Skip to content
Fencer Intel
medium 6.4

CVE-2014-0227 json

Improper Input Validation in Apache Tomcat

published 2015-02-16 11 y ago modified 2026-10-14 26 d ago also GHSA-42j3-498q-m6vp , EUVD-2022-2270

cvss
6.4
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
21.0%
EPSS 21.0% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.

Patch / fix

  • maven org.apache.tomcat:tomcat 6.0.42, 7.0.55, 8.0.9
  • tomcat6 Ubuntu 14.04 LTS 6.0.39-1ubuntu0.1
  • tomcat6 Ubuntu 16.04 LTS 6.0.45+dfsg-1
  • tomcat7 Ubuntu 14.04 LTS 7.0.52-1ubuntu0.3

ubuntu advisories UBUNTU-CVE-2014-0227

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ecj3 jboss enterprise web server 2 1:3.7.2-9.redhat_3.1.ep6.el5
  • httpd jboss enterprise web server 2, jboss enterprise application platform 6 2.2.26-35.ep6.el5
  • mod_jk jboss enterprise web server 2, jboss enterprise application platform 6 1.2.40-2.redhat_1.ep6.el5
  • mod_rt jboss enterprise web server 2 2.4.1-6.GA.ep6.el5
  • mod_ssl jboss enterprise web server 2, jboss enterprise application platform 6 1:2.2.26-35.ep6.el5
  • tomcat6 jboss enterprise web server 2 6.0.41-6_patch_02.ep6.el5
  • tomcat7 jboss enterprise web server 2 7.0.54-6_patch_02.ep6.el5
  • mod_snmp jboss enterprise web server 2 2.4.1-13.GA.ep6.el5

red hat advisories RHSA-2014:1088RHSA-2014:1087RHSA-2015:0991RHSA-2015:0983RHSA-2014:1020RHSA-2014:1019

  • tomcat6 SLES for SAP 11 SP4, SLES 11 SP4 6.0.41-0.47.1

suse advisories SUSE-SU-2015:1565-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-0227 updated cvss 4.3

