CVE-2011-4858: Improper Input Validation in Apache Tomcat
Summary
CVE-2011-4858: Improper Input Validation in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 5.5.0, < 5.5.35
>= 6.0.0, < 6.0.35
>= 7.0.0, < 7.0.23
Fixed in 5.5.35, 6.0.35 or 7.0.23, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. Apache Tomcat is widely used and has a large user base. However, it is vulnerable to an improper input validation vulnerability.
Vulnerability Detail
The vulnerability in Apache Tomcat allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. This vulnerability exists because Apache Tomcat computes hash values for form parameters without restricting the ability to trigger hash collisions predictably. By sending a large number of specially crafted parameters, an attacker can cause the server to consume excessive CPU resources, leading to a denial of service condition. This vulnerability has a moderate severity rating.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.355.5.35 -
>= 6.0.0, < 6.0.356.0.35 -
>= 7.0.0, < 7.0.237.0.23
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix by upgrading to a patched version of Apache Tomcat.
Conclusion
The improper input validation vulnerability in Apache Tomcat can be mitigated by upgrading to a patched version of the software. It is recommended to update to Apache Tomcat version 5.5.35, 6.0.35, or 7.0.23 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that is used to deploy Java-based web applications.
This vulnerability allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, leading to a server outage or performance degradation.
To fix this vulnerability, it is recommended to upgrade to Apache Tomcat version 5.5.35, 6.0.35, or 7.0.23 or later.
There is no known workaround for this vulnerability. It is recommended to apply the official fix by upgrading to a patched version of Apache Tomcat.
This vulnerability has a moderate severity rating.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
