{"id":"CVE-2023-45648","published":"2023-10-10T18:38:34Z","modified":"2025-10-29T12:00:47Z","title":"Apache Tomcat: Trailer header parsing too lenient","vendor":"Apache","product":"Apache Tomcat","tier":"tail","description":{"text":"Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially \ncrafted, invalid trailer header could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.05883,"percentile":0.93204,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/10/10","tags":["x_transferred"]},{"url":"https://www.debian.org/security/2023/dsa-5522","tags":["x_transferred"]},{"url":"https://www.debian.org/security/2023/dsa-5521","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20231103-0007/","tags":["x_transferred"]}],"priority":{"score":27.4,"factors":[{"name":"EPSS percentile","points":18.64},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":3.71}]},"exploitSources":{"nuclei":[{"id":"CVE-2023-45648","name":"Apache Tomcat - HTTP Request Smuggling","severity":"medium","path":"http/cves/2023/CVE-2023-45648.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-45648.yaml"}],"provenance":"source"},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[">= 11.0.0-M1, <= 11.0.0-M11",">= 10.1.0-M1, <= 10.1.13",">= 9.0.0-M1, <= 9.0.81",">= 8.5.0, <= 8.5.93"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=11.0.0-M1, <11.0.0-M12",">=10.1.0-M1, <10.1.14",">=9.0.0-M1, <9.0.81",">=8.5.0, <8.5.94"],"patched":["11.0.0-M12","10.1.14","9.0.81","8.5.94"],"from":["GHSA-r6j3-px5g-cq3x"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","vulnerableRanges":[">=11.0.0-M1, <11.0.0-M12",">=10.1.0-M1, <10.1.14",">=9.0.0-M1, <9.0.81",">=8.5.0, <8.5.94"],"patched":["11.0.0-M12","10.1.14","9.0.81","8.5.94"],"from":["GHSA-r6j3-px5g-cq3x"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-coyote","vulnerableRanges":[">=11.0.0-M1, <11.0.0-M12",">=10.1.0-M1, <10.1.14",">=9.0.0-M1, <9.0.81",">=8.5.0, <8.5.94"],"patched":["11.0.0-M12","10.1.14","9.0.81","8.5.94"],"from":["GHSA-r6j3-px5g-cq3x"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-2799","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tomcat-cve-2011-0534","parents":[{"from":"CVE-2014-0227","to":"CVE-2023-45648","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http11/filters/ChunkedInputFilter.java"],"commits":["https://github.com/apache/tomcat/commit/593a2447e6ebe465585cfa07e93b5635dffa1c70","https://github.com/apache/tomcat/commit/59583245639d8c42ae0009f4a4a70464d3ea70a0","https://github.com/apache/tomcat/commit/8ecff306507be8e4fd3adee1ae5de1ea6661a8f4"],"basis":"shared function","functions":["parseHeader"]}]},{"from":"CVE-2016-6816","to":"CVE-2023-45648","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http11/Http11InputBuffer.java"],"commits":["https://github.com/apache/tomcat/commit/516bda676ac8d0284da3e0295a7df70391315360","https://github.com/apache/tomcat/commit/cdc0a935c2173aff60039a0b85e57a461381107c","https://github.com/apache/tomcat/commit/59583245639d8c42ae0009f4a4a70464d3ea70a0","https://github.com/apache/tomcat/commit/8ecff306507be8e4fd3adee1ae5de1ea6661a8f4"],"basis":"shared function","functions":["parseHeader"]}]},{"from":"CVE-2022-42252","to":"CVE-2023-45648","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["java/org/apache/coyote/http11/Http11InputBuffer.java"],"commits":["https://github.com/apache/tomcat/commit/0d089a15047faf9cb3c82f80f4d28febd4798920","https://github.com/apache/tomcat/commit/4c7f4fd09d2cc1692112ef70b8ee23a7a037ae77","https://github.com/apache/tomcat/commit/59583245639d8c42ae0009f4a4a70464d3ea70a0","https://github.com/apache/tomcat/commit/8ecff306507be8e4fd3adee1ae5de1ea6661a8f4"],"basis":"shared function","functions":["parseHeader"]}]}],"packageHistory":[{"cve":"CVE-2023-34981","published":"2023-06-21","fixed":"8.5.89","kev":false,"link":{"from":"CVE-2023-34981","to":"CVE-2023-45648","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"8.5.89","toFixed":"8.5.94","daysApart":111}]}},{"cve":"CVE-2022-42252","published":"2022-11-01","fixed":"10.1.1","kev":false},{"cve":"CVE-2023-46589","published":"2023-11-28","fixed":"11.0.0-M11","kev":false},{"cve":"CVE-2023-44487","published":"2023-10-10","fixed":"11.0.0-M12","kev":true},{"cve":"CVE-2023-45648","published":"2023-10-10","fixed":"11.0.0-M12","kev":false},{"cve":"CVE-2024-24549","published":"2024-03-13","fixed":"11.0.0-M17","kev":false},{"cve":"CVE-2024-34750","published":"2024-07-03","fixed":"11.0.0-M21","kev":false},{"cve":"CVE-2024-38286","published":"2024-11-07","fixed":"11.0.0-M21","kev":false},{"cve":"CVE-2023-24998","published":"2023-02-20","fixed":"11.0.0-M5","kev":false,"link":{"from":"CVE-2023-24998","to":"CVE-2023-45648","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"9.0.71","toFixed":"9.0.81","daysApart":232},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-coyote","fromFixed":"10.1.5","toFixed":"10.1.14","daysApart":232}]}}],"package":"Maven:org.apache.tomcat:tomcat-coyote"}}