CVE-2014-0075

What it actually does

Integer overflow in parseChunkHeader during chunked transfer encoding parsing allows remote attackers to trigger excessive resource consumption leading to denial of service.

Why it matters to the business

Web servers and applications using affected Tomcat versions can experience unplanned downtime and degraded performance from crafted requests, increasing operational costs and disrupting user access.

How an attack unfolds

An attacker crafts an HTTP request using chunked transfer coding with a malformed chunk size value that triggers an integer overflow in the header parser, causing the server to allocate excessive resources while processing the stream.

How to fix it

Upgrade Apache Tomcat to version 6.0.40 or later, 7.0.53 or later, or 8.0.4 or later. Apply vendor patches promptly and validate configurations to reject malformed chunked requests at the network or application layer if immediate upgrade is not feasible.

How to confirm the fix worked

Verify installed Tomcat version against fixed releases, review server logs for parsing errors on chunked requests, and test with controlled malformed chunk size payloads in a non-production environment to confirm the overflow condition is resolved.

Typical attack path

1. Identify a Tomcat server accepting HTTP requests
2. Construct a request with Transfer-Encoding: chunked header
3. Supply a chunk size value designed to overflow the integer parser
4. Stream the request data to force resource exhaustion
5. Repeat or sustain requests to maintain denial of service

How to detect it

Review Tomcat access and error logs for anomalous chunk sizes or repeated parsing failures during HTTP streaming; correlate with network traffic showing chunked encoding requests from untrusted sources.

What your security team should do

• Prioritize upgrade of all Tomcat instances to the fixed versions listed in remediation guidance
• Implement web application firewall rules to sanitize or drop suspicious chunked encoding requests
• Monitor EPSS score and any new exploit maturity indicators for increased urgency
• Conduct asset inventory to identify all downstream dependents relying on affected Tomcat versions