Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 28 Nov 2023 15:32:50 +0000
From: Mark Thomas <>
Subject: CVE-2023-46589: Apache Tomcat: HTTP request smuggling via malformed
 trailer headers

Severity: important

Affected versions:

- Apache Tomcat 11.0.0-M1 through 11.0.0-M10
- Apache Tomcat 10.1.0-M1 through 10.1.15
- Apache Tomcat 9.0.0-M1 through 9.0.82
- Apache Tomcat 8.5.0 through 8.5.95


Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 
11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 
9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly 
parse HTTP trailer headers. A trailer header that exceeded the header 
size limit could cause Tomcat to treat a single
request as multiple requests leading to the possibility of request
smuggling when behind a reverse proxy.

Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 
onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.


Norihito Aimoto (OSSTech Corporation)  (finder)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.