CVE-2009-0033
Apache Tomcat Denial of Service via Malformed Request Headers
EPSS 17.5%
Description
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.
How to fix CVE-2009-0033
No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.
- —no fix listed
Is CVE-2009-0033 being exploited?
Moderate — EPSS is 17.5%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (1)
- >= 4.1.0, <= 4.1.39