Skip to content
Fencer Intel
medium 5.0

CVE-2012-0022 json

Denial of Service in Apache Tomcat

published 2012-01-19 14 y ago modified 2026-06-16 4 mo ago also GHSA-8h2q-qm9x-55jc , EUVD-2022-3181

cvss
5.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
10.5%
EPSS 10.5% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.

Patch / fix

  • maven org.apache.tomcat:tomcat 5.5.35, 6.0.34, 7.0.23
  • tomcat6 jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el5
  • tomcat6 jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el6
  • tomcat6-lib jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el5
  • tomcat6-lib jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el6
  • tomcat6-log4j jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el5
  • tomcat6-log4j jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el6
  • tomcat6-javadoc jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el5
  • tomcat6-javadoc jboss enterprise web server 1 6.0.32-24_patch_07.ep5.el6

red hat advisories RHSA-2012:0682RHSA-2012:0076RHSA-2012:0074RHSA-2012:0680RHSA-2012:0475RHSA-2012:0474

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-0022 updated cvss 5.0

tomcat: large number of parameters DoS

  • Red Hat JBoss Communications Platform 5.1
    fixed: vendor fix RHSA-2012:0078
  • Red Hat JBoss Enterprise BRMS Platform 5.1
    fixed: vendor fix RHSA-2012:0325
  • Red Hat Enterprise Linux (v. 5 server) tomcat5 5.5.23-0jpp.31.el5_8, tomcat5-jasper 5.5.23-0jpp.31.el5_8, tomcat5-webapps 5.5.23-0jpp.31.el5_8, tomcat5-common-lib 5.5.23-0jpp.31.el5_8, tomcat5-server-lib 5.5.23-0jpp.31.el5_8, tomcat5-jsp-2.0-api 5.5.23-0jpp.31.el5_8, +5 more Red Hat Enterprise Linux Desktop (v. 5 client) tomcat5 5.5.23-0jpp.31.el5_8, tomcat5-jsp-2.0-api 5.5.23-0jpp.31.el5_8, tomcat5-servlet-2.4-api 5.5.23-0jpp.31.el5_8
    fixed: vendor fix RHSA-2012:0474
  • Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6 6.0.24-36.el6_2, tomcat6-lib 6.0.24-36.el6_2, tomcat6-javadoc 6.0.24-36.el6_2, tomcat6-webapps 6.0.24-36.el6_2, tomcat6-el-2.1-api 6.0.24-36.el6_2, tomcat6-docs-webapp 6.0.24-36.el6_2, +3 more Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6 6.0.24-36.el6_2, tomcat6-lib 6.0.24-36.el6_2, tomcat6-javadoc 6.0.24-36.el6_2, tomcat6-webapps 6.0.24-36.el6_2, tomcat6-el-2.1-api 6.0.24-36.el6_2, tomcat6-docs-webapp 6.0.24-36.el6_2, +3 more Red Hat Enterprise Linux Server (v. 6) tomcat6 6.0.24-36.el6_2, tomcat6-lib 6.0.24-36.el6_2, tomcat6-el-2.1-api 6.0.24-36.el6_2, tomcat6-jsp-2.1-api 6.0.24-36.el6_2, tomcat6-servlet-2.5-api 6.0.24-36.el6_2 Red Hat Enterprise Linux Server Optional (v. 6) tomcat6 6.0.24-36.el6_2, tomcat6-javadoc 6.0.24-36.el6_2, tomcat6-webapps 6.0.24-36.el6_2, tomcat6-docs-webapp 6.0.24-36.el6_2, tomcat6-admin-webapps 6.0.24-36.el6_2 Red Hat Enterprise Linux Workstation (v. 6) tomcat6 6.0.24-36.el6_2, tomcat6-lib 6.0.24-36.el6_2, tomcat6-el-2.1-api 6.0.24-36.el6_2, tomcat6-jsp-2.1-api 6.0.24-36.el6_2, tomcat6-servlet-2.5-api 6.0.24-36.el6_2 Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6 6.0.24-36.el6_2, tomcat6-javadoc 6.0.24-36.el6_2, tomcat6-webapps 6.0.24-36.el6_2, tomcat6-docs-webapp 6.0.24-36.el6_2, tomcat6-admin-webapps 6.0.24-36.el6_2
    fixed: vendor fix RHSA-2012:0475
  • Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 AS jbossweb 2.1.12-3_patch_03.2.ep5.el4, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el4, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 4 ES jbossweb 2.1.12-3_patch_03.2.ep5.el4, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el4, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el4 Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Server jbossweb 2.1.12-3_patch_03.2.ep5.el5, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el5, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el5, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el5, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el5 Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Server jbossweb 2.1.12-3_patch_03.2.ep5.el6, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el6, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el6, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el6, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el6
    fixed: vendor fix RHSA-2012:0074
  • Red Hat JBoss Enterprise Application Platform 5.1
    fixed: vendor fix RHSA-2012:0075
  • Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server tomcat5 5.5.33-27_patch_07.ep5.el5, tomcat6 6.0.32-24_patch_07.ep5.el5, tomcat6-lib 6.0.32-24_patch_07.ep5.el5, tomcat6-log4j 6.0.32-24_patch_07.ep5.el5, tomcat5-jasper 5.5.33-27_patch_07.ep5.el5, tomcat5-parent 5.5.33-27_patch_07.ep5.el5, +17 more Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server tomcat5 5.5.33-28_patch_07.ep5.el6, tomcat6 6.0.32-24_patch_07.ep5.el6, tomcat6-lib 6.0.32-24_patch_07.ep5.el6, tomcat6-log4j 6.0.32-24_patch_07.ep5.el6, tomcat5-jasper 5.5.33-28_patch_07.ep5.el6, tomcat5-parent 5.5.33-28_patch_07.ep5.el6, +17 more
    fixed: vendor fix RHSA-2012:0680
  • Red Hat JBoss Operations Network 3.1
    fixed: vendor fix RHSA-2012:1331
show 7 more
  • Red Hat JBoss Portal 4.3
    fixed: vendor fix RHSA-2012:0345
  • Red Hat JBoss Portal 5.2 Red Hat JBoss SOA Platform 5.2
    fixed: vendor fix RHSA-2012:0325
  • Red Hat JBoss Web Platform 5 for RHEL 5 Server jbossweb 2.1.12-3_patch_03.2.ep5.el5, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el5, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el5, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el5, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el5 Red Hat JBoss Web Platform 5 for RHEL 6 Server jbossweb 2.1.12-3_patch_03.2.ep5.el6, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el6, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el6, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el6, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el6
    fixed: vendor fix RHSA-2012:0076
  • Red Hat JBoss Web Platform 5.1
    fixed: vendor fix RHSA-2012:0077
  • Red Hat JBoss Web Server 1.0
    fixed: vendor fix RHSA-2012:0679
  • Red Hat RHEL Desktop Workstation (v. 5 client) tomcat5 5.5.23-0jpp.31.el5_8, tomcat5-jasper 5.5.23-0jpp.31.el5_8, tomcat5-webapps 5.5.23-0jpp.31.el5_8, tomcat5-common-lib 5.5.23-0jpp.31.el5_8, tomcat5-server-lib 5.5.23-0jpp.31.el5_8, tomcat5-admin-webapps 5.5.23-0jpp.31.el5_8, +3 more
    fixed: vendor fix RHSA-2012:0474
  • Red Hat JBoss Web Platform 5 for RHEL 4 AS jbossweb 2.1.12-3_patch_03.2.ep5.el4, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el4, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el4 Red Hat JBoss Web Platform 5 for RHEL 4 ES jbossweb 2.1.12-3_patch_03.2.ep5.el4, jbossweb-lib 2.1.12-3_patch_03.2.ep5.el4, jbossweb-el-1.0-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-jsp-2.1-api 2.1.12-3_patch_03.2.ep5.el4, jbossweb-servlet-2.5-api 2.1.12-3_patch_03.2.ep5.el4
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

10.48% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected packages

ecosystem package affected fixed in
maven org.apache.tomcat:tomcat
>=5.5.0, <5.5.35
>=6.0.0, <6.0.34
>=7.0.0, <7.0.23
5.5.35
6.0.34
7.0.23

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.