CVE-2011-0534

Published: Feb 10, 2011Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.

Affected (34)

Products: Apache: Tomcat

1 product

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 7.0.0
Apache Tomcat	Version 7.0.1
Apache Tomcat	Version 7.0.2
Apache Tomcat	Version 7.0.3
Apache Tomcat	Version 7.0.4
Apache Tomcat	Version 7.0.5
Apache Tomcat	Version 7.0.6

Configuration B

27 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat	Version 6.0.0
Apache Tomcat	Version 6.0.10
Apache Tomcat	Version 6.0.11
Apache Tomcat	Version 6.0.12
Apache Tomcat	Version 6.0.13
Apache Tomcat	Version 6.0.14
Apache Tomcat	Version 6.0.15
Apache Tomcat	Version 6.0.16
Apache Tomcat	Version 6.0.17
Apache Tomcat	Version 6.0.18
Apache Tomcat	Version 6.0.19
Apache Tomcat	Version 6.0.1
Apache Tomcat	Version 6.0.20
Apache Tomcat	Version 6.0.24
Apache Tomcat	Version 6.0.26
Apache Tomcat	Version 6.0.27
Apache Tomcat	Version 6.0.28
Apache Tomcat	Version 6.0.29
Apache Tomcat	Version 6.0.2
Apache Tomcat	Version 6.0.30
Apache Tomcat	Version 6.0.3
Apache Tomcat	Version 6.0.4
Apache Tomcat	Version 6.0.5
Apache Tomcat	Version 6.0.6
Apache Tomcat	Version 6.0.7
Apache Tomcat	Version 6.0.8
Apache Tomcat	Version 6.0.9

Related CWEs

References (36)

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=139344343412337&w=2

Source: secalert@redhat.com

http://osvdb.org/70809

Source: secalert@redhat.com

http://secunia.com/advisories/43192

Source: secalert@redhat.com

http://secunia.com/advisories/45022

Source: secalert@redhat.com

http://secunia.com/advisories/57126

Source: secalert@redhat.com

http://securityreason.com/securityalert/8074

Source: secalert@redhat.com

http://support.apple.com/kb/HT5002

Source: secalert@redhat.com

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html

Source: secalert@redhat.com

http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.32

Source: secalert@redhat.com

PatchVendor Advisory

http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.8_%28released_5_Feb_2011%29

Source: secalert@redhat.com

http://www.debian.org/security/2011/dsa-2160

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/516214/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/46164

Source: secalert@redhat.com

http://www.securitytracker.com/id?1025027

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0293

Source: secalert@redhat.com

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/65162

Source: secalert@redhat.com

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=139344343412337&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/70809

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/43192

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/45022

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57126

Source: af854a3a-2127-422b-91ae-364da2661108

http://securityreason.com/securityalert/8074

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT5002

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098550.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.32

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.8_%28released_5_Feb_2011%29

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2011/dsa-2160

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/516214/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/46164

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1025027

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0293

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/65162

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.