Tomcat/JBossWeb: request smuggling and limited DoS in ChunkedInputFilter

  • Red Hat BPM Suite 6 jbossweb jbossweb
    affected: no fix available
  • Red Hat Enterprise Linux 5 tomcat5
    affected: no fix planned “Will not fix”
  • Red Hat JBoss BRMS 6 jbossweb jbossweb Red Hat JBoss Data Grid 6 jbossweb jbossweb Red Hat JBoss Data Virtualization 6 jbossweb jbossweb
    affected: no fix available
  • Red Hat JBoss Enterprise Application Platform 5 jbossweb jbossweb Red Hat JBoss Enterprise Web Server 1 tomcat6, tomcat5 tomcat5
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Fuse Service Works 6 jbossweb jbossweb Red Hat JBoss Operations Network 3 jbossweb jbossweb Red Hat JBoss Portal 6 jbossweb jbossweb
    affected: no fix available
  • Red Hat Enterprise Linux Client (v. 7) tomcat 7.0.54-2.el7_1, tomcat-servlet-3.0-api 7.0.54-2.el7_1 Red Hat Enterprise Linux Client Optional (v. 7) tomcat 7.0.54-2.el7_1, tomcat-lib 7.0.54-2.el7_1, tomcat-jsvc 7.0.54-2.el7_1, tomcat-javadoc 7.0.54-2.el7_1, tomcat-webapps 7.0.54-2.el7_1, tomcat-el-2.2-api 7.0.54-2.el7_1, +3 more Red Hat Enterprise Linux ComputeNode (v. 7) tomcat 7.0.54-2.el7_1, tomcat-servlet-3.0-api 7.0.54-2.el7_1 Red Hat Enterprise Linux ComputeNode Optional (v. 7) tomcat 7.0.54-2.el7_1, tomcat-lib 7.0.54-2.el7_1, tomcat-jsvc 7.0.54-2.el7_1, tomcat-javadoc 7.0.54-2.el7_1, tomcat-webapps 7.0.54-2.el7_1, tomcat-el-2.2-api 7.0.54-2.el7_1, +3 more
    fixed: vendor fix RHSA-2015:0983
  • Red Hat Enterprise Linux Desktop (v. 6) tomcat6 6.0.24-83.el6_6, tomcat6-lib 6.0.24-83.el6_6, tomcat6-javadoc 6.0.24-83.el6_6, tomcat6-webapps 6.0.24-83.el6_6, tomcat6-el-2.1-api 6.0.24-83.el6_6, tomcat6-docs-webapp 6.0.24-83.el6_6, +3 more Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6 6.0.24-83.el6_6, tomcat6-lib 6.0.24-83.el6_6, tomcat6-javadoc 6.0.24-83.el6_6, tomcat6-webapps 6.0.24-83.el6_6, tomcat6-el-2.1-api 6.0.24-83.el6_6, tomcat6-docs-webapp 6.0.24-83.el6_6, +3 more Red Hat Enterprise Linux HPC Node (v. 6) tomcat6 6.0.24-83.el6_6, tomcat6-lib 6.0.24-83.el6_6, tomcat6-javadoc 6.0.24-83.el6_6, tomcat6-webapps 6.0.24-83.el6_6, tomcat6-el-2.1-api 6.0.24-83.el6_6, tomcat6-docs-webapp 6.0.24-83.el6_6, +3 more Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6 6.0.24-83.el6_6, tomcat6-lib 6.0.24-83.el6_6, tomcat6-javadoc 6.0.24-83.el6_6, tomcat6-webapps 6.0.24-83.el6_6, tomcat6-el-2.1-api 6.0.24-83.el6_6, tomcat6-docs-webapp 6.0.24-83.el6_6, +3 more Red Hat Enterprise Linux Server (v. 6) tomcat6 6.0.24-83.el6_6, tomcat6-lib 6.0.24-83.el6_6, tomcat6-javadoc 6.0.24-83.el6_6, tomcat6-webapps 6.0.24-83.el6_6, tomcat6-el-2.1-api 6.0.24-83.el6_6, tomcat6-docs-webapp 6.0.24-83.el6_6, +3 more
    fixed: vendor fix RHSA-2015:0991
  • Red Hat Enterprise Linux Server (v. 7) tomcat 7.0.54-2.el7_1, tomcat 7.0.54-2.ael7b_1, tomcat-lib 7.0.54-2.el7_1, tomcat-lib 7.0.54-2.ael7b_1, tomcat-webapps 7.0.54-2.el7_1, tomcat-webapps 7.0.54-2.ael7b_1, +8 more
    fixed: vendor fix RHSA-2015:0983
show 20 more
  • Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-javadoc 6.0.24-83.el6_6, tomcat6-webapps 6.0.24-83.el6_6, tomcat6-docs-webapp 6.0.24-83.el6_6, tomcat6-admin-webapps 6.0.24-83.el6_6
    fixed: vendor fix RHSA-2015:0991
  • Red Hat Enterprise Linux Server Optional (v. 7) tomcat 7.0.54-2.el7_1, tomcat-lib 7.0.54-2.el7_1, tomcat-jsvc 7.0.54-2.el7_1, tomcat-jsvc 7.0.54-2.ael7b_1, tomcat-javadoc 7.0.54-2.el7_1, tomcat-webapps 7.0.54-2.el7_1, +6 more
