high 7.5

CVE-2022-42252 json

Apache Tomcat request smuggling via malformed content-length

published 2022-11-01 4 y ago modified 2026-09-08 2 mo ago also BIT-tomcat-2022-42252 , EUVD-2022-7390 , GHSA-p22x-g9px-3945

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits: 0; none known

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

Patch / fix

fixed in 4 distros 5 links 4

maven org.apache.tomcat.embed:tomcat-embed-core 8.5.83, 9.0.68, 10.0.27, 10.1.1
maven org.apache.tomcat:tomcat-coyote 9.0.68, 10.0.27, 10.1.1
bitnami tomcat 8.5.83, 9.0.68, 10.0.27, 10.1.1
apache tomcat 8.5.83, 9.0.68, 10.0.27, 10.1.1

debian ubuntu red hat suse opensuse

tomcat9 Debian 14, Debian 13, Debian 12 9.0.68-1

debian advisories DEBIAN-CVE-2022-42252

tomcat9 Ubuntu 20.04 LTS 9.0.31-1ubuntu0.5
tomcat8 Ubuntu Pro 18.04 LTS 8.5.39-1ubuntu1~18.04.3+esm1
tomcat9 Ubuntu Pro 18.04 LTS 9.0.16-3ubuntu0.18.04.2+esm1
tomcat9 Ubuntu Pro 22.04 LTS 9.0.58-1ubuntu0.1+esm1

ubuntu advisories UBUNTU-CVE-2022-42252

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

jws5-tomcat jboss enterprise web server 5.7 9.0.62-13.redhat_00011.1.el7jws
jws5-tomcat jboss enterprise web server 5.7 9.0.62-13.redhat_00011.1.el8jws
jws5-tomcat jboss enterprise web server 5.7 9.0.62-13.redhat_00011.1.el9jws
jws5-tomcat-lib jboss enterprise web server 5.7 9.0.62-13.redhat_00011.1.el7jws
jws5-tomcat-lib jboss enterprise web server 5.7 9.0.62-13.redhat_00011.1.el8jws
jws5-tomcat-lib jboss enterprise web server 5.7 9.0.62-13.redhat_00011.1.el9jws
jws5-tomcat-javadoc jboss enterprise web server 5.7 9.0.62-13.redhat_00011.1.el7jws
jws5-tomcat-javadoc jboss enterprise web server 5.7 9.0.62-13.redhat_00011.1.el8jws

red hat advisories RHSA-2023:1663

tomcat SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 9.0.36-3.93.1
tomcat SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +3 more 9.0.36-150100.4.81.1
tomcat SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 9.0.36-150000.3.101.2
tomcat SLES 12 SP3-BCL, SLES 12 SP2-BCL 8.0.53-29.57.1
tomcat SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 9.0.115-3.160.1

suse advisories SUSE-SU-2026:1058-1 SUSE-SU-2022:4303-1 SUSE-SU-2022:4257-1 SUSE-SU-2022:4221-1 SUSE-SU-2022:4193-1

tomcat openSUSE Tumbleweed 9.0.43-11.1
tomcat10 openSUSE Tumbleweed 10.1.14-1.1

opensuse advisories openSUSE-SU-2024:12534-1 openSUSE-SU-2024:13441-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-42252 updated 2026-11-06 cvss 4.8

tomcat: request smuggling

Red Hat JBoss Web Server 3 tomcat, tomcat7 tomcat7, tomcat8 tomcat8
affected: no fix planned “Out of support scope”
Red Hat JBoss Web Server 5
fixed: vendor fix RHSA-2023:1664
Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat 9.0.62-13.redhat_00011.1.el7jws, jws5-tomcat-lib 9.0.62-13.redhat_00011.1.el7jws, jws5-tomcat-javadoc 9.0.62-13.redhat_00011.1.el7jws, jws5-tomcat-selinux 9.0.62-13.redhat_00011.1.el7jws, jws5-tomcat-webapps 9.0.62-13.redhat_00011.1.el7jws, jws5-tomcat-java-jdk8 9.0.62-13.redhat_00011.1.el7jws, +6 more Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat 9.0.62-13.redhat_00011.1.el8jws, jws5-tomcat-lib 9.0.62-13.redhat_00011.1.el8jws, jws5-tomcat-javadoc 9.0.62-13.redhat_00011.1.el8jws, jws5-tomcat-selinux 9.0.62-13.redhat_00011.1.el8jws, jws5-tomcat-webapps 9.0.62-13.redhat_00011.1.el8jws, jws5-tomcat-el-3.0-api 9.0.62-13.redhat_00011.1.el8jws, +4 more Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat 9.0.62-13.redhat_00011.1.el9jws, jws5-tomcat-lib 9.0.62-13.redhat_00011.1.el9jws, jws5-tomcat-javadoc 9.0.62-13.redhat_00011.1.el9jws, jws5-tomcat-selinux 9.0.62-13.redhat_00011.1.el9jws, jws5-tomcat-webapps 9.0.62-13.redhat_00011.1.el9jws, jws5-tomcat-el-3.0-api 9.0.62-13.redhat_00011.1.el9jws, +4 more
fixed: vendor fix RHSA-2023:1663
Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 more Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more Red Hat Enterprise Linux 8 tomcat, tomcat-lib, tomcat-webapps, tomcat-el-3.0-api, pki-servlet-engine, tomcat-docs-webapp, +4 more Red Hat Enterprise Linux 9 tomcat, tomcat-lib, tomcat-webapps, tomcat-el-3.0-api, pki-servlet-engine, tomcat-docs-webapp, +4 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 18 mo ago (2025-05-06)

Exploit prediction

1.78% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.apache.tomcat.embed:tomcat-embed-core	>=8.5.0, <8.5.83 >=9.0.0-M1, <9.0.68 >=10.0.0-M1, <10.0.27 >=10.1.0-M1, <10.1.1	8.5.83 9.0.68 10.0.27 10.1.1
maven	org.apache.tomcat:tomcat-coyote	>=9.0.0-M1, <9.0.68 >=10.0.0-M1, <10.0.27 >=10.1.0-M1, <10.1.1	9.0.68 10.0.27 10.1.1
bitnami	tomcat	>=8.5.0, <8.5.83 >=9.0.0, <9.0.68 >=10.0.0, <10.0.27 >=10.1.0, <10.1.1	8.5.83 9.0.68 10.0.27 10.1.1

Affected products

Apache Software Foundation Apache Tomcat

Classification

Weakness

CWE-444 Inconsistent Interpretation of HTTP Requests
CWE-20 Improper Input Validation

References

github.com /apache/tomcat/commit/0d089a15047faf9cb3c82f80f4d28febd4798920
web
github.com /apache/tomcat/commit/4c7f4fd09d2cc1692112ef70b8ee23a7a037ae77
web
github.com /apache/tomcat/commit/a1c07906d8dcaf7957e5cc97f5cdbac7d18a205a
web
github.com /apache/tomcat/commit/c9fe754e5d17e262dfbd3eab2a03ca96ff372dc3
web
lists.apache.org /thread/zzcxzvqfdqn515zfs3dxb7n8gty589sq
web, mailing-list, vendor-advisory, advisory
security.gentoo.org /glsa/202305-37
web
nvd.nist.gov /vuln/detail/CVE-2022-42252
advisory, web
github.com /apache/tomcat
package
tomcat.apache.org /security-10.html
web
tomcat.apache.org /security-8.html
web
tomcat.apache.org /security-9.html
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary