--- Doc Text *updated* by Eric Christensen <sparks(a)redhat.com> ---
A flaw was found in Apache Tomcat versions 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50, and 7.0.0
to 7.0.99. The HTTP header parsing code used an approach to end-of-line (EOL) parsing that
allowed some invalid HTTP headers to be parsed as valid. This led to the possibility of
HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly
handled the invalid Transfer-Encoding header in a particular manner. The highest threat
with this vulnerability is system availability.
You are receiving this mail because:
You are on the CC list for the bug.