The vulnerability of the Apache Tomcat application server, related to the inconsistent interpretation of HTTP requests, allows attackers to compromise the integrity of the protected information.

🗓️ 15 Feb 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Tomcat HTTP request interpretation vulnerability allows attackers to compromise integrity of protected information.

Reporter	Title	Published	Views	Family All 241
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities (CVE-2023-46589)	5 Mar 202408:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Bus is vulnerable to HTTP request smuggling and a denial of service due to Apache Tomcat. (CVE-2023-46589, CVE-2023-42794)	3 Jan 202414:43	–	ibm
IBM Security Bulletins	Security Bulletin: due to the use of Apache Tomcat, IBM webMethods developer portal is affected by Multiple Vulnerabilities	30 Sep 202510:47	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of Apache Tomcat, App Connect Professional is vulnerable to HTTP request smuggling.	16 Feb 202413:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.5 fixes multiple security vulnerabilities	26 Mar 202503:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Release 7.0.0.1 addresses multiple vulnerabilities.	27 Mar 202417:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) may be vulnerable to HTTP request smuggling (CVE-2023-46589)	5 Feb 202413:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling B2B Integrator Document Service container vulnerable to multiple issues due to Apache Tomcat	11 Apr 202413:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Build 7.0.0.1 addresses multiple vulnerabilities.	27 Mar 202417:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities (CVE-2023-46589)	11 Sep 202410:22	–	ibm

Vulners

Node

apache tomcatRange11.0.0-m1–11.0.0-m10

apache tomcatRange10.1.0-m1–10.1.15

apache tomcatRange9.0.0-m1–9.0.82

apache tomcatRange8.5.0–8.5.95

axiom_jdk libercat_certifiedRange<9.0.88-2

axiom_jdk libercat_certifiedRange<10.1.20-2

Source	Link
lists	www.lists.apache.org/thread/0rqq6ktozqc42ro8hhxdmmdjm1k1tpxr
lists	www.lists.debian.org/debian-lts-announce/2024/01/msg00001.html
security	www.security.netapp.com/advisory/ntap-20231214-0009/
openwall	www.openwall.com/lists/oss-security/2023/11/28/2
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.11/
abf	www.abf.rosa.ru/advisories/ROSA-SA-2024-2544
altsp	www.altsp.su/obnovleniya-bezopasnosti/
web	www.web.nvd.nist.gov/view/vuln/detail

22 Aug 2025 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 37.5

CVSS 27.8

EPSS0.02651