CVE-2014-0075Medium· 5.0▾ TwilightPoC available

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of servi…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 27.5 · likelihood 3.5 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

May 31, 2014

Updated

Oct 14, 2026

CVSS

5.0

Vendor

apache

Product

tomcat

CWE

CWE-189

Depth score

43 · Moderate

EPSS

18% · p97

Platforms

—

Source

NVD

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-10-27

GitHub PoCs

1 public repository

LiviuPtr/CVE-2014-0075_PoC ↗

CISA SSVC

decided 2026-10-14

Exploitation: none
Automatable: yes
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 14.

20% → 18%▼ 2.5%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 4533 days

May 31, 2014Published
Disclosed via NVD
Oct 14, 2026Record revised
Last analysed / modified upstream
Oct 14, 2026EPSS first tracked
20%
Oct 27, 2026Public exploit observed
1 GitHub repo (last check)

apache CWE-189 #nvd #exploit-available #cve.org

Affected

tomcat = 7.0.0
tomcat = 7.0.1
tomcat = 7.0.2
tomcat = 7.0.3
tomcat = 7.0.4
tomcat = 7.0.5
tomcat = 7.0.6
tomcat = 7.0.7
tomcat = 7.0.8
tomcat = 7.0.9
tomcat = 7.0.10
tomcat = 7.0.11
tomcat = 7.0.12
tomcat = 7.0.13
tomcat = 7.0.14
tomcat = 7.0.15
tomcat = 7.0.16
tomcat = 7.0.17
tomcat = 7.0.18
tomcat = 7.0.19
tomcat = 7.0.20
tomcat = 7.0.21
tomcat = 7.0.22
tomcat = 7.0.23
tomcat = 7.0.24
tomcat = 7.0.25
tomcat = 7.0.26
tomcat = 7.0.27
tomcat = 7.0.28
tomcat = 7.0.29
tomcat = 7.0.30
tomcat = 7.0.31
tomcat = 7.0.32
tomcat = 7.0.33
tomcat = 7.0.34
tomcat = 7.0.35
tomcat = 7.0.36
tomcat = 7.0.37
tomcat = 7.0.38
tomcat = 7.0.39
tomcat = 7.0.40
tomcat = 7.0.41
tomcat = 7.0.42
tomcat = 7.0.43
tomcat = 7.0.44
tomcat = 7.0.45
tomcat = 7.0.46
tomcat = 7.0.47
tomcat = 7.0.48
tomcat = 7.0.49
tomcat = 7.0.50
tomcat = 7.0.52
tomcat = 8.0.0
tomcat = 8.0.1
tomcat = 8.0.3
tomcat <= 6.0.39
tomcat = 6
tomcat = 6.0
tomcat = 6.0.0
tomcat = 6.0.1
tomcat = 6.0.2
tomcat = 6.0.3
tomcat = 6.0.4
tomcat = 6.0.5
tomcat = 6.0.6
tomcat = 6.0.7
tomcat = 6.0.8
tomcat = 6.0.9
tomcat = 6.0.10
tomcat = 6.0.11
tomcat = 6.0.12
tomcat = 6.0.13
tomcat = 6.0.14
tomcat = 6.0.15
tomcat = 6.0.16
tomcat = 6.0.17
tomcat = 6.0.18
tomcat = 6.0.19
tomcat = 6.0.20
tomcat = 6.0.24
tomcat = 6.0.26
tomcat = 6.0.27
tomcat = 6.0.28
tomcat = 6.0.29
tomcat = 6.0.30
tomcat = 6.0.31
tomcat = 6.0.32
tomcat = 6.0.33
tomcat = 6.0.35
tomcat = 6.0.36
tomcat = 6.0.37

Full technical detail▾

Overview

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

Affected

tomcat = 7.0.0
tomcat = 7.0.1
tomcat = 7.0.2
tomcat = 7.0.3
tomcat = 7.0.4
tomcat = 7.0.5
tomcat = 7.0.6
tomcat = 7.0.7
tomcat = 7.0.8
tomcat = 7.0.9
tomcat = 7.0.10
tomcat = 7.0.11
tomcat = 7.0.12
tomcat = 7.0.13
tomcat = 7.0.14
tomcat = 7.0.15
tomcat = 7.0.16
tomcat = 7.0.17
tomcat = 7.0.18
tomcat = 7.0.19
tomcat = 7.0.20
tomcat = 7.0.21
tomcat = 7.0.22
tomcat = 7.0.23
tomcat = 7.0.24
tomcat = 7.0.25
tomcat = 7.0.26
tomcat = 7.0.27
tomcat = 7.0.28
tomcat = 7.0.29
tomcat = 7.0.30
tomcat = 7.0.31
tomcat = 7.0.32
tomcat = 7.0.33
tomcat = 7.0.34
tomcat = 7.0.35
tomcat = 7.0.36
tomcat = 7.0.37
tomcat = 7.0.38
tomcat = 7.0.39
tomcat = 7.0.40
tomcat = 7.0.41
tomcat = 7.0.42
tomcat = 7.0.43
tomcat = 7.0.44
tomcat = 7.0.45
tomcat = 7.0.46
tomcat = 7.0.47
tomcat = 7.0.48
tomcat = 7.0.49
tomcat = 7.0.50
tomcat = 7.0.52
tomcat = 8.0.0
tomcat = 8.0.1
tomcat = 8.0.3
tomcat <= 6.0.39
tomcat = 6
tomcat = 6.0
tomcat = 6.0.0
tomcat = 6.0.1
tomcat = 6.0.2
tomcat = 6.0.3
tomcat = 6.0.4
tomcat = 6.0.5
tomcat = 6.0.6
tomcat = 6.0.7
tomcat = 6.0.8
tomcat = 6.0.9
tomcat = 6.0.10
tomcat = 6.0.11
tomcat = 6.0.12
tomcat = 6.0.13
tomcat = 6.0.14
tomcat = 6.0.15
tomcat = 6.0.16
tomcat = 6.0.17
tomcat = 6.0.18
tomcat = 6.0.19
tomcat = 6.0.20
tomcat = 6.0.24
tomcat = 6.0.26
tomcat = 6.0.27
tomcat = 6.0.28
tomcat = 6.0.29
tomcat = 6.0.30
tomcat = 6.0.31
tomcat = 6.0.32
tomcat = 6.0.33
tomcat = 6.0.35
tomcat = 6.0.36
tomcat = 6.0.37

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#exploit-available#cve.org