https://bugzilla.redhat.com/show_bug.cgi?id=1806849
--- Doc Text *updated* by Nick Tait <ntait(a)redhat.com> ---
The refactoring in 9.0.28 introduced a regression. The result of the regression was that
invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of
HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly
handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy
is considered unlikely.
It affects the versions of Apache Tomcat 9 (9.0.28 to 9.0.30), Tomcat 8 (8.5.48 to
8.5.50), and Tomcat 7 (7.0.98 to 7.0.99).
--
You are receiving this mail because:
You are on the CC list for the bug.