CVE-2002-2272

Published: Dec 31, 2002Modified: Apr 16, 2026

7.8

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability: 10.0 / Impact: 6.9

Source: NVD

Description

Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.

Affected (36)

Products: Apache: Http Server, Tomcat

Apache

2 products

Http Server

Tomcat

Configuration A

36 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	Version 1.3.0
Apache Http Server	Version 1.3.10
Apache Http Server	Version 1.3.11
Apache Http Server	Version 1.3.12
Apache Http Server	Version 1.3.13
Apache Http Server	Version 1.3.14
Apache Http Server	Version 1.3.15
Apache Http Server	Version 1.3.16
Apache Http Server	Version 1.3.17
Apache Http Server	Version 1.3.18
Apache Http Server	Version 1.3.19
Apache Http Server	Version 1.3.1
Apache Http Server	Version 1.3.20
Apache Http Server	Version 1.3.22
Apache Http Server	Version 1.3.23
Apache Http Server	Version 1.3.24
Apache Http Server	Version 1.3.25
Apache Http Server	Version 1.3.26
Apache Http Server	Version 1.3.27
Apache Http Server	Version 1.3.2
Apache Http Server	Version 1.3
Apache Tomcat	Version 4.0.0
Apache Tomcat	Version 4.0.1
Apache Tomcat	Version 4.0.2
Apache Tomcat	Version 4.0.3
Apache Tomcat	Version 4.0.4
Apache Tomcat	Version 4.0.5
Apache Tomcat	Version 4.0.6
Apache Tomcat	Version 4.1.0
Apache Tomcat	Version 4.1.10
Apache Tomcat	Version 4.1.12
Apache Tomcat	Version 4.1.1
Apache Tomcat	Version 4.1.2
Apache Tomcat	Version 4.1.3
Apache Tomcat	Version 4.1.3 beta
Apache Tomcat	Version 4.1.9 beta