CVE-2011-2526

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate…

published July 14, 2011

CVSS
—
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00699 · 52.3th percentile
Published
2011-07-14T23:00Z
EPSS history
Timeline
  • 14 JUL 23:00Z
    Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate…
    cvelistv5