CVE-2012-0022

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-01-19 · updated 2026-06-16
Weakness: CWE-189

Description

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.

Affected products

Apache Tomcat: 5.5.0, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5 (+84)

References

http://archives.neohapsis.com/archives/bugtraq/2012-01/0112.html
http://marc.info/?l=bugtraq&m=132871655717248&w=2
http://marc.info/?l=bugtraq&m=133294394108746&w=2
http://marc.info/?l=bugtraq&m=136485229118404&w=2
http://rhn.redhat.com/errata/RHSA-2012-0074.html
http://rhn.redhat.com/errata/RHSA-2012-0075.html
http://rhn.redhat.com/errata/RHSA-2012-0076.html
http://rhn.redhat.com/errata/RHSA-2012-0077.html
http://rhn.redhat.com/errata/RHSA-2012-0078.html
http://rhn.redhat.com/errata/RHSA-2012-0325.html
http://rhn.redhat.com/errata/RHSA-2012-0345.html
http://rhn.redhat.com/errata/RHSA-2012-1331.html

Get alerted when CVE-2012-0022 or the next vulnerability affects your stack