Skip to content
Fencer Vulns
medium 5.3

CVE-2023-45648 json

Apache Tomcat: Trailer header parsing too lenient

published 2023-10-10 3 y ago modified 2026-09-08 2 mo ago also BIT-tomcat-2023-45648 , EUVD-2023-2799 , GHSA-r6j3-px5g-cq3x

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
5.9%
EPSS 5.9% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known, plus a Nuclei check

Summary

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

Older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.

Patch / fix

  • maven org.apache.tomcat:tomcat 8.5.94, 9.0.81, 10.1.14, 11.0.0-M12
  • maven org.apache.tomcat.embed:tomcat-embed-core 8.5.94, 9.0.81, 10.1.14, 11.0.0-M12
  • maven org.apache.tomcat:tomcat-coyote 8.5.94, 9.0.81, 10.1.14, 11.0.0-M12
  • bitnami tomcat 8.5.94, 9.0.81, 10.1.14
  • apache tomcat 8.5.94, 9.0.81, 10.1.14
  • tomcat9 Debian 14, Debian 13, Debian 12 9.0.70-2
  • tomcat10 Debian 12 10.1.6-1+deb12u1
  • tomcat10 Debian 14, Debian 13 10.1.14-1

debian advisories DEBIAN-CVE-2023-45648

  • tomcat9 Ubuntu 20.04 LTS 9.0.31-1ubuntu0.8
  • tomcat9 Ubuntu 25.10 9.0.70-2ubuntu3
  • tomcat8 Ubuntu Pro 18.04 LTS 8.5.39-1ubuntu1~18.04.3+esm5
  • tomcat9 Ubuntu Pro 18.04 LTS 9.0.16-3ubuntu0.18.04.2+esm4
  • tomcat9 Ubuntu Pro 22.04 LTS 9.0.58-1ubuntu0.1+esm4
  • tomcat9 Ubuntu Pro 24.04 LTS 9.0.70-2ubuntu0.1+esm2

ubuntu advisories UBUNTU-CVE-2023-45648

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • tomcat RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-lib RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-webapps RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-el-5.0-api RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-docs-webapp RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-jsp-3.1-api RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-admin-webapps RHEL 10.0 1:10.1.36-1.el10_0
  • tomcat-servlet-6.0-api RHEL 10.0 1:10.1.36-1.el10_0

red hat advisories RHSA-2025:7497RHSA-2024:0474RHSA-2024:0125RHSA-2023:6206RHSA-2024:3814

  • tomcat SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +11 more 9.0.85-150200.57.1
  • tomcat SLES for SAP 12 SP5, SLES 12 SP5 9.0.36-3.111.1
  • tomcat SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 9.0.36-150100.4.98.1

suse advisories SUSE-SU-2024:0472-1SUSE-SU-2023:4423-1SUSE-SU-2023:4337-1

  • tomcat openSUSE Tumbleweed 9.0.82-2.1

opensuse advisories openSUSE-SU-2024:13382-1

  • tomcat AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-lib AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-webapps AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-el-3.0-api AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-docs-webapp AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-jsp-2.3-api AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-admin-webapps AlmaLinux 9 1:9.0.62-37.el9_3.1
  • tomcat-servlet-4.0-api AlmaLinux 9 1:9.0.62-37.el9_3.1

