GHSA-f2gq-p6qv-ccw4 CVE-2005-2090

Tomcat Vulnerable to Web Cache Poisoning

Medium Maven

Severity: Medium; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): 26.11%; Chance of exploitation in the next 30 days. Higher than 97.99% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: None yet; No fixed version published

Description

Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

Affected versions

Maven

Package	Vulnerable	Fixed in
org.apache.tomcat:tomcat	`>= 5.0.0, <= 5.0.19`	No fix yet
org.apache.tomcat:tomcat	`>= 4.0.0, <= 4.1.24`	No fix yet

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2005-2090

Timeline

May 1, 2022 Published
Nov 8, 2023 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-69r9-qgr7-g2wj Apache Tomcat Missing Encryption of Sensitive Data vulnerability	High Known exploited	Also affects org.apache.tomcat:tomcat
GHSA-h3x4-894j-xpx5 Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability	Critical	Also affects org.apache.tomcat:tomcat
GHSA-9xv2-5v5q-p794 Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability	Critical	Also affects org.apache.tomcat:tomcat
GHSA-gcx9-497g-6cp6 Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability	Critical	Also affects org.apache.tomcat:tomcat
GHSA-5m62-pw8w-7w9f Apache Tomcat - Security constraints not correctly applied	Critical	Also affects org.apache.tomcat:tomcat
GHSA-9m89-8frq-c98c Apache Tomcat - AJP secret compared in non-constant time	Low	Also affects org.apache.tomcat:tomcat
GHSA-5mp6-jrq3-r938 Apache Tomcat: LockOutRealm treats user names as case-sensitive	High	Also affects org.apache.tomcat:tomcat
GHSA-h6fc-48rj-7qqh Apache Tomcat - Digest authenticator will authenticate any unknown user	Critical	Also affects org.apache.tomcat:tomcat

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor