CVE-2013-4286: Apache Tomcat HTTP Request-Smuggling Vulnerability
Summary
CVE-2013-4286: Apache Tomcat is vulnerable to HTTP request-smuggling. Affects org.apache.tomcat:tomcat across 3 version ranges.
< 6.0.39
>= 7.0.0, < 7.0.47
>= 8.0.0-RC1, < 8.0.0-RC3
Fixed in 6.0.39, 7.0.47 or 8.0.0-RC3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications. However, versions before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3 are vulnerable to an HTTP request-smuggling attack. This vulnerability arises due to the improper handling of inconsistent HTTP request headers when using an HTTP connector or AJP connector. This can allow remote attackers to manipulate the request length and conduct request-smuggling attacks.
Vulnerability Detail
The vulnerability in Apache Tomcat allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks. This can be achieved through two methods: (1) by sending multiple Content-Length headers or (2) by sending a Content-Length header along with a "Transfer-Encoding: chunked" header. The incomplete fix for CVE-2005-2090 is responsible for this vulnerability. Successful exploitation of this vulnerability can lead to various security risks, including unauthorized access, data leakage, and potential compromise of the affected system.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 6.0.396.0.39 -
>= 7.0.0, < 7.0.477.0.47 -
>= 8.0.0-RC1, < 8.0.0-RC38.0.0-RC3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a possible workaround is to disable the affected connectors (HTTP or AJP) if they are not required for the application's functionality. This can be done by modifying the server configuration to remove or comment out the connector configuration. However, this workaround may impact the application's functionality and should be thoroughly tested before implementation.
Conclusion
The Apache Tomcat HTTP request-smuggling vulnerability (CVE-2013-4286) poses a significant security risk to affected systems. It is crucial to promptly upgrade to a fixed version of Apache Tomcat to mitigate the vulnerability. If immediate upgrade is not feasible, disabling the affected connectors can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that provides a platform for running Java-based web applications.
An HTTP request-smuggling attack is a technique used by attackers to manipulate the interpretation of HTTP requests by the server, leading to security vulnerabilities such as unauthorized access or data leakage.
This vulnerability can be exploited by sending specially crafted HTTP requests with inconsistent headers, tricking the server into misinterpreting the request length and potentially allowing unauthorized access or data leakage.
No, only versions before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3 are affected. It is recommended to upgrade to a fixed version to mitigate the vulnerability.
Yes, a possible workaround is to disable the affected connectors (HTTP or AJP) if they are not required for the application's functionality. However, this may impact the application's functionality and should be tested before implementation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
