CVE-2023-46589

Summary

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.

Affected Software

VendorProductVersion RangeStatus
Apache Software FoundationApache Tomcat11.0.0-M1 <= 11.0.0-M10affected
Apache Software FoundationApache Tomcat10.1.0-M1 <= 10.1.15affected
Apache Software FoundationApache Tomcat9.0.0-M1 <= 9.0.82affected
Apache Software FoundationApache Tomcat8.5.0 <= 8.5.95affected
Apache Software FoundationApache Tomcat3 < 8.5.0unknown
Apache Software FoundationApache Tomcat10.0.0-M1 <= 10.0.27unknown

Weaknesses

  • CWE-444: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

CVE Program Container

Additional References

References