Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows rem

Summary

Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.

Timeline

1. Jun 1, 2013, 10:00 AM UTCCVE published
2. Oct 9, 2026, 7:06 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 9, 2026, 7:07 PM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• org.apache.tomcat:tomcatMaven

  From 6.0.0 · fixed in 6.0.37

• org.apache.tomcat:tomcatMaven

  From 7.0.0 · fixed in 7.0.30

References 21