VULNERABILITY INTELLIGENCE
CVE-2019-17569
CVSS score4.8 MEDIUM
EPSS probability8.87%
CISA KEVNot currently listed
Published2020-02-24
Last modified2026-08-25
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Description
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Weakness classification
- CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Primary references
- security@apache.org — Mailing List, Third Party Advisory
- security@apache.org
- security@apache.org — Mailing List, Vendor Advisory
- security@apache.org
- security@apache.org — Mailing List, Third Party Advisory
- security@apache.org — Third Party Advisory
- security@apache.org — Third Party Advisory
- security@apache.org — Third Party Advisory
- security@apache.org — Patch, Third Party Advisory
- security@apache.org — Patch, Third Party Advisory
- security@apache.org — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory