CVE-2012-3544
NoneCVSS
—
EPSS
11.0%
Published
Jun 1, 2013
CISA due date
—
The record
Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.tomcat:tomcat | 6.0.0 | 6.0.37 |
| Maven | org.apache.tomcat:tomcat | 7.0.0 | 7.0.30 |
| Debian:6.0 | tomcat6 | 0 | 6.0.35-1+squeeze3 |
| Debian:7 | tomcat6 | 0 | 6.0.35-6+deb7u1 |
| Debian:7 | tomcat7 | 0 | 7.0.28-4+deb7u1 |
| Mageia:3 | tomcat6 | 0 | 6.0.39-1.1.mga3 |
| Red Hat:jboss_enterprise_web_server:2::el5 | apache-commons-daemon-eap6 | 0 | 1:1.0.15-4.redhat_1.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | apache-commons-daemon-jsvc-eap6 | 0 | 1:1.0.15-1.redhat_1.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | apache-commons-pool-eap6 | 0 | 0:1.6-6.redhat_4.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | apache-commons-pool-tomcat-eap6 | 0 | 0:1.6-6.redhat_4.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | dom4j | 0 | 0:1.6.1-19.redhat_5.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | ecj3 | 0 | 1:3.7.2-6.redhat_1.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | httpd | 0 | 0:2.2.22-23.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | httpd-devel | 0 | 0:2.2.22-23.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | httpd-manual | 0 | 0:2.2.22-23.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | httpd-tools | 0 | 0:2.2.22-23.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | mod_cluster | 0 | 0:1.2.4-1.Final_redhat_1.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | mod_cluster-demo | 0 | 0:1.2.4-1.Final_redhat_1.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | mod_cluster-native | 0 | 0:1.2.4-1.Final.redhat_1.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | mod_cluster-tomcat6 | 0 | 0:1.2.4-1.Final_redhat_1.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | mod_cluster-tomcat7 | 0 | 0:1.2.4-1.Final_redhat_1.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | mod_jk | 0 | 0:1.2.37-2.redhat_1.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | mod_jk-ap22 | 0 | 0:1.2.37-2.redhat_1.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | mod_jk-manual | 0 | 0:1.2.37-2.redhat_1.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | mod_ssl | 0 | 1:2.2.22-23.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat-native | 0 | 0:1.1.27-4.redhat_1.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat6 | 0 | 0:6.0.37-8_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat6-admin-webapps | 0 | 0:6.0.37-8_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat6-docs-webapp | 0 | 0:6.0.37-8_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat6-el-1.0-api | 0 | 0:6.0.37-8_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat6-javadoc | 0 | 0:6.0.37-8_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat6-jsp-2.1-api | 0 | 0:6.0.37-8_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat6-lib | 0 | 0:6.0.37-8_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat6-log4j | 0 | 0:6.0.37-8_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat6-servlet-2.5-api | 0 | 0:6.0.37-8_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat6-webapps | 0 | 0:6.0.37-8_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat7 | 0 | 0:7.0.40-9_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat7-admin-webapps | 0 | 0:7.0.40-9_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat7-docs-webapp | 0 | 0:7.0.40-9_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat7-el-1.0-api | 0 | 0:7.0.40-9_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat7-javadoc | 0 | 0:7.0.40-9_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat7-jsp-2.2-api | 0 | 0:7.0.40-9_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat7-lib | 0 | 0:7.0.40-9_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat7-log4j | 0 | 0:7.0.40-9_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat7-servlet-3.0-api | 0 | 0:7.0.40-9_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el5 | tomcat7-webapps | 0 | 0:7.0.40-9_patch_01.ep6.el5 |
