Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Apache Tomcat: Malformed Request Can Cause Resource Consumption

CVE-2014-0075 · published 12 years ago
Summary

Apache Tomcat versions before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 are affected by a security issue that can cause the server to consume excessive resources if it receives a specially crafted request. This can lead to a denial of service. To protect against this issue, update to a fixed version of Apache Tomcat.

What to do
  • Update apache org.apache.tomcat:tomcat to version 6.0.40.
  • Update apache org.apache.tomcat:tomcat to version 7.0.53.
  • Update apache org.apache.tomcat:tomcat to version 8.0.4.
  • Update apache org.apache.tomcat:tomcat-coyote to version 6.0.40.
  • Update apache org.apache.tomcat:tomcat-coyote to version 7.0.53.
  • Update apache org.apache.tomcat:tomcat-coyote to version 8.0.4.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.tomcat:tomcat < 6.0.40
>= 7.0.0, < 7.0.53
>= 8.0.0, < 8.0.4
Fix: upgrade to 6.0.40
maven apache org.apache.tomcat:tomcat-coyote < 6.0.40
>= 7.0.0, < 7.0.53
>= 8.0.0, < 8.0.4
Fix: upgrade to 6.0.40
– apache tomcat 7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
7.0.10
7.0.11
78 more version ranges
cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*
Original advisory text
Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows rem...
Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.0 Medium
Exploitation
18% chance of attack within 30 days
Type
CWE-190Integer Overflow
CWE-400Uncontrolled Resource Consumption
CWE-189Numeric Errors
Timeline
Published31 May 2014
Updated18 Oct 2026
First seen6 Mar 2026
Sources
GHSA-475f-74wp-pqv5 · GHSA
CVE-2014-0075 · NVD
CVE-2014-0075 · MITRE
Track software like this
Free during beta