7.5

CVE-2022-42252: Apache Tomcat request smuggling via malformed content-length

Modified
AliasesSUSE-SU-2022:4193-1SUSE-SU-2022:4303-1UBUNTU-CVE-2022-42252
Published 01-11-2022Last modified 06-05-2025

Vulnerability summary

CVE-2022-42252 is a high (CVSS 7.5) vulnerability in apache software foundation apache tomcat. EPSS estimates a 1.78% chance of exploitation in the next 30 days, higher than 78.2% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.78%
0%100%
Low · +0.24 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9 · Related 5
DLA-3384-1DSA-5381-1MGASA-2023-0138OPENSUSE-SU-2024:12534-1OPENSUSE-SU-2024:13441-1RHSA-2023:1663

Timeline

  1. 01-11-2022
    PublishedVulnerability first disclosed.
  2. 06-05-2025
    Last modifiedVulnerability information updated.

Description

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

1.78%

Chance of exploitation in the next 30 days

Percentile

78%

Versus all other CVEs

30-day change

Increase +0.24 pp

From 1.54% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse8 products
  • tomcat&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 8.0.53-29.57.1
  • tomcat&distro=SUSE Linux Enterprise Server 12 SP3-BCL< 8.0.53-29.57.1
  • tomcat&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 9.0.36-3.93.1
  • tomcat&distro=SUSE Linux Enterprise Server 12 SP5< 9.0.36-3.93.1
  • tomcat&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 9.0.36-3.93.1
Ubuntu2 products
  • tomcat8< 8.5.39-1ubuntu1~18.04.3+esm1
  • tomcat9< 9.0.16-3ubuntu0.18.04.2+esm1 | < 9.0.31-1ubuntu0.5 | < 9.0.58-1ubuntu0.1+esm1
Apache1 product
  • tomcat≥ 8.5.0, < 8.5.83 | ≥ 9.0.0, < 9.0.68 | ≥ 10.0.0, < 10.0.27 | ≥ 10.1.0, < 10.1.1
Apache software foundation1 product
  • apache tomcat≥ 10.1.0-M1, ≤ 10.1.0 | ≥ 10.0.0-M1, ≤ 10.0.26 | ≥ 9.0.0-M1, ≤ 9.0.67 | ≥ 8.5.0, ≤ 8.5.82
Debian1 product
  • tomcat9< 9.0.68-1
Org.apache.tomcat1 product
  • tomcat-coyote≥ 9.0.0-M1, < 9.0.68 | ≥ 10.0.0-M1, < 10.0.27 | ≥ 10.1.0-M1, < 10.1.1
Org.apache.tomcat.embed1 product
  • tomcat-embed-core≥ 8.5.0, < 8.5.83 | ≥ 9.0.0-M1, < 9.0.68 | ≥ 10.0.0-M1, < 10.0.27 | ≥ 10.1.0-M1, < 10.1.1

7 vendors · 15 products

References

19 links
Show all 19 references