Fixed in Apache Tomcat 7.0.8

Note: The issue below was fixed in Apache Tomcat 7.0.7 but the release vote for the 7.0.7 release candidate did not pass. Therefore, although users must download 7.0.8 to obtain a version that includes a fix for this issue, version 7.0.7 is not included in the list of affected versions.

Important: Remote Denial Of Service CVE-2011-0534

The NIO connector expands its buffer endlessly during request line processing. That behaviour can be used for a denial of service attack using a carefully crafted request.

This was fixed in revision 1065939.

This was identified by the Tomcat security team on 27 Jan 2011 and made public on 5 Feb 2011.

Affects: 7.0.0-7.0.6