CVE Feed

Dashboard / CVE / CVE-2010-2227

CVE-2010-2227

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."

Published:Jul 8, 2010

Last Modified:Apr 11, 2025

EPS:Jul 13, 2010

EPSS Score:0.64738

CVSS Score:6.4

Affected Products

Vendor

Product

Action

Vendor

Apache

Product

Tomcat

Apache

Tomcat

Vendor

Redhat

Product

Certificate System

Redhat

Certificate System

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Vendor

Redhat

Product

Jboss Enterprise Application Platform

Redhat

Jboss Enterprise Application Platform

Vendor

Redhat

Product

Jboss Enterprise Web Server

Redhat

Jboss Enterprise Web Server

Vendor

Redhat

Product

Rhel Application Server

Redhat

Rhel Application Server

Vendor

Redhat

Product

Rhel Developer Suite

Redhat

Rhel Developer Suite

Exploits

No exploit reference

Common Weakness Enumeration

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-10 Buffer Overflow via Environment Variables

CAPEC-100 Overflow Buffers

CAPEC-123 Buffer Manipulation

CAPEC-14 Client-side Injection-induced Buffer Overflow

CAPEC-24 Filter Failure through Buffer Overflow

CAPEC-42 MIME Conversion

CAPEC-44 Overflow Binary Resource File

CAPEC-45 Buffer Overflow via Symbolic Links

CAPEC-46 Overflow Variables and Tags

CAPEC-47 Buffer Overflow via Parameter Expansion

CAPEC-8 Buffer Overflow in an API Call

CAPEC-9 Buffer Overflow in Local Command-Line Utilities

Related CVEs

CVE-2026-73180 (CVSS 6.8) — Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticat…

CVE-2026-68763 (CVSS 7.5) — Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog …

CVE-2026-68569 (CVSS 8.1) — Improper Authentication vulnerability in Apache Tomcat meant that in some circumstances (e.g. CLIENT-CERT, SPN…

CVE-2026-68525 (CVSS 9.1) — Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a…

CVE-2026-66422 (CVSS 8.1) — Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly…

CVE-2026-65927 (CVSS 7.5) — Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite pr…

CVE-2026-65905 (CVSS 9.8) — Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before wind…

CVE-2026-65637 (CVSS 9.8) — Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This iss…

CVE-2026-65183 (CVSS 8.1) — Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain soc…

CVE-2026-65182 (CVSS 9.1) — Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint b…

References

http://geronimo.apache.org/21x-security-report.html

http://geronimo.apache.org/22x-security-report.html

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050207.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050214.html

http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html

http://marc.info/?l=bugtraq&m=129070310906557&w=2

http://marc.info/?l=bugtraq&m=136485229118404&w=2

http://marc.info/?l=bugtraq&m=139344343412337&w=2

http://secunia.com/advisories/40813

http://secunia.com/advisories/41025

http://secunia.com/advisories/42079

http://secunia.com/advisories/42368

http://secunia.com/advisories/42454

http://secunia.com/advisories/43310

http://secunia.com/advisories/44183

http://secunia.com/advisories/57126

http://securitytracker.com/id?1024180

http://support.apple.com/kb/HT5002

http://svn.apache.org/viewvc?view=revision&revision=958911

http://svn.apache.org/viewvc?view=revision&revision=958977

http://svn.apache.org/viewvc?view=revision&revision=959428

http://tomcat.apache.org/security-5.html

http://tomcat.apache.org/security-6.html

http://tomcat.apache.org/security-7.html

http://www.debian.org/security/2011/dsa-2207

http://www.mandriva.com/security/advisories?name=MDVSA-2010:176

http://www.mandriva.com/security/advisories?name=MDVSA-2010:177

http://www.novell.com/support/viewContent.do?externalId=7007274

http://www.novell.com/support/viewContent.do?externalId=7007275

http://www.redhat.com/support/errata/RHSA-2010-0580.html

http://www.redhat.com/support/errata/RHSA-2010-0581.html

http://www.redhat.com/support/errata/RHSA-2010-0582.html

http://www.redhat.com/support/errata/RHSA-2010-0583.html

http://www.securityfocus.com/archive/1/512272/100/0/threaded

http://www.securityfocus.com/archive/1/516397/100/0/threaded

http://www.securityfocus.com/bid/41544

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

http://www.vupen.com/english/advisories/2010/1986

http://www.vupen.com/english/advisories/2010/2868

http://www.vupen.com/english/advisories/2010/3056

https://exchange.xforce.ibmcloud.com/vulnerabilities/60264

https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18532

http://geronimo.apache.org/21x-security-report.html

http://geronimo.apache.org/22x-security-report.html

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050207.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050214.html

http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html

http://marc.info/?l=bugtraq&m=129070310906557&w=2

http://marc.info/?l=bugtraq&m=136485229118404&w=2

http://marc.info/?l=bugtraq&m=139344343412337&w=2

http://secunia.com/advisories/40813

http://secunia.com/advisories/41025

http://secunia.com/advisories/42079

http://secunia.com/advisories/42368

http://secunia.com/advisories/42454

http://secunia.com/advisories/43310

http://secunia.com/advisories/44183

http://secunia.com/advisories/57126

http://securitytracker.com/id?1024180

http://support.apple.com/kb/HT5002

http://svn.apache.org/viewvc?view=revision&revision=958911

http://svn.apache.org/viewvc?view=revision&revision=958977

http://svn.apache.org/viewvc?view=revision&revision=959428

http://tomcat.apache.org/security-5.html

http://tomcat.apache.org/security-6.html

http://tomcat.apache.org/security-7.html

http://www.debian.org/security/2011/dsa-2207

http://www.mandriva.com/security/advisories?name=MDVSA-2010:176

http://www.mandriva.com/security/advisories?name=MDVSA-2010:177

http://www.novell.com/support/viewContent.do?externalId=7007274

http://www.novell.com/support/viewContent.do?externalId=7007275

http://www.redhat.com/support/errata/RHSA-2010-0580.html

http://www.redhat.com/support/errata/RHSA-2010-0581.html

http://www.redhat.com/support/errata/RHSA-2010-0582.html

http://www.redhat.com/support/errata/RHSA-2010-0583.html

http://www.securityfocus.com/archive/1/512272/100/0/threaded

http://www.securityfocus.com/archive/1/516397/100/0/threaded

http://www.securityfocus.com/bid/41544

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

http://www.vupen.com/english/advisories/2010/1986

http://www.vupen.com/english/advisories/2010/2868

http://www.vupen.com/english/advisories/2010/3056

https://exchange.xforce.ibmcloud.com/vulnerabilities/60264

https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18532

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High