QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2022-42252

Back to search

CVE-2022-42252

Published: Nov 1, 2022

Modified: May 6, 2025

PUBLISHED

Description

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

VendorProductVersions

Apache Software Foundation

Apache Tomcat

affected
10.1.0-M1 - <= 10.1.0
affected
10.0.0-M1 - <= 10.0.26
affected
9.0.0-M1 - <= 9.0.67
affected
8.5.0 - <= 8.5.82

Weaknesses (CWE)

CWE-444

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now