CVE

CVE-2023-45648

5.3

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

apache tomcattomcat

Updated Nov 10, 2026View on NVD →

S4E scanner

mediumProduct Based Network Vulnerabilities~10 seconds

Apache Tomcat - HTTP Request Smuggling

Apache Tomcat from versions 8.5.0 to 8.5.93, 9.0.0-M1 to 9.0.81, 10.1.0-M1 to 10.1.13, and 11.0.0-M1 to 11.0.0-M11 contain an improper input validation caused by incorrect parsing of HTTP trailer headers, letting attackers craft headers to cause request smuggling, exploit requires sending malicious trailer headers. References: https://lists.apache.org/thread/2pv8yz1pyp088tsxfb7ogltk9msk0jdp https://hackerone.com/reports/2299692 https://nvd.nist.gov/vuln/detail/CVE-2023-45648 Remediation: Upgrade to version 11.0.0-M12, 10.1.14, 9.0.81, or 8.5.94 or later.

url

Scanner page →Run scanner

CVE history: apache tomcat

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →