What’s Vulnerable › Vulnerabilities
CVE-2019-17569
- Severity: medium (CVSS 4.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 8.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-02-24 · updated 2026-08-25
- Weakness: CWE-444
Description
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Affected products
- Apache Tomcat: from 7.0.98 through 7.0.99; from 8.5.48 through 8.5.50; from 9.0.28 through 9.0.30
- Apache TomEE: 7.0.7
- Debian Linux: 9.0, 10.0
- NetApp Data Availability Services: all versions
- OnCommand System Manager 9.x: from 3.0.0 through 3.1.3
- openSUSE Leap: 15.1
- Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
- Oracle Corporation Oracle Agile PLM: 9.3.3, 9.3.5, 9.3.6
- Oracle Communications Instant Messaging Server: 10.0.1.4.0
- Oracle Health Sciences Empirica Inspections: 1.0.1.2
- Oracle Health Sciences Empirica Signal: 7.3.3
- Oracle Corporation Hospitality Guest Access: 4.2.0, 4.2.1
- Oracle Instantis Enterprisetrack: from 17.1 through 17.3
- Oracle Corporation MySQL Enterprise Monitor: through 4.0.12; from 8.0.0 through 8.0.20
- Oracle Corporation Transportation Management: 6.3.7
- Oracle Workload Manager: 12.2.0.1, 18c, 19c
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html
- https://lists.apache.org/thread.html/r7bc994c965a34876bd94d5ff15b4e1e30b6220a15eb9b47c81915b78%40%3Ccommits.tomee.apache.org%3E
- https://lists.apache.org/thread.html/r88def002c5c78534674ca67472e035099fbe088813d50062094a1390%40%3Cannounce.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rc31cbabb46cdc58bbdd8519a8f64b6236b2635a3922bbeba0f0e3743%40%3Ccommits.tomee.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html
- https://security.netapp.com/advisory/ntap-20200327-0005/
- https://www.debian.org/security/2020/dsa-4673
- https://www.debian.org/security/2020/dsa-4680
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html
Get alerted when CVE-2019-17569 or the next vulnerability affects your stack