.0.13
- 6.0.14
- 6.0.15
- 6.0.16
- 6.0.17
- 6.0.18
- 6.0.19
- 6.0.20
- 6.0.24
- 6.0.26
- 6.0.27
- 6.0.28
- 6.0.29
- 6.0.30
- 6.0.31
- 6.0.32
- 6.0.33
- 6.0.35
- 6.0.36
Configuration 3
OR
- 8.0.0
- 8.0.0
- 8.0.0
- 8.0.0
- 8.0.0
- 8.0.0
- 8.0.0
- 8.0.0
- 8.0.0
No data.
Red Hat Enterprise Linux 6
tomcat6-0:6.0.24-64.el6_5
Fixed · RHSA-2014:0429
Red Hat Enterprise Linux 7
tomcat-0:7.0.42-5.el7_0
Fixed · RHSA-2014:0686
Red Hat JBoss Enterprise Web Server 2 for RHEL 5
tomcat6-0:6.0.37-19_patch_04.ep6.el5
Fixed · RHSA-2014:0525
Red Hat JBoss Enterprise Web Server 2 for RHEL 5
tomcat7-0:7.0.40-13_patch_02.ep6.el5
Fixed · RHSA-2014:0526
Red Hat JBoss Enterprise Web Server 2 for RHEL 6
tomcat6-0:6.0.37-27_patch_04.ep6.el6
Fixed · RHSA-2014:0525
Red Hat JBoss Enterprise Web Server 2 for RHEL 6
tomcat7-0:7.0.40-9_patch_02.ep6.el6
Fixed · RHSA-2014:0526
Red Hat JBoss Web Server 2.0
tomcat6
Fixed · RHSA-2014:0528
Red Hat JBoss Web Server 2.0
tomcat7
Fixed · RHSA-2014:0527
Red Hat BPM Suite 6
jbossweb
Not affected
Red Hat Enterprise Linux 5
tomcat5
Will not fix
Red Hat JBoss BRMS 6
jbossweb
Not affected
Red Hat JBoss Data Grid 6
jbossweb
Not affected
Red Hat JBoss Data Virtualization 6
jbossweb
Not affected
Red Hat JBoss Enterprise Application Platform 5
jbossweb
Not affected
Red Hat JBoss Enterprise Application Platform 6
jbossweb
Not affected
Red Hat JBoss Enterprise Web Server 1
tomcat5
Will not fix
Red Hat JBoss Enterprise Web Server 1
tomcat6
Will not fix
Red Hat JBoss Fuse Service Works 6
jbossweb
Not affected
Red Hat JBoss Operations Network 3
jbossweb
Not affected
Red Hat JBoss Portal 6
jbossweb
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | tomcat6-0:6.0.24-64.el6_5 | Fixed | RHSA-2014:0429 |
| Red Hat Enterprise Linux 7 | tomcat-0:7.0.42-5.el7_0 | Fixed | RHSA-2014:0686 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 5 | tomcat6-0:6.0.37-19_patch_04.ep6.el5 | Fixed | RHSA-2014:0525 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 5 | tomcat7-0:7.0.40-13_patch_02.ep6.el5 | Fixed | RHSA-2014:0526 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 | tomcat6-0:6.0.37-27_patch_04.ep6.el6 | Fixed | RHSA-2014:0525 |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 | tomcat7-0:7.0.40-9_patch_02.ep6.el6 | Fixed | RHSA-2014:0526 |
| Red Hat JBoss Web Server 2.0 | tomcat6 | Fixed | RHSA-2014:0528 |
| Red Hat JBoss Web Server 2.0 | tomcat7 | Fixed | RHSA-2014:0527 |
| Red Hat BPM Suite 6 | jbossweb | Not affected | n/a |
| Red Hat Enterprise Linux 5 | tomcat5 | Will not fix | n/a |
| Red Hat JBoss BRMS 6 | jbossweb | Not affected | n/a |
| Red Hat JBoss Data Grid 6 | jbossweb | Not affected | n/a |
| Red Hat JBoss Data Virtualization 6 | jbossweb | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform 5 | jbossweb | Not affected | n/a |
| Red Hat JBoss Enterprise Application Platform 6 | jbossweb | Not affected | n/a |
| Red Hat JBoss Enterprise Web Server 1 | tomcat5 | Will not fix | n/a |
| Red Hat JBoss Enterprise Web Server 1 | tomcat6 | Will not fix | n/a |
| Red Hat JBoss Fuse Service Works 6 | jbossweb | Not affected | n/a |
| Red Hat JBoss Operations Network 3 | jbossweb | Not affected | n/a |
| Red Hat JBoss Portal 6 | jbossweb | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
No CVSS v3.1 score for this CVE.
No CVSS v3.0 score for this CVE.
4.3 MEDIUM NVD
AV:N/AC:M/Au:N/C:N/I:N/A:P
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
9.46% 0.09458
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.09458
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (36 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 9.46% (0.09458) | 95.28th | v5 (v2026.06.15) |
| Jun 15, 2026 | 9.49% (0.09492) | 94.80th | v5 (v2026.06.15) |
| Mar 27, 2026 | 36.66% (0.36664) | 97.10th | v4 (v2025.03.14) |
| Mar 13, 2026 | 48.49% (0.48491) | 97.69th | v4 (v2025.03.14) |
| Feb 22, 2026 | 59.36% (0.59364) | 98.20th | v4 (v2025.03.14) |
| Feb 19, 2026 | 56.33% (0.56328) | 98.05th | v4 (v2025.03.14) |
| Feb 18, 2026 | 54.08% (0.54083) | 97.94th | v4 (v2025.03.14) |
| Jan 26, 2026 | 48.22% (0.48222) | 97.64th | v4 (v2025.03.14) |
| Jan 21, 2026 | 50.67% (0.50672) | 97.76th | v4 (v2025.03.14) |
| Jan 19, 2026 | 47.63% (0.47632) | 97.60th | v4 (v2025.03.14) |
| Dec 28, 2025 | 70.70% (0.70702) | 98.64th | v4 (v2025.03.14) |
| Dec 27, 2025 | 72.22% (0.72219) | 98.71th | v4 (v2025.03.14) |
| Oct 28, 2025 | 70.70% (0.70702) | 98.62th | v4 (v2025.03.14) |
| Oct 27, 2025 | 72.22% (0.72219) | 98.70th | v4 (v2025.03.14) |
| Oct 1, 2025 | 70.70% (0.70702) | 98.65th | v4 (v2025.03.14) |
| Sep 28, 2025 | 72.22% (0.72219) | 98.72th | v4 (v2025.03.14) |
| Sep 26, 2025 | 75.65% (0.75649) | 98.87th | v4 (v2025.03.14) |
| Jul 9, 2025 | 67.32% (0.67322) | 98.46th | v4 (v2025.03.14) |
| Jun 18, 2025 | 74.78% (0.74775) | 98.79th | v4 (v2025.03.14) |
| May 15, 2025 | 79.15% (0.79150) | 98.99th | v4 (v2025.03.14) |
| Mar 30, 2025 | 82.55% (0.82552) | 99.19th | v4 (v2025.03.14) |
| Mar 29, 2025 | 83.68% (0.83678) | 99.11th | v4 (v2025.03.14) |
| Mar 17, 2025 | 82.55% (0.82552) | 99.19th | v4 (v2025.03.14) |
| Jan 16, 2025 | 86.13% (0.86130) | 98.83th | v3 (v2023.03.01) |
| Dec 17, 2024 | 88.30% (0.88301) | 98.94th | v3 (v2023.03.01) |
| Sep 13, 2024 | 91.83% (0.91834) | 98.99th | v3 (v2023.03.01) |
| Jun 1, 2024 | 93.04% (0.93043) | 99.04th | v3 (v2023.03.01) |
| Feb 25, 2024 | 93.17% (0.93169) | 98.99th | v3 (v2023.03.01) |
| Nov 23, 2023 | 93.63% (0.93625) | 98.88th | v3 (v2023.03.01) |
| Oct 9, 2023 | 94.44% (0.94443) | 98.94th | v3 (v2023.03.01) |
| Aug 23, 2023 | 95.08% (0.95084) | 99.01th | v3 (v2023.03.01) |
| Mar 23, 2023 | 94.94% (0.94941) | 98.80th | v3 (v2023.03.01) |
| Mar 7, 2023 | 95.48% (0.95476) | 98.92th | v3 (v2023.03.01) |
| Mar 6, 2023 | 7.34% (0.07344) | 92.59th | v2 (v2022.01.01) |
| Apr 1, 2022 | 7.34% (0.07344) | 91.87th | v2 (v2022.01.01) |
| Feb 4, 2022 | 7.34% (0.07344) | 80.64th | v2 (v2022.01.01) |
References (64)
- http://advisories.mageia.org/MGASA-2014-0148.html x_refsource_CONFIRM
- http://marc.info/?l=bugtraq&m=144498216801440&w=2 vendor-advisoryx_refsource_HP
- http://seclists.org/fulldisclosure/2014/Dec/23 mailing-listx_refsource_FULLDISC
- http://secunia.com/advisories/59036 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/59675 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/59722 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/59724 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/59873 third-party-advisoryx_refsource_SECUNIA
- http://svn.apache.org/viewvc?view=revision&revision=1521834 x_refsource_CONFIRM
- http://svn.apache.org/viewvc?view=revision&revision=1521864 x_refsource_CONFIRM
- http://svn.apache.org/viewvc?view=revision&revision=1549522 x_refsource_CONFIRM
