CVE-2012-0022: Denial of Service in Apache Tomcat
Summary
CVE-2012-0022: Denial of Service in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 5.5.0, < 5.5.35
>= 6.0.0, < 6.0.34
>= 7.0.0, < 7.0.23
Fixed in 5.5.35, 6.0.34 or 7.0.23, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is used to serve Java-based web applications. It provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications. The vulnerability identified as CVE-2012-0022 affects Apache Tomcat versions 5.5.x, 6.x, and 7.x. This vulnerability allows remote attackers to cause a denial of service (CPU consumption) by sending a request that contains a large number of parameters and parameter values. This vulnerability is different from CVE-2011-4858.
Vulnerability Detail
The vulnerability in Apache Tomcat arises from an inefficient approach to handling parameters. When a request with numerous parameters and parameter values is received, the server consumes excessive CPU resources, leading to a denial of service condition. This vulnerability can be exploited remotely, allowing an attacker to disrupt the normal functioning of the server. It is important to note that this vulnerability is distinct from CVE-2011-4858, even though they both result in a denial of service.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 5.5.355.5.35 -
>= 6.0.0, < 6.0.346.0.34 -
>= 7.0.0, < 7.0.237.0.23
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to upgrade to the fixed version of Apache Tomcat as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability identified as CVE-2012-0022 in Apache Tomcat can lead to a denial of service condition by consuming excessive CPU resources. It is crucial to upgrade to the fixed version of Apache Tomcat to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that provides a Java Servlet and JavaServer Pages (JSP) environment for running web applications.
This vulnerability allows remote attackers to cause a denial of service (CPU consumption) by sending a request with a large number of parameters and parameter values. It can disrupt the normal functioning of the server.
No, this vulnerability is different from CVE-2011-4858, although both result in a denial of service. They have separate origins and technical aspects.
To fix this vulnerability, upgrade to the fixed version of Apache Tomcat: 5.5.35 for 5.5.x, 6.0.34 for 6.x, and 7.0.23 for 7.x.
No specific workaround is provided for this vulnerability. Upgrading to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
