CVE-2012-5568

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-11-30 · updated 2026-10-09

Description

Apache Tomcat through 7.0.x allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.

Affected products

Apache Tomcat: from 7.0.0 through 7.0.105
Opensuse: 11.4, 12.1, 12.2

References

http://captainholly.wordpress.com/2009/06/19/slowloris-vs-tomcat/
http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
http://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
http://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
http://openwall.com/lists/oss-security/2012/11/26/2
http://tomcat.10.n6.nabble.com/How-does-Tomcat-handle-a-slow-HTTP-DoS-tc2147776.html
http://tomcat.10.n6.nabble.com/How-does-Tomcat-handle-a-slow-HTTP-DoS-tc2147779.html
http://www.securityfocus.com/bid/56686
https://bugzilla.redhat.com/show_bug.cgi?id=880011
https://exchange.xforce.ibmcloud.com/vulnerabilities/80317
http://captainholly.wordpress.com/2009/06/19/slowloris-vs-tomcat/
http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html

Get alerted when CVE-2012-5568 or the next vulnerability affects your stack