- http://svn.apache.org/viewvc?view=revision&revision=1549523 x_refsource_CONFIRM
- http://svn.apache.org/viewvc?view=revision&revision=1556540 x_refsource_CONFIRM
- http://tomcat.apache.org/security-6.html x_refsource_CONFIRMVendor Advisory
- http://tomcat.apache.org/security-7.html x_refsource_CONFIRMVendor Advisory
- http://tomcat.apache.org/security-8.html x_refsource_CONFIRMVendor Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21667883 x_refsource_CONFIRM
- http://www-01.ibm.com/support/docview.wss?uid=swg21675886 x_refsource_CONFIRM
- http://www-01.ibm.com/support/docview.wss?uid=swg21677147 x_refsource_CONFIRM
- http://www-01.ibm.com/support/docview.wss?uid=swg21678113 x_refsource_CONFIRM
- http://www-01.ibm.com/support/docview.wss?uid=swg21678231 x_refsource_CONFIRM
- http://www.debian.org/security/2016/dsa-3530 vendor-advisoryx_refsource_DEBIAN
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:052 vendor-advisoryx_refsource_MANDRIVA
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:084 vendor-advisoryx_refsource_MANDRIVA
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html x_refsource_CONFIRM
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html x_refsource_CONFIRM
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html x_refsource_CONFIRM
- http://www.securityfocus.com/archive/1/534161/100/0/threaded mailing-listx_refsource_BUGTRAQ
- http://www.securityfocus.com/bid/65767 vdb-entryx_refsource_BID
- http://www.ubuntu.com/usn/USN-2130-1 vendor-advisoryx_refsource_UBUNTU
- http://www.vmware.com/security/advisories/VMSA-2014-0008.html x_refsource_CONFIRM
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2013-4322 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1069905 x_refsource_CONFIRMIssue Tracking
- https://github.com/advisories/GHSA-wq2p-q66w-q8gp Advisory
- https://github.com/apache/tomcat/commit/70dc3b279f7c99136c2c51bce8812508b4893c8b
- https://github.com/apache/tomcat/commit/72613a0e2f88af789c2acc7093c82ff02b95b6d1
- https://github.com/apache/tomcat/commit/a91516b80deaf1d0c6e04a7931765fdac34c4ccd
- https://github.com/apache/tomcat/commit/b8cb9f5f91e9210ca107fd80f3e6acd47531daa7
- https://github.com/apache/tomcat/commit/bed3a1a0d06a3c787183c6e90f326bbe17e49dd4
- https://github.com/apache/tomcat/commit/d6a9898125f34e593de426e8c7dabb0f224fc00f
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 x_refsource_CONFIRM
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E mailing-listx_refsource_MLIST
- https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2013-4322
- https://rhn.redhat.com/errata/RHSA-2014-0686.html vendor-advisoryx_refsource_REDHAT
- https://web.archive.org/web/20140315211337/http://www.securityfocus.com/bid/65767
- https://web.archive.org/web/20150503090027/http://www.securityfocus.com/archive/1/534161/100/0/threaded
- https://web.archive.org/web/20151023203543/http://secunia.com/advisories/59873
- https://web.archive.org/web/20161024215620/http://secunia.com/advisories/59036
- https://web.archive.org/web/20161024215639/http://secunia.com/advisories/59722
- https://web.archive.org/web/20161024215804/http://secunia.com/advisories/59675
- https://web.archive.org/web/20161024220018/http://secunia.com/advisories/59724
- https://www.cve.org/CVERecord?id=CVE-2013-4322
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Feb 26, 2014
Updated Aug 6, 2024
Reserved Jun 12, 2013
Link CVE-2013-4322
CISA Vulnrichment
GHSA-WQ2P-Q66W-Q8GP Updated n/a