CVE-2019-17569: apache apache tomcat
Vulnerability summary
CVE-2019-17569 is a medium (CVSS 5.8) vulnerability in apache apache tomcat. EPSS estimates a 8.87% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities.
Not severe (CVSS 4.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 8Timeline
- 24-02-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · MavenEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- NVDNIST4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
8.87%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
No change 0.00 pp
From 8.87% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle10 products
- agile_engineering_data_management6.2.1.0
- agile_product_lifecycle_management9.3.3 | 9.3.5 | 9.3.6
- communications_instant_messaging_server10.0.1.4.0
- health_sciences_empirica_inspections1.0.1.2
- health_sciences_empirica_signal7.3.3
Apache3 products
- apache tomcatApache Tomcat 9.0.28 to 9.0.30 | 8.5.48 to 8.5.50 | 7.0.98 to 7.0.99
- tomcat≥ 7.0.98, ≤ 7.0.99 | ≥ 8.5.48, ≤ 8.5.50 | ≥ 9.0.28, ≤ 9.0.30
- tomee7.0.7
Debian2 products
- tomcat9< 9.0.31-1
- debian_linuxEOL9.0 | 10.0
Netapp2 products
- data_availability_servicesna
- oncommand_system_manager≥ 3.0.0, ≤ 3.1.3
Opensuse1 product
- leapEOL15.1
Org.apache.tomcat1 product
- tomcat≥ 7.0.98, < 7.0.100 | ≥ 8.5.48, < 8.5.51 | ≥ 9.0.28, < 9.0.31
Org.apache.tomcat.embed1 product
- tomcat-embed-core≥ 7.0.98, < 7.0.100 | ≥ 8.5.48, < 8.5.51 | ≥ 9.0.28, < 9.0.31
7 vendors · 20 products
References
16 links
lists.debian.org/debian-lts-announce/2020/03/msg00006.htmlMailing ListX Refsource MLISTWEBThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
