CVE-2011-0534
Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
- EPSS
- 7.9% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-399
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-43v2-6grp-9pp9 | Maven | org.apache.tomcat:tomcat | >=6.0.0 <6.0.32 | 6.0.32 |
| GHSA-43v2-6grp-9pp9 | Maven | org.apache.tomcat:tomcat | >=7.0.0 <7.0.8 | 7.0.8 |