https://bugzilla.redhat.com/show_bug.cgi?id=1806835
--- Comment #10 from Mauro Matteo Cascella <mcascell(a)redhat.com> ---
Mitigation:
Disabling keep-alive will prevent Tomcat from reading multiple requests from a
single TCP connection, and should also prevent Tomcat from handling any request
that was smuggled through the proxy in front of it. This can be done via the
`maxKeepAliveRequests` configuration setting of the HTTP Connector.
Apache httpd is often used as reverse proxy to enhance the performance of
high-load environments. When running Tomcat behind Apache httpd, consider the
`disablereuse Off` mod_proxy configuration setting, which can be used to
prevent Tomcat from keeping the connection between himself and httpd.
--
You are receiving this mail because:
You are on the CC list for the bug.