Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.apache.tomcat:tomcat(Maven) | 6.0.0 | 6.0.32 | N/A |
| org.apache.tomcat:tomcat(Maven) | 7.0.0 | 7.0.8 | N/A |
CVSS Metrics
