CVE-2008-4308
apache tomcat: no CVSS score yet. EPSS 4.2% chance of exploitation in the next 30 days. Fixed in org.apache.tomcat:tomcat 4.1.35, 5.5.21.
The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.
- EPSS
- 4.2% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7g59-hm8v-cwmc | Maven | org.apache.tomcat:tomcat | >=4.1.32 <4.1.35 | 4.1.35 |
| GHSA-7g59-hm8v-cwmc | Maven | org.apache.tomcat:tomcat | >=5.5.10 <5.5.21 | 5.5.21 |