CVE-2012-0022
NoneCVSS
—
EPSS
10.5%
Published
Jan 19, 2012
CISA due date
—
The record
Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | 5.5.0 | 5.5.35 |
| Maven | org.apache.tomcat:tomcat | 6.0.0 | 6.0.34 |
| Maven | org.apache.tomcat:tomcat | 7.0.0 | 7.0.23 |
| Debian:6.0 | tomcat6 | 0 | 6.0.35-1+squeeze2 |
| Red Hat:enterprise_linux:5::client | tomcat5 | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client | tomcat5-common-lib | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client | tomcat5-debuginfo | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client | tomcat5-jasper | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client | tomcat5-server-lib | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client | tomcat5-webapps | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5 | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-common-lib | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-debuginfo | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jasper | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-server-lib | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::client_workstation | tomcat5-webapps | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::server | tomcat5 | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::server | tomcat5-admin-webapps | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::server | tomcat5-common-lib | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::server | tomcat5-debuginfo | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::server | tomcat5-jasper | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::server | tomcat5-jasper-javadoc | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::server | tomcat5-jsp-2.0-api | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::server | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::server | tomcat5-server-lib | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::server | tomcat5-servlet-2.4-api | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::server | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:5::server | tomcat5-webapps | 0 | 0:5.5.23-0jpp.31.el5_8 |
| Red Hat:enterprise_linux:6::client | tomcat6 | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::client | tomcat6-admin-webapps | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::client | tomcat6-docs-webapp | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::client | tomcat6-el-2.1-api | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::client | tomcat6-javadoc | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::client | tomcat6-jsp-2.1-api | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::client | tomcat6-lib | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::client | tomcat6-servlet-2.5-api | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::client | tomcat6-webapps | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::computenode | tomcat6 | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-admin-webapps | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-docs-webapp | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-el-2.1-api | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-javadoc | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-jsp-2.1-api | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-lib | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-servlet-2.5-api | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::computenode | tomcat6-webapps | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::server | tomcat6 | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::server | tomcat6-admin-webapps | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::server | tomcat6-docs-webapp | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::server | tomcat6-el-2.1-api | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::server | tomcat6-javadoc | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::server | tomcat6-jsp-2.1-api | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::server | tomcat6-lib | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::server | tomcat6-servlet-2.5-api | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::server | tomcat6-webapps | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::workstation | tomcat6 | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-admin-webapps | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-docs-webapp | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-el-2.1-api | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-javadoc | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-jsp-2.1-api | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-lib | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-servlet-2.5-api | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:enterprise_linux:6::workstation | tomcat6-webapps | 0 | 0:6.0.24-36.el6_2 |
| Red Hat:jboss_enterprise_application_platform:5::el4 | jbossweb | 0 | 0:2.1.12-3_patch_03.2.ep5.el4 |
| Red Hat:jboss_enterprise_application_platform:5::el4 | jbossweb-el-1.0-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el4 |
| Red Hat:jboss_enterprise_application_platform:5::el4 | jbossweb-jsp-2.1-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el4 |
| Red Hat:jboss_enterprise_application_platform:5::el4 | jbossweb-lib | 0 | 0:2.1.12-3_patch_03.2.ep5.el4 |
| Red Hat:jboss_enterprise_application_platform:5::el4 | jbossweb-servlet-2.5-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el4 |
| Red Hat:jboss_enterprise_application_platform:5::el5 | jbossweb | 0 | 0:2.1.12-3_patch_03.2.ep5.el5 |
| Red Hat:jboss_enterprise_application_platform:5::el5 | jbossweb-el-1.0-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el5 |
| Red Hat:jboss_enterprise_application_platform:5::el5 | jbossweb-jsp-2.1-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el5 |
| Red Hat:jboss_enterprise_application_platform:5::el5 | jbossweb-lib | 0 | 0:2.1.12-3_patch_03.2.ep5.el5 |
| Red Hat:jboss_enterprise_application_platform:5::el5 | jbossweb-servlet-2.5-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el5 |
| Red Hat:jboss_enterprise_application_platform:5::el6 | jbossweb | 0 | 0:2.1.12-3_patch_03.2.ep5.el6 |
| Red Hat:jboss_enterprise_application_platform:5::el6 | jbossweb-el-1.0-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el6 |
| Red Hat:jboss_enterprise_application_platform:5::el6 | jbossweb-jsp-2.1-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el6 |
| Red Hat:jboss_enterprise_application_platform:5::el6 | jbossweb-lib | 0 | 0:2.1.12-3_patch_03.2.ep5.el6 |
| Red Hat:jboss_enterprise_application_platform:5::el6 | jbossweb-servlet-2.5-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el6 |
| Red Hat:jboss_enterprise_web_platform:5::el5 | jbossweb | 0 | 0:2.1.12-3_patch_03.2.ep5.el5 |
| Red Hat:jboss_enterprise_web_platform:5::el5 | jbossweb-el-1.0-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el5 |
| Red Hat:jboss_enterprise_web_platform:5::el5 | jbossweb-jsp-2.1-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el5 |
| Red Hat:jboss_enterprise_web_platform:5::el5 | jbossweb-lib | 0 | 0:2.1.12-3_patch_03.2.ep5.el5 |
| Red Hat:jboss_enterprise_web_platform:5::el5 | jbossweb-servlet-2.5-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el5 |
| Red Hat:jboss_enterprise_web_platform:5::el6 | jbossweb | 0 | 0:2.1.12-3_patch_03.2.ep5.el6 |
| Red Hat:jboss_enterprise_web_platform:5::el6 | jbossweb-el-1.0-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el6 |
| Red Hat:jboss_enterprise_web_platform:5::el6 | jbossweb-jsp-2.1-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el6 |
| Red Hat:jboss_enterprise_web_platform:5::el6 | jbossweb-lib | 0 | 0:2.1.12-3_patch_03.2.ep5.el6 |
| Red Hat:jboss_enterprise_web_platform:5::el6 | jbossweb-servlet-2.5-api | 0 | 0:2.1.12-3_patch_03.2.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5 | 0 | 0:5.5.33-27_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-admin-webapps | 0 | 0:5.5.33-27_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-common-lib | 0 | 0:5.5.33-27_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-jasper | 0 | 0:5.5.33-27_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-jasper-eclipse | 0 | 0:5.5.33-27_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-jasper-javadoc | 0 | 0:5.5.33-27_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-jsp-2.0-api | 0 | 0:5.5.33-27_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.33-27_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-parent | 0 | 0:5.5.33-27_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-server-lib | 0 | 0:5.5.33-27_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-servlet-2.4-api | 0 | 0:5.5.33-27_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.33-27_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat5-webapps | 0 | 0:5.5.33-27_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6 | 0 | 0:6.0.32-24_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-admin-webapps | 0 | 0:6.0.32-24_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-docs-webapp | 0 | 0:6.0.32-24_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-el-1.0-api | 0 | 0:6.0.32-24_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-javadoc | 0 | 0:6.0.32-24_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-jsp-2.1-api | 0 | 0:6.0.32-24_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-lib | 0 | 0:6.0.32-24_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-log4j | 0 | 0:6.0.32-24_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-servlet-2.5-api | 0 | 0:6.0.32-24_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el5 | tomcat6-webapps | 0 | 0:6.0.32-24_patch_07.ep5.el5 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat5 | 0 | 0:5.5.33-28_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat5-admin-webapps | 0 | 0:5.5.33-28_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat5-common-lib | 0 | 0:5.5.33-28_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat5-jasper | 0 | 0:5.5.33-28_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat5-jasper-eclipse | 0 | 0:5.5.33-28_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat5-jasper-javadoc | 0 | 0:5.5.33-28_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat5-jsp-2.0-api | 0 | 0:5.5.33-28_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat5-jsp-2.0-api-javadoc | 0 | 0:5.5.33-28_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat5-parent | 0 | 0:5.5.33-28_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat5-server-lib | 0 | 0:5.5.33-28_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat5-servlet-2.4-api | 0 | 0:5.5.33-28_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat5-servlet-2.4-api-javadoc | 0 | 0:5.5.33-28_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat5-webapps | 0 | 0:5.5.33-28_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat6 | 0 | 0:6.0.32-24_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat6-admin-webapps | 0 | 0:6.0.32-24_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat6-docs-webapp | 0 | 0:6.0.32-24_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat6-el-1.0-api | 0 | 0:6.0.32-24_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat6-javadoc | 0 | 0:6.0.32-24_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat6-jsp-2.1-api | 0 | 0:6.0.32-24_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat6-lib | 0 | 0:6.0.32-24_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat6-log4j | 0 | 0:6.0.32-24_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat6-servlet-2.5-api | 0 | 0:6.0.32-24_patch_07.ep5.el6 |
| Red Hat:jboss_enterprise_web_server:1::el6 | tomcat6-webapps | 0 | 0:6.0.32-24_patch_07.ep5.el6 |
| maven | org.apache.tomcat/tomcat | 5.5.0 | 5.5.35 |
| maven | org.apache.tomcat/tomcat | 6.0.0 | 6.0.34 |
| maven | org.apache.tomcat/tomcat | 7.0.0 | 7.0.23 |
Related vulnerabilities
- CVE-2026-24733 Improper Input Validation vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-66614 Improper Input Validation vulnerability. Also affects org.apache.tomcat:tomcat
- GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal Also affects org.apache.tomcat:tomcat
- GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences Also affects org.apache.tomcat:tomcat
- CVE-2025-61795 Improper Resource Shutdown or Release vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-55752 Relative Path Traversal vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-55754 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache… Also affects org.apache.tomcat:tomcat
- CVE-2025-49124 Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. Also affects org.apache.tomcat:tomcat