CVE-2019-17569: Potential HTTP request smuggling in Apache Tomcat
Summary
CVE-2019-17569: Potential HTTP request smuggling in Apache Tomcat. Affects org.apache.tomcat.embed:tomcat-embed-core across 3 version ranges.
>= 7.0.98, < 7.0.100
>= 8.5.48, < 8.5.51
>= 9.0.28, < 9.0.31
Fixed in 7.0.100, 8.5.51 or 9.0.31, depending on the release line you run. How to fix ↓
Also tracked for
- tomcat9 · Debian:11
The same CVE-2019-17569 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and efficient platform for running Java web applications, handling HTTP requests, and serving web content. However, versions 7.0.98 to 7.0.99, 8.5.48 to 8.5.50, and 9.0.28 to 9.0.30 of Apache Tomcat introduced a regression that resulted in incorrect processing of invalid Transfer-Encoding headers. This regression created a potential vulnerability for HTTP Request Smuggling attacks when Tomcat is located behind a reverse proxy that mishandles the invalid Transfer-Encoding header in a specific manner. Although the likelihood of such a reverse proxy is considered low, it is important to address this vulnerability to ensure the security of Apache Tomcat deployments.
Vulnerability Detail
The regression introduced in Apache Tomcat versions 7.0.98 to 7.0.99, 8.5.48 to 8.5.50, and 9.0.28 to 9.0.30 led to the incorrect processing of invalid Transfer-Encoding headers. This vulnerability could potentially be exploited for HTTP Request Smuggling attacks. An attacker could send specially crafted requests to the affected Tomcat server through a reverse proxy that mishandles the invalid Transfer-Encoding header. This could lead to the smuggling of malicious requests, bypassing security measures and potentially resulting in unauthorized access, data leakage, or other malicious activities. The severity of this vulnerability is rated as MODERATE with a CVSS score of 4.8.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 7.0.98, < 7.0.1007.0.100 -
>= 8.5.48, < 8.5.518.5.51 -
>= 9.0.28, < 9.0.319.0.31
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Apache Tomcat is not immediately feasible, a possible workaround is to ensure that the reverse proxy in front of Tomcat correctly handles the invalid Transfer-Encoding header. This can be achieved by configuring the reverse proxy to reject or ignore requests with invalid Transfer-Encoding headers. Consult the documentation or support resources for the specific reverse proxy software being used to implement this workaround.
Conclusion
The potential HTTP request smuggling vulnerability in Apache Tomcat versions 7.0.98 to 7.0.99, 8.5.48 to 8.5.50, and 9.0.28 to 9.0.30 can be mitigated by upgrading to the latest secure versions of Apache Tomcat or by implementing a workaround with the reverse proxy. It is crucial to address this vulnerability to prevent potential unauthorized access, data leakage, or other malicious activities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat.embed:tomcat-embed-core →
FAQ
Apache Tomcat is an open-source web server and servlet container that provides a platform for running Java-based web applications.
HTTP Request Smuggling is a web application vulnerability that allows an attacker to manipulate the way HTTP requests are interpreted by a server or proxy, potentially bypassing security measures and gaining unauthorized access or performing malicious activities.
The vulnerability in Apache Tomcat occurs due to a regression introduced in versions 7.0.98 to 7.0.99, 8.5.48 to 8.5.50, and 9.0.28 to 9.0.30. This regression leads to incorrect processing of invalid Transfer-Encoding headers, which can be exploited for HTTP Request Smuggling attacks.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 4.8.
To mitigate the risk of HTTP Request Smuggling in Apache Tomcat, it is recommended to upgrade to versions 7.0.100, 8.5.51, or 9.0.31 or later. Additionally, ensuring that the reverse proxy in front of Tomcat correctly handles the invalid Transfer-Encoding header can provide an additional layer of protection.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat.embed:tomcat-embed-core.
