Patchfirst
Patchfirst
ChainApache TomcatMaven:org.apache.tomcat:tomcat

Apache Tomcat: incomplete fixes (2011–2023)

8 CVEs over 4 generations, 10 Feb 2011 to 10 Oct 2023.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2011-053410 Feb 2011 First in the chain
  2. CVE-2012-35441 Jun 2013 No direct link to an earlier CVE
  3. CVE-2013-432226 Feb 2014 incomplete fix for CVE-2012-3544
  4. CVE-2014-007531 May 2014 No direct link to an earlier CVE
  5. CVE-2014-022716 Feb 2015 related to CVE-2013-4322related to CVE-2014-0075
  6. CVE-2016-681620 Mar 2017 related to CVE-2011-0534
  7. CVE-2022-422521 Nov 2022 related to CVE-2016-6816
  8. CVE-2023-4564810 Oct 2023 related to CVE-2014-0227related to CVE-2016-6816and 1 more
20112012201320142015201620172018202020222023 CVE-2012-3544 → CVE-2013-4322: incomplete fix (high confidence)CVE-2011-0534 → CVE-2016-6816: related (medium confidence)CVE-2013-4322 → CVE-2014-0227: related (medium confidence)CVE-2014-0075 → CVE-2014-0227: related (medium confidence)CVE-2014-0227 → CVE-2023-45648: related (medium confidence)CVE-2016-6816 → CVE-2022-42252: related (medium confidence)CVE-2016-6816 → CVE-2023-45648: related (medium confidence)CVE-2022-42252 → CVE-2023-45648: related (medium confidence) CVE-2011-0534 10 Feb 2011 CVE-2012-3544 1 Jun 2013 CVE-2013-4322 26 Feb 2014 CVE-2014-0075 31 May 2014 CVE-2014-0227 16 Feb 2015 CVE-2016-6816 20 Mar 2017 CVE-2022-42252 1 Nov 2022 CVE-2023-45648 10 Oct 2023 2011201220132014201520162017201820192020202120222023 CVE-2012-3544 → CVE-2013-4322: incomplete fix (high confidence)CVE-2011-0534 → CVE-2016-6816: related (medium confidence)CVE-2013-4322 → CVE-2014-0227: related (medium confidence)CVE-2014-0075 → CVE-2014-0227: related (medium confidence)CVE-2014-0227 → CVE-2023-45648: related (medium confidence)CVE-2016-6816 → CVE-2022-42252: related (medium confidence)CVE-2016-6816 → CVE-2023-45648: related (medium confidence)CVE-2022-42252 → CVE-2023-45648: related (medium confidence) CVE-2011-0534 10 Feb 2011 CVE-2012-3544 1 Jun 2013 CVE-2013-4322 26 Feb 2014 CVE-2014-0075 31 May 2014 CVE-2014-0227 16 Feb 2015 CVE-2016-6816 20 Mar 2017 CVE-2022-42252 1 Nov 2022 CVE-2023-45648 10 Oct 2023
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2011-0534 10 Feb 2011 Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests… · fixed in 7.0.8 First in chain 18.9
CVE-2012-3544 1 Jun 2013 Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer… First in chain 19.2
CVE-2013-4322 26 Feb 2014 Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without… · fixed in 8.0.0-RC10 CVE-2012-3544 · incomplete fix · High 24.1
CVE-2014-0075 31 May 2014 Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in… · fixed in 8.0.4 First in chain 24.4
CVE-2014-0227 16 Feb 2015 java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55… · fixed in 8.0.9 CVE-2013-4322 · related · Medium 19.5
CVE-2016-6816 20 Mar 2017 The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to… · fixed in 9.0.0.M12 CVE-2011-0534 · related · Medium 24.7
CVE-2022-42252 1 Nov 2022 Apache Tomcat request smuggling via malformed content-length · fixed in 10.1.1 CVE-2016-6816 · related · Medium 20.9
CVE-2023-45648 10 Oct 2023 Apache Tomcat: Trailer header parsing too lenient · fixed in 11.0.0-M12 CVE-2014-0227 · related · Medium 27.4
↑ ↓ chooseEnter openEsc close