    fixed: vendor fix RHSA-2015:0983
  • Red Hat Enterprise Linux Workstation (v. 6) tomcat6 6.0.24-83.el6_6, tomcat6-lib 6.0.24-83.el6_6, tomcat6-javadoc 6.0.24-83.el6_6, tomcat6-webapps 6.0.24-83.el6_6, tomcat6-el-2.1-api 6.0.24-83.el6_6, tomcat6-docs-webapp 6.0.24-83.el6_6, +3 more
    fixed: vendor fix RHSA-2015:0991
  • Red Hat Enterprise Linux Workstation (v. 7) tomcat 7.0.54-2.el7_1, tomcat-lib 7.0.54-2.el7_1, tomcat-webapps 7.0.54-2.el7_1, tomcat-el-2.2-api 7.0.54-2.el7_1, tomcat-jsp-2.2-api 7.0.54-2.el7_1, tomcat-admin-webapps 7.0.54-2.el7_1, +1 more
    fixed: vendor fix RHSA-2015:0983
  • Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-javadoc 6.0.24-83.el6_6, tomcat6-webapps 6.0.24-83.el6_6, tomcat6-docs-webapp 6.0.24-83.el6_6, tomcat6-admin-webapps 6.0.24-83.el6_6
    fixed: vendor fix RHSA-2015:0991
  • Red Hat Enterprise Linux Workstation Optional (v. 7) tomcat-jsvc 7.0.54-2.el7_1, tomcat-javadoc 7.0.54-2.el7_1, tomcat-docs-webapp 7.0.54-2.el7_1
    fixed: vendor fix RHSA-2015:0983
  • Red Hat JBoss BPMS 6.0
    fixed: vendor fix RHSA-2015:0234
  • Red Hat JBoss BRMS 6.0
    fixed: vendor fix RHSA-2015:0235
  • Red Hat JBoss Data Grid 6.4
    fixed: vendor fix RHSA-2015:0091
  • Red Hat JBoss Data Virtualization 6.0
    fixed: vendor fix RHSA-2015:0765
  • Red Hat JBoss Data Virtualization 6.1
    fixed: vendor fix RHSA-2015:0675
  • Red Hat JBoss Enterprise Application Platform 6 for RHEL 5 Server httpd 2.2.26-35.ep6.el5, mod_rt 2.4.1-3.GA.ep6.el5, mod_ssl 2.2.26-35.ep6.el5, mod_snmp 2.4.1-7.GA.ep6.el5, httpd-tools 2.2.26-35.ep6.el5, httpd-manual 2.2.26-35.ep6.el5, +184 more
    fixed: vendor fix RHSA-2014:1019
  • Red Hat JBoss Enterprise Application Platform 6 for RHEL 6 Server httpd 2.2.26-35.ep6.el6, mod_rt 2.4.1-5.GA.ep6.el6, mod_ssl 2.2.26-35.ep6.el6, mod_snmp 2.4.1-8.GA.ep6.el6, httpd-tools 2.2.26-35.ep6.el6, httpd-manual 2.2.26-35.ep6.el6, +184 more
    fixed: vendor fix RHSA-2014:1020
  • Red Hat JBoss Enterprise Application Platform 6.3
    fixed: vendor fix RHSA-2014:1021
  • Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server httpd 2.2.26-35.ep6.el5, mod_rt 2.4.1-6.GA.ep6.el5, mod_ssl 2.2.26-35.ep6.el5, mod_snmp 2.4.1-13.GA.ep6.el5, httpd-tools 2.2.26-35.ep6.el5, httpd-manual 2.2.26-35.ep6.el5, +48 more
    fixed: vendor fix RHSA-2014:1088
  • Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server httpd 2.2.26-35.ep6.el6, mod_rt 2.4.1-6.GA.ep6.el6, mod_ssl 2.2.26-35.ep6.el6, mod_snmp 2.4.1-13.GA.ep6.el6, httpd-tools 2.2.26-35.ep6.el6, httpd-manual 2.2.26-35.ep6.el6, +50 more
    fixed: vendor fix RHSA-2014:1087
  • Red Hat JBoss Fuse Service Works 6.0
    fixed: vendor fix RHSA-2015:0720
  • Red Hat JBoss Operations Network 3.3
    fixed: vendor fix RHSA-2014:1904
  • Red Hat JBoss Portal 6.2
    fixed: vendor fix RHSA-2015:1009
  • Red Hat JBoss Web Server 2.1
    fixed: vendor fix RHSA-2014:1086

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
26 d ago

Exploit prediction

21.04% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P

Affected packages

ecosystem package affected fixed in
maven org.apache.tomcat:tomcat
>=6.0.0, <6.0.42
>=7.0.0, <7.0.55
>=8.0.0, <8.0.9
6.0.42
7.0.55
8.0.9

Classification

Weakness
  • CWE-19 Data Processing Errors
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.