CVE-2012-3544
Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
- EPSS
- 11% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-25)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:tomcat
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qfxv-3ppc-7qg5 | Maven | org.apache.tomcat:tomcat | >=6.0.0 <6.0.37 | 6.0.37 |
| GHSA-qfxv-3ppc-7qg5 | Maven | org.apache.tomcat:tomcat | >=7.0.0 <7.0.30 | 7.0.30 |
References
- http://archives.neohapsis.com/archives/bugtraq/2013-05/0042.html
- http://seclists.org/fulldisclosure/2014/Dec/23
- http://svn.apache.org/viewvc/tomcat/tc6.0.x/trunk/java/org/apache/coyote/http11/filters/ChunkedInputFilter.java?r1=1476592&r2=1476591&pathrev=1476592
- http://svn.apache.org/viewvc?view=revision&revision=1378702
- http://svn.apache.org/viewvc?view=revision&revision=1378921