Apache Tomcat: HTTP request smuggling via malformed trailer headers

CVE-2023-46589

Summary

An improper input validation vulnerability has been identified in Apache Tomcat, affecting several versions. This flaw arises from incorrect parsing of HTTP trailer headers, which can allow a single request to be misinterpreted as multiple requests. As a result, this can lead to potential request smuggling issues when the server is situated behind a reverse proxy. It is crucial for users to update to the fixed versions—11.0.0-M11 and onwards, 10.1.16 and onwards, 9.0.83 and onwards, or 8.5.96 and onwards—to mitigate this risk.

References