almalinux advisories ALSA-2024:0474ALSA-2024:0125

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-45648 updated cvss 5.3

tomcat: incorrectly parsed http trailer headers can cause request smuggling

  • Red Hat build of Apache Camel for Spring Boot 3 tomcat Red Hat build of OptaPlanner 8 tomcat
    affected: workaround, no fix planned “No mitigation is currently available for this flaw.”
  • Red Hat Decision Manager 7 tomcat
    affected: workaround, no fix available “No mitigation is currently available for this flaw.”
  • Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more Red Hat Enterprise Linux 8 pki-servlet-engine, pki-servlet-4.0-api, pki-servlet-container Red Hat Enterprise Linux 9 pki-servlet-engine, pki-servlet-4.0-api Red Hat Integration Camel K 1 tomcat Red Hat JBoss Enterprise Application Platform 6 tomcat
    affected: workaround, no fix planned “No mitigation is currently available for this flaw.”
  • Red Hat OpenShift Application Runtimes tomcat
    affected: workaround, no fix available “No mitigation is currently available for this flaw.”
  • Red Hat Process Automation 7 tomcat Red Hat streams for Apache Kafka tomcat
    affected: workaround, no fix planned “No mitigation is currently available for this flaw.”
  • Red Hat Enterprise Linux AppStream (v. 8) tomcat 9.0.62-27.el8_9.2, tomcat-lib 9.0.62-27.el8_9.2, tomcat-webapps 9.0.62-27.el8_9.2, tomcat-el-3.0-api 9.0.62-27.el8_9.2, tomcat-docs-webapp 9.0.62-27.el8_9.2, tomcat-jsp-2.3-api 9.0.62-27.el8_9.2, +2 more
    fixed: vendor fix “No mitigation is currently available for this flaw.” RHSA-2024:0125
  • Red Hat Enterprise Linux AppStream (v. 9) tomcat 9.0.62-37.el9_3.1, tomcat-lib 9.0.62-37.el9_3.1, tomcat-webapps 9.0.62-37.el9_3.1, tomcat-el-3.0-api 9.0.62-37.el9_3.1, tomcat-docs-webapp 9.0.62-37.el9_3.1, tomcat-jsp-2.3-api 9.0.62-37.el9_3.1, +2 more
    fixed: vendor fix “No mitigation is currently available for this flaw.” RHSA-2024:0474
  • Red Hat Enterprise Linux AppStream (v. 10) tomcat 10.1.36-1.el10_0, tomcat-lib 10.1.36-1.el10_0, tomcat-webapps 10.1.36-1.el10_0, tomcat-el-5.0-api 10.1.36-1.el10_0, tomcat-docs-webapp 10.1.36-1.el10_0, tomcat-jsp-3.1-api 10.1.36-1.el10_0, +2 more
    fixed: vendor fix “No mitigation is currently available for this flaw.” RHSA-2025:7497
show 6 more
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) tomcat 9.0.87-1.el8_8.2, tomcat-lib 9.0.87-1.el8_8.2, tomcat-webapps 9.0.87-1.el8_8.2, tomcat-el-3.0-api 9.0.87-1.el8_8.2, tomcat-docs-webapp 9.0.87-1.el8_8.2, tomcat-jsp-2.3-api 9.0.87-1.el8_8.2, +2 more
    fixed: vendor fix “No mitigation is currently available for this flaw.” RHSA-2024:3814
  • Red Hat Fuse 7.12.1
    fixed: vendor fix “No mitigation is currently available for this flaw.” RHSA-2023:7247
  • Red Hat JBoss Web Server 5
    fixed: vendor fix “No mitigation is currently available for this flaw.” RHSA-2023:6207
  • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat 9.0.62-18.redhat_00016.1.el7jws, jws5-tomcat-lib 9.0.62-18.redhat_00016.1.el7jws, jws5-tomcat-javadoc 9.0.62-18.redhat_00016.1.el7jws, jws5-tomcat-selinux 9.0.62-18.redhat_00016.1.el7jws, jws5-tomcat-webapps 9.0.62-18.redhat_00016.1.el7jws, jws5-tomcat-java-jdk8 9.0.62-18.redhat_00016.1.el7jws, +6 more Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat 9.0.62-18.redhat_00016.1.el8jws, jws5-tomcat-lib 9.0.62-18.redhat_00016.1.el8jws, jws5-tomcat-javadoc 9.0.62-18.redhat_00016.1.el8jws, jws5-tomcat-selinux 9.0.62-18.redhat_00016.1.el8jws, jws5-tomcat-webapps 9.0.62-18.redhat_00016.1.el8jws, jws5-tomcat-el-3.0-api 9.0.62-18.redhat_00016.1.el8jws, +4 more Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat 9.0.62-18.redhat_00016.1.el9jws, jws5-tomcat-lib 9.0.62-18.redhat_00016.1.el9jws, jws5-tomcat-javadoc 9.0.62-18.redhat_00016.1.el9jws, jws5-tomcat-selinux 9.0.62-18.redhat_00016.1.el9jws, jws5-tomcat-webapps 9.0.62-18.redhat_00016.1.el9jws, jws5-tomcat-el-3.0-api 9.0.62-18.redhat_00016.1.el9jws, +4 more
    fixed: vendor fix “No mitigation is currently available for this flaw.” RHSA-2023:6206
  • Red Hat OpenShift Dev Spaces 3 devspaces/server-rhel8 3.15-3
    fixed: vendor fix “No mitigation is currently available for this flaw.” RHSA-2024:4631
  • Red Hat A-MQ Clients 2 tomcat Red Hat AMQ Broker 7 tomcat Red Hat Data Grid 8 tomcat Red Hat JBoss Data Grid 7 tomcat Red Hat JBoss Enterprise Application Platform 7 tomcat Red Hat JBoss Enterprise Application Platform 8 tomcat
    +4 more products
    Red Hat JBoss Enterprise Application Platform Expansion Pack tomcat Red Hat JBoss Web Server 6 tomcat Red Hat OpenShift Dev Spaces 3 devspaces/udi-rhel8 3.15-5, devspaces/code-rhel8 3.15-4, devspaces/idea-rhel8 3.15-5, devspaces/traefik-rhel8 3.15-2, devspaces/dashboard-rhel8 3.15-6, devspaces/configbump-rhel8 3.15-2, +6 more Red Hat Single Sign-On 7 tomcat
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
16 mo ago

Exploit prediction

5.88% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
OSV 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.apache.tomcat:tomcat
>=11.0.0-M1, <11.0.0-M12
>=10.1.0-M1, <10.1.14
>=9.0.0-M1, <9.0.81
>=8.5.0, <8.5.94
11.0.0-M12
10.1.14
9.0.81
8.5.94
maven org.apache.tomcat.embed:tomcat-embed-core
>=11.0.0-M1, <11.0.0-M12
>=10.1.0-M1, <10.1.14
>=9.0.0-M1, <9.0.81
>=8.5.0, <8.5.94
11.0.0-M12
10.1.14
9.0.81
8.5.94
maven org.apache.tomcat:tomcat-coyote
>=11.0.0-M1, <11.0.0-M12
>=10.1.0-M1, <10.1.14
>=9.0.0-M1, <9.0.81
>=8.5.0, <8.5.94
11.0.0-M12
10.1.14
9.0.81
8.5.94
bitnami tomcat
>=8.5.0, <8.5.94
>=9.0.1, <9.0.81
>=10.1.1, <10.1.14
8.5.94
9.0.81
10.1.14

Affected products

  • Apache Software Foundation Apache Tomcat
  • apache tomcat

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.