| Red Hat:jboss_enterprise_web_server:2::el6 | apache-commons-daemon-eap6 | 0 | 1:1.0.15-4.redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | apache-commons-daemon-jsvc-eap6 | 0 | 1:1.0.15-1.redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | apache-commons-daemon-jsvc-eap6-debuginfo | 0 | 1:1.0.15-1.redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | apache-commons-pool-eap6 | 0 | 0:1.6-6.redhat_4.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | apache-commons-pool-tomcat-eap6 | 0 | 0:1.6-6.redhat_4.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | dom4j | 0 | 0:1.6.1-19.redhat_5.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | ecj3 | 0 | 1:3.7.2-6.redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | httpd | 0 | 0:2.2.22-23.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | httpd-debuginfo | 0 | 0:2.2.22-23.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | httpd-devel | 0 | 0:2.2.22-23.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | httpd-manual | 0 | 0:2.2.22-23.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | httpd-tools | 0 | 0:2.2.22-23.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | mod_cluster | 0 | 0:1.2.4-1.Final_redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | mod_cluster-demo | 0 | 0:1.2.4-1.Final_redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | mod_cluster-native | 0 | 0:1.2.4-1.Final.redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | mod_cluster-native-debuginfo | 0 | 0:1.2.4-1.Final.redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | mod_cluster-tomcat6 | 0 | 0:1.2.4-1.Final_redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | mod_cluster-tomcat7 | 0 | 0:1.2.4-1.Final_redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | mod_jk | 0 | 0:1.2.37-2.redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | mod_jk-ap22 | 0 | 0:1.2.37-2.redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | mod_jk-debuginfo | 0 | 0:1.2.37-2.redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | mod_jk-manual | 0 | 0:1.2.37-2.redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | mod_ssl | 0 | 1:2.2.22-23.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat-native | 0 | 0:1.1.27-4.redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat-native-debuginfo | 0 | 0:1.1.27-4.redhat_1.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat6 | 0 | 0:6.0.37-10_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat6-admin-webapps | 0 | 0:6.0.37-10_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat6-docs-webapp | 0 | 0:6.0.37-10_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat6-el-1.0-api | 0 | 0:6.0.37-10_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat6-javadoc | 0 | 0:6.0.37-10_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat6-jsp-2.1-api | 0 | 0:6.0.37-10_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat6-lib | 0 | 0:6.0.37-10_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat6-log4j | 0 | 0:6.0.37-10_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat6-servlet-2.5-api | 0 | 0:6.0.37-10_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat6-webapps | 0 | 0:6.0.37-10_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat7 | 0 | 0:7.0.40-5_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat7-admin-webapps | 0 | 0:7.0.40-5_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat7-docs-webapp | 0 | 0:7.0.40-5_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat7-el-1.0-api | 0 | 0:7.0.40-5_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat7-javadoc | 0 | 0:7.0.40-5_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat7-jsp-2.2-api | 0 | 0:7.0.40-5_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat7-lib | 0 | 0:7.0.40-5_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat7-log4j | 0 | 0:7.0.40-5_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat7-servlet-3.0-api | 0 | 0:7.0.40-5_patch_01.ep6.el6 |
| Red Hat:jboss_enterprise_web_server:2::el6 | tomcat7-webapps | 0 | 0:7.0.40-5_patch_01.ep6.el6 |
| Ubuntu:14.04:LTS | tomcat6 | 0 | 6.0.39-1 |
| maven | org.apache.tomcat/tomcat | 6.0.0 | 6.0.37 |
| maven | org.apache.tomcat/tomcat | 7.0.0 | 7.0.30 |
Related vulnerabilities
- CVE-2026-24733 Improper Input Validation vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-66614 Improper Input Validation vulnerability. Also affects org.apache.tomcat:tomcat
- GHSA-wmwf-9ccg-fff5 Apache Tomcat Vulnerable to Relative Path Traversal Also affects org.apache.tomcat:tomcat
- GHSA-vfww-5hm6-hx2j Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences Also affects org.apache.tomcat:tomcat
- CVE-2025-61795 Improper Resource Shutdown or Release vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-55752 Relative Path Traversal vulnerability in Apache Tomcat. Also affects org.apache.tomcat:tomcat
- CVE-2025-55754 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache… Also affects org.apache.tomcat:tomcat
- CVE-2025-49124 Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. Also affects org.apache.tomcat:tomcat