CVE-2013-4322

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS

9.10% chance of exploitation in the next 30 days, 95th percentile

Published

2014-02-26

Updated

2026-10-09

Proof-of-concept exploits (1)

• LiviuPtr/CVE-2013-4322_PoC0★ · 2026-01-18

Security advisories

• http://tomcat.apache.org/security-6.html
• http://tomcat.apache.org/security-7.html
• http://tomcat.apache.org/security-8.html
• advisories/GHSA-wq2p-q66w-q8gp
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:052
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:084
• http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
• http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
• http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
• http://www.securityfocus.com/bid/65767
• http://www.ubuntu.com/usn/USN-2130-1
• http://www.vmware.com/security/advisories/VMSA-2014-0008.html
• http://www.vmware.com/security/advisories/VMSA-2014-0012.html

References

• CVE Record
• NVD entry

Related

• CVE-2014-0075