How many CVEs have patched parseHeader?

5 published CVEs changed parseHeader in apache/tomcat, in 13 distinct patches totalling 96 changed lines, between 2014 and 2023.

What is the latest CVE that changed parseHeader?

CVE-2023-45648 (Apache Tomcat: Trailer header parsing too lenient), published 2023-10-10, changed lines 507 to 626 of java/org/apache/coyote/http11/filters/ChunkedInputFilter.java.

How does parseHeader compare to the rest of apache/tomcat?

apache/tomcat has 135 CVEs with a located fix in total; 5 of them changed parseHeader.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

parseHeader in apache/tomcat: Patched by 5 CVEs

CVEs that patched it

Every published CVE whose fix changed parseHeader, newest first, with the lines each fix touched.

Apache Tomcat: Trailer header parsing too lenient
CVE-2023-45648 · java/org/apache/coyote/http11/filters/ChunkedInputFilter.java · lines 507–626 · +13 −1 in 3 hunks
Medium · CVSS 5.3
EPSS 5.9%2023-10-10
Apache Tomcat: Trailer header parsing too lenient
CVE-2023-45648 · java/org/apache/coyote/http11/Http11InputBuffer.java · lines 829–977 · +7 −1 in 2 hunks
Medium · CVSS 5.3
EPSS 5.9%2023-10-10
Apache Tomcat may reject request containing invalid Content-Length header
CVE-2022-42252 · java/org/apache/coyote/http11/Http11InputBuffer.java · lines 922–994 · +6 −10 in 3 hunks
High · CVSS 7.5
EPSS 1.6%2022-11-01
Improper Input Validation in Apache Tomcat
CVE-2016-6816 · java/org/apache/coyote/http11/Http11InputBuffer.java · line 789 · +1 −1
High · CVSS 7.1
EPSS 39.6%2017-03-20
Improper Input Validation in Apache Tomcat
CVE-2016-6816 · java/org/apache/coyote/http11/InternalAprInputBuffer.java · lines 389–502 · +3 −3 in 2 hunks
High · CVSS 7.1
EPSS 39.6%2017-03-20
Improper Input Validation in Apache Tomcat
CVE-2016-6816 · java/org/apache/coyote/http11/InternalInputBuffer.java · line 341 · +1 −1
High · CVSS 7.1
EPSS 39.6%2017-03-20
Improper Input Validation in Apache Tomcat
CVE-2016-6816 · java/org/apache/coyote/http11/InternalNioInputBuffer.java · lines 513–678 · +7 −7 in 7 hunks
High · CVSS 7.1
EPSS 39.6%2017-03-20
Improper Input Validation in Apache Tomcat
CVE-2014-0227 · java/org/apache/coyote/http11/filters/ChunkedInputFilter.java · lines 451–573 · +16 −11 in 6 hunks
Medium · CVSS 6.4
EPSS 21.0%2015-02-16
Apache Tomcat Denial of Service vulnerability
CVE-2013-4322 · java/org/apache/coyote/http11/filters/ChunkedInputFilter.java · lines 526–532 · +7 −0
Medium · CVSS 4.3
EPSS 9.5%2014-02-26

Get an alert when the next CVE fix lands in apache/tomcat, with the patched functions.

Monitor tomcat CVEs

parseHeader

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track apache/tomcat CVEs