The vulnerability in the implementation of the `rejectIllegalHeader` attribute in the Apache Tomcat application server allows a attacker to send hidden HTTP requests (HTTP Request Smuggling attack).

Tomcat rejectIllegalHeader implementation flaw enables HTTP Request Smuggling through Content-Length header handling.

Reporter	Title	Published	Views	Family All 200
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge 8.0.0.24 addresses multiple vulnerabilities by updating Apache Tomcat Server	31 Oct 202315:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Tomcat, Apache Commons FileUpload and Apache Axis might affect IBM Storage Copy Data Management	22 Mar 202416:05	–	ibm
IBM Security Bulletins	Security Bulletin: Apache Tomcat is vulnerable to HTTP request smuggling (CVE-2022-42252)	19 Dec 202219:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Build is affected by CVE-2022-42252	20 Dec 202207:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	26 Mar 202503:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerability in Apache Tomcat	7 Nov 202407:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Release is affected by CVE-2022-42252	20 Jan 202316:11	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.9 addresses multiple security vulnerabilities.	18 Jul 202313:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Engineering Requirements Management DOORS/DWA vulnerabilities addressed in 9.7.2.8	18 Oct 202407:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including remote code execution in Apache Commons Text 1.9	8 Dec 202204:10	–	ibm

Vulners

Node

apache tomcatRange10.1.0-m1–10.1.1

apache tomcatRange10.0.0-m1–10.0.27

apache tomcatRange9.0.0-m1–9.0.68

apache tomcatRange8.5.0–8.5.53

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-42252
lists	www.lists.apache.org/thread/zzcxzvqfdqn515zfs3dxb7n8gty589sq
access	www.access.redhat.com/security/cve/cve-2022-42252
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.8/
abf	www.abf.rosalinux.ru/advisories/ROSA-SA-2023-2258
altsp	www.altsp.su/obnovleniya-bezopasnosti/
web	www.web.nvd.nist.gov/view/vuln/detail

29 Jul 2025 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 37.5

CVSS 27.8

EPSS0.0029