CVE-2014-0075

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 17.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-05-31 · updated 2026-10-14
Weakness: CWE-189

Description

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

Affected products

Apache Tomcat: through 6.0.39; 7.0.0, 7.0.0-beta, 7.0.1, 7.0.2, 7.0.2-beta, 7.0.3 (+100)

References

http://advisories.mageia.org/MGASA-2014-0268.html
http://linux.oracle.com/errata/ELSA-2014-0865.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-February/150282.html
http://marc.info/?l=bugtraq&m=141017844705317&w=2
http://marc.info/?l=bugtraq&m=141390017113542&w=2
http://marc.info/?l=bugtraq&m=144498216801440&w=2
http://rhn.redhat.com/errata/RHSA-2015-0675.html
http://rhn.redhat.com/errata/RHSA-2015-0720.html
http://rhn.redhat.com/errata/RHSA-2015-0765.html
http://seclists.org/fulldisclosure/2014/Dec/23
http://secunia.com/advisories/59121
http://secunia.com/advisories/59616

Get alerted when CVE-2014-0075 or the next vulnerability affects your stack