VYPR
← All advisories
Moderate severityNVD Advisory· Published Jul 5, 2005· Updated Jun 16, 2026

CVE-2005-2090

CVE-2005-2090

Description

Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat:tomcatMaven
>= 5.0.0, <= 5.0.19—
org.apache.tomcat:tomcatMaven
>= 4.0.0, <= 4.1.24—

Affected products

3
  • Apache/Tomcat2 versions
    cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:tomcat:4.1.24:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:tomcat:5.0.19:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.apache.tomcat/tomcat
    Range: >= 5.0.0, <= 5.0.19

Patches

Vulnerability mechanics

References

60

News mentions

0

No linked articles in our index yet.