CVE-2013-4286Medium· 5.8▾ Sunlit

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incor…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score35/ 100 · Low

impact 31.9 · likelihood 3.2 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Feb 26, 2014

Updated

Oct 9, 2026

CVSS

5.8

Vendor

apache

Product

tomcat

CWE

CWE-20

Depth score

35 · Low

EPSS

16% · p97

Platforms

—

Source

NVD

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

CISA SSVC

decided 2026-10-09

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 9.

17% → 16%▼ 0.6%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 4608 days

Feb 26, 2014Published
Disclosed via NVD
Oct 9, 2026Record revised
Last analysed / modified upstream
Oct 9, 2026EPSS first tracked
17%

apache CWE-20 #nvd #cve.org

Affected

tomcat = 7.0.0
tomcat = 7.0.1
tomcat = 7.0.2
tomcat = 7.0.3
tomcat = 7.0.4
tomcat = 7.0.10
tomcat = 7.0.11
tomcat = 7.0.12
tomcat = 7.0.13
tomcat = 7.0.14
tomcat = 7.0.15
tomcat = 7.0.16
tomcat = 7.0.17
tomcat = 7.0.18
tomcat = 7.0.19
tomcat = 7.0.20
tomcat = 7.0.21
tomcat = 7.0.22
tomcat = 7.0.23
tomcat = 7.0.24
tomcat = 7.0.25
tomcat = 7.0.26
tomcat = 7.0.27
tomcat = 7.0.28
tomcat = 7.0.29
tomcat = 7.0.30
tomcat = 7.0.31
tomcat = 7.0.32
tomcat = 7.0.33
tomcat = 7.0.34
tomcat = 7.0.35
tomcat = 7.0.36
tomcat = 7.0.37
tomcat = 7.0.38
tomcat = 7.0.39
tomcat = 7.0.40
tomcat = 7.0.41
tomcat = 7.0.42
tomcat = 7.0.43
tomcat = 7.0.44
tomcat = 7.0.45
tomcat = 7.0.46
tomcat = 8.0.0
tomcat <= 6.0.37
tomcat = 1.1.3
tomcat = 3.0
tomcat = 3.1
tomcat = 3.1.1
tomcat = 3.2
tomcat = 3.2.1
tomcat = 3.2.2
tomcat = 3.2.3
tomcat = 3.2.4
tomcat = 3.3
tomcat = 3.3.1
tomcat = 3.3.1a
tomcat = 3.3.2
tomcat = 4
tomcat = 4.0.0
tomcat = 4.0.1
tomcat = 4.0.2
tomcat = 4.0.3
tomcat = 4.0.4
tomcat = 4.0.5
tomcat = 4.0.6
tomcat = 4.1.0
tomcat = 4.1.1
tomcat = 4.1.2
tomcat = 4.1.3
tomcat = 4.1.9
tomcat = 4.1.10
tomcat = 4.1.12
tomcat = 4.1.15
tomcat = 4.1.24
tomcat = 4.1.28
tomcat = 4.1.29
tomcat = 4.1.31
tomcat = 4.1.36
tomcat = 5
tomcat = 5.0.0
tomcat = 5.0.1
tomcat = 5.0.2
tomcat = 5.0.3
tomcat = 5.0.4
tomcat = 5.0.5
tomcat = 5.0.6
tomcat = 5.0.7
tomcat = 5.0.8
tomcat = 5.0.9
tomcat = 5.0.10
tomcat = 5.0.11
tomcat = 5.0.12
tomcat = 5.0.13
tomcat = 5.0.14
tomcat = 5.0.15
tomcat = 5.0.16
tomcat = 5.0.17
tomcat = 5.0.18
tomcat = 5.0.19
tomcat = 5.0.21

Full technical detail▾

Overview

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

Affected

tomcat = 7.0.0
tomcat = 7.0.1
tomcat = 7.0.2
tomcat = 7.0.3
tomcat = 7.0.4
tomcat = 7.0.10
tomcat = 7.0.11
tomcat = 7.0.12
tomcat = 7.0.13
tomcat = 7.0.14
tomcat = 7.0.15
tomcat = 7.0.16
tomcat = 7.0.17
tomcat = 7.0.18
tomcat = 7.0.19
tomcat = 7.0.20
tomcat = 7.0.21
tomcat = 7.0.22
tomcat = 7.0.23
tomcat = 7.0.24
tomcat = 7.0.25
tomcat = 7.0.26
tomcat = 7.0.27
tomcat = 7.0.28
tomcat = 7.0.29
tomcat = 7.0.30
tomcat = 7.0.31
tomcat = 7.0.32
tomcat = 7.0.33
tomcat = 7.0.34
tomcat = 7.0.35
tomcat = 7.0.36
tomcat = 7.0.37
tomcat = 7.0.38
tomcat = 7.0.39
tomcat = 7.0.40
tomcat = 7.0.41
tomcat = 7.0.42
tomcat = 7.0.43
tomcat = 7.0.44
tomcat = 7.0.45
tomcat = 7.0.46
tomcat = 8.0.0
tomcat <= 6.0.37
tomcat = 1.1.3
tomcat = 3.0
tomcat = 3.1
tomcat = 3.1.1
tomcat = 3.2
tomcat = 3.2.1
tomcat = 3.2.2
tomcat = 3.2.3
tomcat = 3.2.4
tomcat = 3.3
tomcat = 3.3.1
tomcat = 3.3.1a
tomcat = 3.3.2
tomcat = 4
tomcat = 4.0.0
tomcat = 4.0.1
tomcat = 4.0.2
tomcat = 4.0.3
tomcat = 4.0.4
tomcat = 4.0.5
tomcat = 4.0.6
tomcat = 4.1.0
tomcat = 4.1.1
tomcat = 4.1.2
tomcat = 4.1.3
tomcat = 4.1.9
tomcat = 4.1.10
tomcat = 4.1.12
tomcat = 4.1.15
tomcat = 4.1.24
tomcat = 4.1.28
tomcat = 4.1.29
tomcat = 4.1.31
tomcat = 4.1.36
tomcat = 5
tomcat = 5.0.0
tomcat = 5.0.1
tomcat = 5.0.2
tomcat = 5.0.3
tomcat = 5.0.4
tomcat = 5.0.5
tomcat = 5.0.6
tomcat = 5.0.7
tomcat = 5.0.8
tomcat = 5.0.9
tomcat = 5.0.10
tomcat = 5.0.11
tomcat = 5.0.12
tomcat = 5.0.13
tomcat = 5.0.14
tomcat = 5.0.15
tomcat = 5.0.16
tomcat = 5.0.17
tomcat = 5.0.18
tomcat = 5.0.19
tomcat = 5.0.21

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org