High
Apache Tomcat: HTTP request smuggling via malformed trailer headers
Type: advisorySources: OSV
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-46589
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 13:54 UTC · Revision 1
Source evidence
Apache Tomcat: HTTP request smuggling via malformed trailer headers
core-osv · Original sourcePublished 28 Nov 2023, 15:31 UTC
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.
osv:CVE-2023-46589
Complete source record
{
"id": "2880277f45a1903532065e90a7f872412b2c150049070a3dc1e124bdbca13d70",
"url": "https://osv.dev/vulnerability/CVE-2023-46589",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Apache Tomcat: HTTP request smuggling via malformed trailer headers",
"summary": "Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header size limit could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M11 onwards, 10.1.16 onwards, 9.0.83 onwards or 8.5.96 onwards, which fix the issue.",
"evidence": "osv:CVE-2023-46589",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2023-46589",
"aliases": [
"BIT-tomcat-2023-46589",
"CVE-2023-46589",
"GHSA-fccv-jmmp-qg76"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/tomcat",
"type": "GIT",
"events": [
{
"introduced": "e37b977db6f47e4380ad67114a49e8568951c953"
},
{
"fixed": "e9630c1fad9a72e7394872a2aeeb73627f821b6c"
},
{
"introduced": "16bf392c67833ad549733b58c350ff92b5ee782a"
},
{
"fixed": "be97b0e06e77226aea5eb2a7b448f1d53bda2aa1"
},
{
"introduced": "e9d17cddc285615807ec5fef09240777436b25dc"
},
{
"fixed": "db45aa20e1686827aa49a9062c775d266ef061d7"
},
{
"introduced": "59c81e30e2f64f5e8c1db78c4860c51850dfb0bd"
},
{
"last_affected": "de714a23642a4d0baef342db6762a7f7a550d82c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.5.0"
},
{
"fixed": "8.5.96"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.0.83"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "10.1.0"
},
{
"fixed": "10.1.16"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone1"
},
{
"last_affected": "11.0.0-milestone1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone10"
},
{
"last_affected": "11.0.0-milestone10"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone2"
},
{
"last_affected": "11.0.0-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone3"
},
{
"last_affected": "11.0.0-milestone3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone4"
},
{
"last_affected": "11.0.0-milestone4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone5"
},
{
"last_affected": "11.0.0-milestone5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone6"
},
{
"last_affected": "11.0.0-milestone6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone7"
},
{
"last_affected": "11.0.0-milestone7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone8"
},
{
"last_affected": "11.0.0-milestone8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*",
"range": [
{
"introduced": "11.0.0-milestone9"
},
{
"last_affected": "11.0.0-milestone9"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"11.0.0-milestone1",
"11.0.0-milestone10",
"11.0.0-milestone2",
"11.0.0-milestone3",
"11.0.0-milestone4",
"11.0.0-milestone5",
"11.0.0-milestone6",
"11.0.0-milestone7",
"11.0.0-milestone8",
"11.0.0-milestone9"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46589.json"
}
}
],
"modified": "2026-10-28T02:30:50.921976448Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2024/01/msg00001.html",
"https://www.openwall.com/lists/oss-security/2023/11/28/2",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46589.json",
"https://lists.apache.org/thread/0rqq6ktozqc42ro8hhxdmmdjm1k1tpxr",
"https://nvd.nist.gov/vuln/detail/CVE-2023-46589",
"https://security.netapp.com/advisory/ntap-20231214-0009/"
],
"provider_metadata": {
"cwe_ids": [
"CWE-444"
],
"cna_assigner": "apache",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "11.0.0-M1"
},
{
"last_affected": "11.0.0-M10"
},
{
"introduced": "10.1.0-M1"
},
{
"last_affected": "10.1.15"
},
{
"introduced": "9.0.0-M1"
},
{
"last_affected": "9.0.82"
},
{
"introduced": "8.5.0"
},
{
"last_affected": "8.5.95"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46589.json"
}
},
"related_cves": [
{
"value": "CVE-2023-46589",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 519535,
"published_at": "2023-11-28T15:31:52.366+00:00"
}