CVE-2019-17569

4.8 mediumEPSS 8.9%

Medium (4.8). EPSS 8.9% chance of exploitation in the next 30 days. Fixed in org.apache.tomcat.embed:tomcat-embed-core 7.0.100, 8.5.51, 9.0.31.

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 8.9% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWE: CWE-444
Published: 2020-02-24
Modified: 2026-08-25
Record from: the NVD, synced 2026-10-19

Affected

apache:tomcat
apache:tomee
debian:debian_linux
netapp:data_availability_services
netapp:oncommand_system_manager
opensuse:leap
oracle:agile_engineering_data_management
oracle:agile_product_lifecycle_management
oracle:communications_instant_messaging_server
oracle:health_sciences_empirica_inspections
oracle:health_sciences_empirica_signal
oracle:hospitality_guest_access
oracle:instantis_enterprisetrack
oracle:mysql_enterprise_monitor
oracle:transportation_management
oracle:workload_manager

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-767j-jfh2-jvrc	Maven	org.apache.tomcat.embed:tomcat-embed-core	>=7.0.98 <7.0.100	7.0.100
GHSA-767j-jfh2-jvrc	Maven	org.apache.tomcat.embed:tomcat-embed-core	>=8.5.48 <8.5.51	8.5.51
GHSA-767j-jfh2-jvrc	Maven	org.apache.tomcat.embed:tomcat-embed-core	>=9.0.28 <9.0.31	9.0.31
GHSA-767j-jfh2-jvrc	Maven	org.apache.tomcat:tomcat	>=7.0.98 <7.0.100	7.0.100
GHSA-767j-jfh2-jvrc	Maven	org.apache.tomcat:tomcat	>=8.5.48 <8.5.51	8.5.51
GHSA-767j-jfh2-jvrc	Maven	org.apache.tomcat:tomcat	>=9.0.28 <9.0.31	9.0.31

References

Check your stack JSON